alt Hacker NewsFridges in French supermarkets hit by cyber attack
Comments
This is pretty interesting as the Danfoss vulnerability was suspected to be related to a similar situation that occurred across US military bases in late August 2026.
https://signalandsilence.substack.com/p/i-think-someone-hack...
Could this be the same group? Or someone inspired by reading that article? Or just entirely unrelated?
Interestingly, a major Dutch supermarket was also hit by a yet-undescribed cyberattack, prompting them to basically shut down every IT system. So not a hack of a control system, sounds more like an ordinary ransomware attack... but still tantalizing that two EU countries have their food supplies targeted the same day... the day of a big NATO "russia we dont mess around" conference, too.
Looks like that specific vulnerability was found this summer, disclosed in coordination with the vendor and at least some models were patched [0] (unclear if all models were), but from early reports:
- they either didn't warn their customers this was a critical security patch, - many of these fridges/freezers were directly accessible on the internet with their own 3G/4F SIM cards without further protection!
Crazy stuff
[0] https://www.claroty.com/team82/research/freeze-the-controlle...
Watch Dogs was ahead of its time. How long before one of these hacker groups claim the DedSec name as their own?
These are fridges in supermarkets, not home fridges. I think a supermarket capable of administering many fridges can put their big boy pants on and handle the potential downsides of controllability.
Something different came to mind as I read this article - there has been recent chatter regarding impending Food security issues - it was even talked about by India's foreign minister recently:
https://www.thehindu.com/news/national/eam-jaishankar-warns-...
I wonder if this attack is some kind of early warning about capabilities of disruptive forces.
Previous discussion https://news.ycombinator.com/item?id=50055304
Supermarkets in the Netherlands were also hit. Seems like a Russian linked attack.
Good. I’m not happy that this happened. That’s a large financial loss. I don’t like thinking about all the good, edible food thrown away instead of nourishing people. But the infosec thing that keeps me up at night is the utter lack of SCADA security. “Relax! This dam won’t collapse as long as no one guesses our public IP address!”
Lots of industrial controls haven’t been updated since they were deployed in the 90’s. “And why should they be? If it ain’t broken…” Well, because they’re freaking broken!
So I’m glad that this happened in a tangible, public way people can easily understand without it involving something much more drastic. If your family asks about this, explain that you’re glad no one blew up a gas pipeline… yet.
It really, really irks me that in one of the articles about this, it mentions the manufacturer pointing to "outdated firmware", and even comments here demeaning the store for not "securing" their __refrigerators__. Read that twice, and think how many times this silliness could apply to far too many objects in our lives.
Very few things should be networked, or at the very least, not with any sort of control. I can't even blame the average person anymore for not being as aware about technology, unless there's some sort of aggression or dismissive responses when they're informed of the risks or potential risks. Software developers at this point may very well end up being as despised as lawyers or bankers, for not broadly enough condemning this sort of technological creep, but for being that guy smugly saying something about firmware updates ... on a refrigerator.
This thing is addressing problems that don't exist. It's solutionism at its worst. We are dumbing down machines that are inherently superior.
> The software allows retailers to manage their cold units remotely.
Will they never learn?
Of all the things to put on a network, this ranks as one of the dumbest, ever. You don't need control of the unit done over a network, just the data on whether it is working or not. Anything else is simply asking for someone else to come along and break your stuff.
To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.
Maybe, just maybe, fridges shouldn't be online. Cue immediate responses of: but don't you understand, management can now monitor it 24/7 and adjust in real time. To which I have about the same response:
Maybe they shouldn't.