Hacker News

> The problem is that these refrigerator cases are not as simple as your refrigerator at home. As a simple example, many systems allow you have control over the deadband: the exact low temperature at which the compressor turns off and the high temperature at which the compressor turns back on. You also have control over defrost cycles, compressor pressure and many other things (I worked with this a long while ago, and I don't remember all the details). … This is not something that a non-expert supermarket employee would be able to handle well.

I still don't see why the expert has to be remote, or why an integrated computer can't do the optimization. Or why it needs to be fiddled with at any significant frequency.

> Even if you only save $500/store/year, you can see that it really adds up over a chain of 1000 stores.

People always say stuff like this, but it never tracks for me. If you’re a chain with 1,000 stores, $500,000 is barely a blip on your budget sheet in exactly the same way that $500 is barely a blip on the budget of a single store.

Plus there’s no way this remote management stuff doesn’t cost at least $500/store in operating costs.

And how much money the shop looses from the attack? It sounds it wiped out all the saving remote automation brought.

If only 50$ of those savings were invested in Tailscale.

I don't see why saving $500 per store a year is better than exposing your systems to cyber attacks.

And yet... if they had instead invested in making the equipment operable locally we wouldn't be here today. This is the problem with thinking of your users as "nontechnical" lesser beings. The engineering problem becomes remove control and ownership from the user instead of make the product usable. In this case by removing control from the user they simply gave it to an attacker. Great job, guys.

Bosses at hospitals, towns, and airports/ARTCCs: Why would we secure our stuff? They're hacking into freezers, not our computers.

Sadly, the exact same hack happened in hundred of french grocery stores three weeks ago. I question people's ability to fix this kind of issues

and electric stations, municipal water pumps, cellular networks, over-the-air software updates to your car ...

"... I think this may have to do with rural stores having essentially consumer-grade internet routers connected to ..."

It has to do with refrigerators reachable on the Internet.

If the refrigerators were not reachable on the Internet, none of this fragility would exist.

The fragility of refrigerators reachable on the Internet was demonstrated just a few weeks ago. These refrigerators were left connected to the Internet.

This lack of discernment and misunderstanding of risks and fragility will not be solved with a better router or a different uplink.

Many of these smaller stores (and probably some of the larger ones too) rent or lease refrigeration equipment from one of a handful big providers. These are large and expensive systems, and there is costly paperwork involved together with logistics suppliers to show that the cold chain is satisfactory.

These refrigeration providers work with local contractors and HVAC companies to set things up. Their installation techs do what they think is required to remotely operate these systems. If you bring up the question keeping these systems offline or at least on airgapped networks you will most likely get a shrug as reply.

This is not a technology problem. This is problem of responsibility. One can hope things will improve when litigation starts happening, but it doesn't look good considering these people had literally months of notice since the well-publicized attacks on the American fridges, then the French fridges, and now these.

All of the fridges stayed online after the hack. I ran a Shodan scan a few days later, and the number of reachable fridges actually increased. The first hack might have been a surprise, but anyone who was IT in a refrigerator management company should have been able to run a (free) Shodan scan like mine and get the whole list.

> I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router.

Why would there be accidental port mappings on their router though? I could maybe see owners setting it up so they could monitor from home, but even that is a bit of a stretch for rural supermarket owners

absolutely unbelievable (even by the very low standards I see, being in iot myself) that any commercial equipment would be doing upnp

someone manually poking a hole in their firewall is way more likely

Somebody made that into a song. Never knew where the lyrics came from.

https://open.spotify.com/track/1mvK5h91yWsm97sAugKy6K?si=wXw...

Thanks! Macroexpanded:

Hackers activate automatic defrosting in supermarket fridges across Europe - https://news.ycombinator.com/item?id=50055304 - Oct 2026 (1007 comments)

I think the military commissary's freezers were hacked - https://news.ycombinator.com/item?id=49508506 - Aug 2026 (239 comments)

https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/

The real issue is geniuses in food stores connecting to the open internet systems with 100K+ EUR of products exposed.

