HN

Need help?
<- Back
Supermarket freezers across Europe hit by second suspected cyber-attack

Supermarket freezers across Europe hit by second suspected cyber-attack

fergie

Comments (319)

  • chromaton
    As I mentioned in the thread regarding the previous attacks, I worked in a closely related field back in 2008-2009.One thing I see repeatedly brought up here in this discussion is "Why can't we just set the refrigerator temperature with a knob and walk away?"The problem is that these refrigerator cases are not as simple as your refrigerator at home. As a simple example, many systems allow you have control over the deadband: the exact low temperature at which the compressor turns off and the high temperature at which the compressor turns back on. You also have control over defrost cycles, compressor pressure and many other things (I worked with this a long while ago, and I don't remember all the details).Take a look at some of these manuals, for example: https://www.hillphoenix.com/resource/installation-manuals-2/... As far as I can tell, those manuals just cover the refrigerator cases, and not the outside compressors and heat exchangers, which are another layer to deal with.This is not something that a non-expert supermarket employee would be able to handle well. The purpose of all these settings is optimize around energy usage, maintenance costs, customer experience, etc. Even if you only save $500/store/year, you can see that it really adds up over a chain of 1000 stores.That's why this equipment is remotely accessible: it's not like your fridge at home and requires a lot more knowledge to get the most out of it. Of course, that does not excuse poor security implementations.
  • the-mitr
    After hearing of such attacks, I always wonder what is the possible benefit anyone gets from acts like these
  • fritzo
    Bless those hackers for firing a warning shot over our freezers, that we may take heed and secure our neonatal care units, stoplights, and air traffic controllers.
  • bedstefar
    I'm extrapolating a bit here based on Reddit hearsay, but I think this may have to do with rural stores having essentially consumer-grade internet routers connected to the mobile broadband network.Much of the coverage in Swedish media drives the point that only 4G-uplinked stores have been hit so far. I think that's unfortunate, because really it wouldn't have differed if these stores were connected by 5G.I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router. In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN, so my guess is that these control systems were simply findable on Shodan.This also explains why this wasn't discovered after the recent French breach. Supposedly all the stores with "proper" uplinks were in compliance, and no one had thought of a way in for those non-compliant stores, because they "weren't even connected, so how would an attacker get in?"
  • hackingonempty
    Back in 1995 this was so improbable it was one of the purported negative effects of the "Good Times" virus which was a parody of the virus warning e-mails that were being forwarded around at the time. Computers still can't give you Dutch elm disease, fortunately.> It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty.https://people.cs.rutgers.edu/~watrous/goodtimes-spoof.html
  • jttnr
    Discussion from 3 weeks ago on the refrigerator "hacks" in the french supermarkets:https://news.ycombinator.com/item?id=50055304 (~1000 comments)
  • great_psy
    I wonder if this might point to some efficiency loss coming from AI. Let me explain.Say in 2015 they installed those smart refrigerators, they could go from 20 people monitoring temperatures to 1. That was some profits being made by those companies, and they got to enjoy those benefits until now.With AI finding exploits for so many things people wouldn’t spend time looking, we might need to go back to dumb fridges out of security concerns.Now extrapolate to many other industries, the economic gain from AI might be hampered.
  • liveoneggs
    Why isn't the brand of cooler or cooler-controller being named?Was it a password break or an open admin console or SNMP or what?
  • c16
    How did every supermarket chain around the world not jump at this and investigate?
  • pbohun
    This is what happens when you over-optimize and over-automate. You should just be able to plug those freezers into power and turn a knob to set the temperature. There is no reason for them to ever have an internet connection.
  • ilkkao
    This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time. Or to take the freezers offline if an update isn't available.I now read some interviews with local chains in Sweden and Finland, and they were still just investigating what to do at this point.
  • andy_ppp
    Maybe we should stop connecting things to the Internet that don't need to be?
  • Kuyawa
    If you definitely need to connect them to the internet, make them read only?I was talking yesterday to my AI imaginary friend about creating an MCP for one of my apps, and the first thing she told me was to make everything read only. No matter how many security layers you have in place, passwords, auth libs, whatever, it will be leaked/hacked so you better be prepared for minimum damageMonitor your freezers temperature? yes, but never allow their thermostat to be set over the internet. I hope the lesson is learned. Applies to all appliances
  • marttt
  • ocd
    I've fantasized a long time about a clearer separation of technology from life, since it's been depicted in some ways I appreciated in fiction. But at this point, I'd just take a set of laws around what types of items should ever have any sort of networking.
  • rocqua
    Also hit a few smaller business in The Netherlands: https://nltimes.nl/2026/11/02/fridges-freezers-17-dutch-busi...With the following interesting quote from the supplier of the system:After that attack, Danfoss advised its Dutch clients on October 13 to disconnect their systems from the internet and ensure they only reconnect via a secure network. “Most stores took action at that time, but a small number did not,” the spokesperson said. “They are now the ones suffering the consequences.” The spokesperson added that the systems hit last night were not on a secure network and were still using default passwords. The attack could have been prevented if measures had been taken, he said.
  • pluc
  • bordercontrol
    > Danfoss said it had identified security flaws last year and had “long recommended” customers install updates.This is a cyber-attack made possible through severe negligence on the victims’ part. It’s like a home burglary where the victim left the door wide open for months without ever checking on their home.Therefore, the news should be about that negligence. That's the interesting part.
  • puszczyk
    I wonder if the companies affected this time missed the news about the French attack a few weeks back?
  • mrweasel
    There was an interview with an angry store manager, he's mad at the attackers, but I didn't hear the media ask him why they didn't improve security after the French attacks. Only now do they appear to want to start a review of their monitoring system.https://www.svt.se/nyheter/lokalt/skane/icas-kylar-och-frysa...
  • hackersnooze1
    Thats interesting something similar happened at military grocery stores in the US a couple months ago
  • vpaulus
    Every time I read news like this I am wondering what an average household has hanging on the internet, totally vulnerable.
  • imjonse
    They must have learned from the last incident and made the password slightly harder to guess.
  • electroweak
    I would love to read about how insurance premiums are driving technology changes, in general. How insurance companies are tabulating risk from AI hacking. Risk of noncompliance probably brought the store operators to networked fridges, how is the network risk evaluated in general?Insurance risk and premiums might be the main drag on the AI future.
  • pluc
  • Sol-
    What's the incentive here? Just some tech anarchism? I would have figured that they at least demand bitcoin to reverse it or something. I know, people will blame the Russians, but seems not super productive for them to do such mundane sabotage on such non-critical systems.
  • lbcadden3
    Not everything needs to be connected to the internet.
  • physhster
    You'd have thought all supermarkets would have audited their refrigeration vendors, or at the very least firewalled vulnerable controllers... Oh well...
  • 1970-01-01
    This is actually good news. Accountability is everything when it comes to food supply. Forcing people to witness spoiled food is the slap people need to feel else they will never take action. The prolific insecure code that is keeping you from eating today will always be fixed.
  • totetsu
    Hope all the fridges in hospital keeping medicines at exact temperatures are better protected these days then they used to be.. The can't exactly be air-gapped wither as they need monitoring for compliance etc.
  • gvieri
    It's a really a bad thing ... It's not the first time that these kinds of attack hit the European markets. So I ask to myself why in earth managers don't learn from the bad experiences of other countries/people.
  • noja
    Will the insurance pay out on this? It would be negligent to have this exposed to the internet - was it?
  • kzrdude
    It happened in France on 12 October: https://www.bbc.com/news/articles/crq5nzxv9q4yo
  • dark-star
    > a deliberate attempt to disrupt our food supply chain and undermine consumersI would bet that if it will ever be resolved, it will turn out to be just some bored kids[] who read the recent report from France and had access to Shodan and a competent AI model.[] I'm using the term "kids" loosely here, not refering to a certain age group but to a certain mindset, similar to the original term "hacker"
  • the__alchemist
    Holy fuck don't connect your freezer to the internet. And if you do, have it be read-only, not change settings. Did we learn nothing from Battlestar Galactica?
  • tensegrist