Remember, the 'S' in 'IoT' stands for Security.

In the attack on French supermarkets a few weeks ago, hackers pirated controllers mostly supplied by the Danish company Danfoss.

In France I believe that the password on the monitoring software, or the controllers, was updated daily. The date was somehow used as the new password, or as an input to the password sequence. So rolling the passwords didn't do anything when the attackers are aware of the "algorithm".

The BBC names (and quotes) Sabcobel as one of the manufacturers.

https://www.bbc.co.uk/news/articles/cq1kd1nee80eo

Probably most of them had exactly zero inhouse expertise in cybersec and just pretended there’s nothing to worry about because having to worry would be inconvenient. Maybe some of them made a call to their cold chain supplier and were told that there’s nothing to worry about.

I wonder how many people working in any given supermarket chain actually know that their fridges are connected to a network at all.

have you seen how big enterprises operate? It would generally take much longer from a decision to do something to any action happening, budget approvals etc.

And for anything infosec, unfortunately people who know a lot about infosec have a habit of 'crying wolf' and talking about infosec as some kind of absolute rule that everything has to bow down to with no willingness to balance against other business risks, so probably leadership is used to ignoring the people who knew that this was a big deal and were calling for action.

Their cybersecurity departments (next to fresh produce) are all over this.

Snark aside, supermarkets are not in the tech business. The extent of their involvement is ringing their IT vendor to complain about it.

I wouldn't be surprised if its their own agencies hacking these systems preemptively in order to force the issue and increase robustness against a larger multi-pronged attack.

I’m still trying to figure out why these freezers are connected to the Internet in the first place…

I don't understand why these things aren't on their own (V)LAN. Why they are open to internet?!

Isn't it more than logical for a store manager to be upset?

At the human being level, this attack is mind boggling. What do you get out of this, other than making good food go to waste?

Edit: Also keep in mind that there's franchising in supermarkets as well. So the guy might literally be looking at losing a chunk of money as a result of something out of his control. Doesn't change the situation, but not having done something doesn't make them deserve this...

The store managers don't manage the IT security of the chain though.

Destabilising.

We can’t get food in the supermarket. People get scared. Better not poke the bear. This government sucks, let’s get the populist one that will fix all this overnight somehow.

My pet theory is an internal OpenAI/Anthropic agent swarm decided meat is unethical, escaped the sandbox, and started attacking supermarket freezers :)

Many of the previous cyberattacks were actually coming from the AI labs (RubyGems, HuggingFace, Australian medicare, PyPI, gym class software, code repositories, etc).

Possibly Russia looking to destabilize Europe.

It's probably whitehat ops to garner political support for cybersecurity bills the public would otherwise dismiss

>Or to take the freezers offline if an update isn't available.

Why the heck would this be necessary? We have VPNs holy crap, the entire genesis of the technology was to solve this fucking problem. If it's not literally intended for the general random public to be able to randomly visit and use themselves, it shouldn't be exposed on the public internet it should be (heavily restricted) LAN-only with remote access done via VPN. While it's even better if every single last thing is well secured at the client-level too, it goes a long way with ancient (or new, but with ancient-equivalent software design expenditure/decisions) kit to protect it at the network level.

Creating a false binary of "take it offline!" when businesses have very good reasons for networking many classes of industrial hardware seems self-defeating vs "just get the cheap bare minimum basic network protection done". I mean shit, even if somehow they've gotten suckered into freezers which demand access to a non-self-hostable manufacturer server (hey EU! here's something useful to regulate! if nothing else order manufacturers to have WireGuard end points for connection) they could at least have the firewall allow !RFC1918 solely and exclusively to that address on those ports.

Why do supermarket freezers need to be on the internet in the first place? A freezer has one job right.. keep things cold :/

They deserve to get burned and should get a hefty fine as well. I'm fed up with businesses completely ignoring all basic security and then blaming culprits for hacking them.

I don't care whether it's the Russians, Chinese, Norks or script kiddies. This should never have happened, especially since a similar incident happened in France three weeks ago so they got ample time to prepare themselves. They just don't care.

I do work in the retail refrigeration world nowadays and "just updating the software" is much easier said than done. I'm usually touching grocery stores with 20+ year old hardware from the dawn of centralized control and monitoring. It's not s trivial thing to rip out the controllers and install new ones.

This very likely first happened in the USA at military commissaries in August. https://www.stripes.com/theaters/us/2026-09-01/army-cid-inve...

Has anyone determined if these were separate from the attacks on US military PX refrigeration that happened well before that?

Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

>This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time.

Came into the thread thinking it would be a new report about the same incident not a new one, yikes.

To be fair, wouldn't the chains probably be reliant on their vendors for an update? and turning off all the fridges for weeks is probably not a sustainable solution... :/

Yeah was about to say, if your a major chain this is on you

In the case of France, the vulnerability was announced in August, 2025.

I believe gigantic fines are appropriate. They need to be of a size where the entire management team has significant financial issues for many years to come, even after having sold their houses, big cars, etc.

Nothing will improve until there are personal consequences.

The temperatures of these freezers need to have a centralised audit trail, to comply with foodchain regulations. While such an audit trail could be built without Internet, Internet seems like an obvious solution.

The true problem doesn't lie with Internet access, it lies with low quality software.

The reason is because the optimisation and automation means that there are no staff in the stores qualified to 'turn the knob' (and it is more complicated than that). What is the store to do, employ full-time knob-turners? They won't even pay for the uniforms of shelf packers or give them two toilet breaks on a shift.

It's useful to have a central monitoring system, so you can detect if a particular device fails so you can dispatch someone to fix it, move the stock elsewhere, etc. Of course, such systems can also be weaponised against you, as this proves.

I'm not saying I think the benefits outweigh the risks but to say there is no reason is to just be willfully ignorant.

even with remote access, they shouldn't have controls that allow for unsafe conditions.

It's more just what happens when you don't have sensible monitoring and/or incident response.

> There is no reason for them to ever have an internet connection.

You can't know this.

> There is no reason for them to ever have an internet connection.

How do you remote control the temperature without having any remote connection to them?

Have you worked in a small rural grocery store ever? You speak confidently about what they need/don't need, but you fail to account for a very basic use case, making me unsure if you actually know what you're talking about or not.

I believe it's industrial protocols used to connect such devises to a SCADA system. It this case it's the SCADA system that has to be disconnected from any general purpose networks.

They do it to take advantage of energy price fluctuations, but the connection should be more secure. What makes no sense is not having a fallback to take the freezers offline after the attack, so their solution is to just fully turn them off?

No joke, yes they did. The markets hit here in Sweden are all in rural communities with very low number of tech workers. They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.

Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT of course but they usually do POS and desktops/servers.

The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

The bizarre thing is it is the second time for Delhaize, although the incident of two weeks ago was related to the pricing system.

After the PHP vulnerability, we got some clients asking if our SaaS product used PHP (it didn't). It's possible that they just contacted their vendor, who assured them that everything was fine.

Also https://news.ycombinator.com/item?id=50335324 - my submission, I linked here since this is the better thread.

Russian hybrid warfare focuses on stoking fear and unrest.

Basically making everything more shitty, and having people walk on eggshells - so that they'll vote for isolationist parties that are either neutral, or will outright appease Russia.

The idea is that no-one in Europe actually wants to go to war with Russia, and small remainders like these is enough to increase that fear.

It's very simple. Anything that hurts the enemy is good. That includes the civilian population. Actions like this increase general discontent, produce negative economic impact and divert attention from other areas.

And the required investment is minimal.