    i know some of us are thinking "if you consistently fail to ensure your ability to make high-severity security patches reach critical internet-exposed systems on time you lose your ability to operate the business and probably get jail time"but what about the deranged (and very prediction market–brained) version of this idea: the government develops ransomware, in a manner functionally similar to towing cars or confiscating illegal items, and uses it against companies in proportion to their revenue and obviously puts the money towards improving the ransomware"the r in rsi stands for…"i'm not sure it's something i want to see, but i don't know if it's impossible for it to actually come to pass or merely unlikely(of course, cross-government versions of this are much more likely to come about but not as ransomware)
  • amelius
    This is exactly the kind of thing we've all been warning about ...(... in hacker forums)
  • elorant
    Why the fuck does a freezer need access to the Internet in the first place?
  • insane_dreamer
    maybe we'll start going back to _not_ having all devices connected to the internet "just because we can"
  • 2OEH8eoCRo0
    Instead of pointing the finger at supermarkets we should point it at ourselves. Why the hell is anything computer related still so difficult? Even in this thread I see varying advice like airgap, VLAN, or VPN. Well which is it?!We keep blaming store owners for not being IT wizards.
  • helsinkiandrew
    Hack my freezers once, shame on you, Hack my freezers twice shame on me.
  • spenjovewkwhalo
    Why can a fridge go to 50ºC ?!
  • techpression
    My fridge beeps loudly when something is wrong, and it has no connectivity to any network. Exactly how a fridge is supposed to be, why are we reinventing fridges…
  • pilif
    Unpopular opinion: Accessing a public service with public default credentials is not a cyber attack but a consequence of severe misconfiguration. This is on the supermarkets, not on the attackers.
  • ChrisArchitect
  • plaguuuuuu
    Not officially at war (or even cyberwar) but... are we at war?What sort of electronic shitfight is about to go down between major powers?
  • torh
    "Fool me once, shame on you, fool me twice, shame on me." But it should have been, like Bush said: "Fool me once, shame on — shame on you. Fool me — you can't get fooled again."
  • HexnMarcusWolfe
    ... Who the fuck is putting this shit on a network that's not closed circuit?
  • thrance
    Why the previous attack wasn't a strong enough signal to make every European retailer unplug their freezers from the internet is a mystery to me.
  • ck2
    here's hoping no country is stupid enough to have an ICBM on the internetbut you just know someone will eventually if not alreadybecause some vendor thought it would be easier for monitoring or firmware update
  • lifestyleguru
    Admin interface available on the internet without 2fa and automatic password change once a week? Anyone gaining sufficient experience and seniority in the industry becomes instantly unemployable, so it is what it is.
  • wronglebowski
    It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?
  • SecretDreams
    Two things:1) I hope they learn some hard lessons about security and what should be exposed to the internet vs LAN.2) These are some evil ass people doing this shit.
  • thatsabadlook
    Can't tell if it will be some asshole hacker group, Russia, the us, or what. But for the love of God please stop connecting everything to the Internet and also ai...
  • parsatomosu
    imagine that happens to a nuclear reactor
  • draxen
    [dead]
  • joshka
    [flagged]
  • Um_air
    [flagged]
  • metalman
    [dead]
  • Jmstdy95
    that's insane, they just got hit recently right?
  • wjnc
    The magic question is: why isn’t this fixed yet? And then the specifics, the nitty grift of why not. Thousands of industrial fridges. They presumably all need new hardware, or at least tenporarily all need a RPi with additional software on the network cable, or it could even worse… are they on regular company wifi? Don’t these companies have VLANs? It’s astonishing that this is what brings billion dollar companies in a key supply chain down.This little gimmick cost Ahold in the Netherlands an estimated 300 M€ a few weeks back. Enough money for any firm to set the engineers to work? Where they waiting it out? Having read some more… another part of Ahold (the Belgian part) was hit and has (only now…) taken all fridges down from the internet. What is IT risk doing in a firm like that? Internet of Shit is a decade old. I am not amazed non tech sectors are perhaps a bit slower in IT risk management. I am amazed that an ongoing attack situation can still cause trouble 4 months after publication and months after board level headline grabbing numbers are widely publicized.Me and my crew (yet to form ;) will visit any fridge for a measly 100 K€ a pop to take them offline. Book early, because once the script kiddies hit, we are on the road.
  • zerozerotwo
    Considering how Europe has embraced huawei and I saw a lot of their gear in consumer use when I was there, I’d be interested in seeing the Ben diagram of huawei gear and impacted stores
  • fergie
    Hackers remotely override settings on thousands of freezers, fridges and chiller cabinets, pushing them from as low as -27C to well over 50C. Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains among those affected.