Invading Ukraine is not productive either, yet they are still at it murdering Ukrainians for four years and counting.

General unrest, as well as stress testing critical infrastructure, and perhaps most importantly shifting the window for what counts as acts of aggression that don't trigger retaliation.

Seems likely that its either a capability demonstration for a future extortion campaign, or some kind of state-level hybrid warfare. In the latter case the obvious culprit is Russia, to create fear and social disruption.

Or another ai has broken containment and has a fixation about freezers...

These fridges were easy enough to hit that it could just be bored teens fucking around with shodan.

> I know, people will blame the Russians, but seems not super productive for them to do such mundane sabotage

It is staggering to me the difference in people that come to HN.

This is one of the thousands of ways a hybrid war is fought!

When you are 16, the incentive is just to feel power.

Not saying we know anything about who did it, but senseless vandalism is usually a hallmark of kids.

>but seems not super productive for them to do such mundane sabotage on such non-critical systems.

The hell makes you think food supply chain refrigeration is non-critical? How do you think safe food supplies work? This type of attack should be treated as an overt act of war.

On the contrary, sabotaging things that impact everyday life and give a generalized feeling of decline throughout society is water on the mills of Russia's allies in Europe, notably the nationalist and populist parties.

Wild guess: vegan activists (terrorists), given it mostly affects meat and dairy.

I think AI will fall squarely into the category of the rest of the post-PC era "tech advancement" in terms of the Productivity Paradox. Outside of very niche areas (like software engineering, making software that likely wouldn't actually improve productivity in a measurable (as in, shows up in productivity statistics) way any way), AI is likely to be more of the same. All the areas where there was real benefit to digitalization and all the low hanging fruit was already finished by the mainframe and minicomputer eras.

Maybe in a stroke of poetic symmetry all the programmers being replaced by AI will find work as cybersecurity professionals defending against AI.

It's more likely that we will see larger investments in cybersecurity.

It's not insecure code that's the problem, it's an insecure system, driven by project managers, information security departments, and box ticking.

For large companies, infosec will never allow some POS IOT device on their network without a 50 page form and large amounts of funding. The business however needs this to happen for whatever goals they have.

So the project manager goes back to the supplier, who recommend sticking it on a 4g simcard with a public IP address, and "install this app" to manage it

The project manger finishes the project, gives the app to the store manager, and rides off into the sunset, and nobody actually owns the equipment or even knows its there.

For small companies they likely don't have a technology provider at all, and just use the ISP's router.

Hospitals, in general, have an above-average IT security posture.

Can they not be read-only for monitoring/compliance?

Especially given the recent precedence of hacked freezers.

That's an interesting angle, that would explain why some bothered to hack fridges and waste food.

It’s really strange that this is a perfect copy of a comment from reddit (or that comment is copied from here). Bots gone wild these days.

Those were toasters, not fridges :)

There are massive financial incentives for centralizing control and management. They’re not doing that because they think it’s a cool gadget.

Monitoring, I guess?

Venn’s first name was John, not Ben. :)

https://en.wikipedia.org/wiki/Venn_diagram

Europeans are totally capable of fucking up themselves. In this particular case, it was Danfoss, which is a Danish company

If there's evidence of Chinese involvement via backdoors then it would be great to see it, but until then this reads as "red scare" adjacent.

You want them back to use very fast after they have certain amount of icing. So you want powerful heating elements there and those are cheap anyway. Fridge or freezer not in use doesn't make money in a store.

In other words, it went into a defrost cycle.

You're not managing thousands of fridges across a country.

Probably a central company that manages maintenance and preventative maintenance and uses them for monitoring and control. Taking them offline would probably cause more failures, and much higher costs in tech labor, tech travel, etc.

The way some of these publicly listed companies work now they would "rather have" a cyber incident and claim the damages on insurance than hire engineers, because that looks worse on a quarterly report to have salaried workers.

Was the Albert Heijn outage due to the fridge issues as well?

Yes. "Hybrid war" is still war.

It seems more like an economic annoyance campaign or something?

If I were a country with this kind of attack sitting around and I wanted to use it for war stuff, I’d probably wait until a hot war had started. Destroy the freezers when everyone is busy making weapons or manning trenches, might actually cause a food situation.

> Not officially at war (or even cyberwar) but... are we at war?

Have been for a few years now.

Let's say China and Russia have hacked into FBI and CIA. It helps those countries build a psychological profile of the centers of power in Western countries. This can help in many ways. E.g. if it is known that Bitcoin is actually a CIA plot to transition the whole world into post-dollar economy, then China can plan ahead and ask its citizens to buy gold. But china started buy gold propaganda in 2002. Or as Putin says this because Russia has access to Epstein files.

"Western elites have been accustomed for centuries to fill their bellies with human flesh and their pockets with money. But they must understand that their vampire ball is ending."

The US seems to make the same mistakes in the middle east time after time.

Vendors install these so the store owner and them have easy access to alarms and controls.

A VPN per store would be too complex for the vendor so they just expose these to the open.

Same story as with all the hacked OT/SCADA systems in the past.

Two things worth keeping in mind:

1. Connecting them was probably considered best practice when they were installed in 2005 2. Their support contract required them to stay connected

> Admin interface available on the internet

This is the bad part. Frequent password resets suck.

An attacker doesn't need an internet connection if they are persistent enough...

Isn't it a reasonable assumption that an LLM was involved in helping prepare this attack? §

...or ai lab bench maxxing.

I have no problem with monitoring temps over internet.

Who ever thought it was OK to control freezers over the internet should be hung.

Isn't Europe just following US Army's example then? A similar incident in US Army commissaries has been reported since August [1]. It only took them two full months to launch an investigation [2].

[1] https://signalandsilence.substack.com/p/i-think-someone-hack...

[2] https://www.foxnews.com/us/mysterious-freezer-failures-us-mi...

This wave of attacks against refrigerators started in USA with many refrigerators serving the personnel at several military bases, a couple of months ago.

Therefore even the US Army has not been better prepared than supermarket chains.

It would take people listening to professionals and getting rid of several decades worth of bad habits amongst users. Same as most other places really.

What makes you think Europe is uniquely vulnerable?

> It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?

I'm quite sure your average American company is just as willing to plug random shit into the internet.

Hell, there are probably hundreds of reports out there of American companies failing to secure their AWS S3 buckets, so you don't even have to plug anything into the internet.

The problem is the ironic "home grown" or "internal" security. These external attacks come after decades of fertilizing far right white politicians whose sole purpose is to dither any directed anger.

Brexit was the first to burst and despite their support of Ukraine, can at any moment capitulate to the ghost of nationalism and delusional escapism that is "white power". Americas on the verge of sinking further into the same. With those two entirely preoccupied, of course europe is next and already has the same underlying current.

1) "They" have no idea what exposed to open internet vs LAN vs VPN even mean. They have no idea what these terms mean, they just want the easy access. Same reason why open RDP to 3389 used to be so common. Vendors install these so the store owner and them have easy access to alarms and controls. So they vendor installs it for easy access, shows the store owner, store owner trusts vendor, but vendor has done the bare minimum. Because the vendor wants it easy too.

A VPN per store would be too complex for the vendor so they just expose these to the open.

Same story as with all the hacked OT/SCADA systems in the past. Like those hacks where some SCADA system is open as a website with pump controls.

Imagine they where internet exposed due to simplicity. Imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

2) Yes, obvious it is Russia doing this. Very handy to be able to disrupt food supply and they are also checking our response and time to restore.

I wonder if any of EU reactors is connected to the open Internet with a weekly password reset policy, where you can use the control rods from the convenient of your home.

“Hit by second”

monoprix is french, and it seems it was limited to sweeden and belgium.

Hoax?