Hackers Heat French Supermarket Fridges, Sparking Fires and Spoiling Food (reuters.com)
- Reference: 0186273594
- News link: https://it.slashdot.org/story/26/10/12/1748203/hackers-heat-french-supermarket-fridges-sparking-fires-and-spoiling-food
- Source link: https://www.reuters.com/business/retail-consumer/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stories-targeted-2026-10-12/
> Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere. The source close to Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss.
>
> Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems." The affected units "were running outdated firmware," Danfoss said, adding that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."
>
> On August 9, cybersecurity firm Claroty's Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller. According to the report, software updates issued by Danfoss addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.
[1] https://www.reuters.com/business/retail-consumer/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stories-targeted-2026-10-12/
Stop hooking standalone things to the internet. (Score:5, Insightful)
From the article: "Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere."
Well, there's your problem. Stop doing stupid things like that.
Re: (Score:2)
There are multiple layers of stupid here:
1) Connecting these devices to the open internet is stupid
2) They were connected to the open internet so that "maintenance companies" can remotely control them - but those companies weren't remotely keeping the firmware up to date?
3) Why is it even possible to set a refrigerator to 50C?
Re: (Score:3)
For (3): Defrost.
Re: Stop hooking standalone things to the internet (Score:1)
Defrosting happens at any temperature above freezing. 50F is a perfectly reasonable max temp for a refrigerator. 50C is not.
Re: (Score:2)
50C defrosts faster than 50F :)
Re: (Score:1)
> For (3): Defrost.
Leave it to the generation who needs a dead phone charged to 80% before they get done taking a phoneless shit, to demand a "turbo" defrost mode north of 120 degrees on a deep freezer.
Re:Stop hooking standalone things to the internet. (Score:5, Informative)
> 3) Why is it even possible to set a refrigerator to 50C?
You're making a logical mistake here, assuming it was possible to set them to that temperature. That's not what the article said was done. It specifically says they raised the temperature to that.
What they've most likely done here is activated the reversing valve - a thing that would be normally used for hot gas defrost - and bypassed the defrost termination time and temp sensors.
These things aren't like your home fridge.
Re: (Score:3)
That's only even half of the stupid. There's no sense in a refrigerator even being able to be set to a temperature above about 70 F, as there's really no scenario in which you'd want to do that. You would just turn it off. Why on earth do they even allow these insane input values?
Re: (Score:3)
Read the article again. Nowhere does it say they were SET to 50C. It said some REACHED 50C. This is quite obviously because it was forced into hot gas defrost with the termination timer and temp sensor bypassed.
Re:Stop doing stupid things like that. (Score:2)
Like Ron White said "You can't fix stupid."
France is NOT known for having businesses staffed continuously.
So, I get being connected 'securely' as it were to the internet so temperature/status can be monitored 24/7/365.
I can also understand a management desire to be able to increase cooling a FEW degrees over a limited time to mitigate an issue until staff can go onsite.
I am ROTFL that via remote connection there were no constraints to setting refrigeration systems to temperatures FAR outside of any 'food sa
Re: (Score:2)
I definitely don't like the idea of having everything plugged into the internet. In this case, a key benefit to the store would be knowing someone is monitoring 24/7. If a unit shows signs of failing, the company can get a repair person dispatched before any employee at the store would even know what was going on. If a unit fails and the store itself is responsible for monitoring and scheduling maintenance, that alone could lead to food spoilage or extra labor to move all the impacted items to another fr
Re: (Score:2)
Monitoring is one thing. Control is something else.
Re: (Score:2)
Supermarkets usually work at a marge of 1,5%, you can't hire hundreds of extra people and expect to still make a profit.
This is not longer the century of the fruit-bat.
Nice weasel wording (Score:3)
"aware of incidents in France affecting a limited number of refrigeration management systems."
That's reassuring. I was afraid for a minute that an infinite number of refrigerators had been hacked.
Re: (Score:3)
> I was afraid for a minute that an infinite number of refrigerators had been hacked.
I understand that's to be the premise of the next DC Universe reboot.
Re: Nice weasel wording (Score:2)
Came here for exactly that.
> Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems."
would be perfectly true if the "limited number" was 100%. This standard corporate PR-speak is such weak tea . . .
Where to begin (Score:2)
First, they are refrigerators. They do not need to be connected to the internet and should not be, period. You want to remotely manage them? Use anything but the internet.
Second, why would you make them remotely accessible FROM ANY IP ADDRESS? Do you not know what a firewall is? A whitelist? Conditional access?
Third, why the fuck would a REFRIGERATOR need the ability to COOK anything? Did someone forget the difference between Fahrenheit and Celsius and give them a max temp of 50C when it should've been 5
Re: (Score:2)
> First, they are refrigerators. They do not need to be connected to the internet and should not be, period. You want to remotely manage them? Use anything but the internet.
I'll bite, what sort of remote control can you do that isn't, some how, some way, using the Internet? You gonna lease RF spectrum and set up some kind of radio controls?
> Second, why would you make them remotely accessible FROM ANY IP ADDRESS? Do you not know what a firewall is? A whitelist? Conditional access?
This is realistically where the failure sits, but it's unlikely that in an IPv4 network, that the IPs of the IoT endpoints would be directly exposed to the Internet as they'd normally be RFC1918 addresses and would require someone to explicitly set up inbound NAT rules to forward to those endpoints for them to be directly exposed. So the q
Can anyone actually confirm? (Score:2)
I'm smelling some bullshit on this one. There's no way I can believe setting the temp to 50C on a refrigerator did anything beyond shut it off. Starting fires? Really? Maybe you saw smoke pouring out of the store manager's ears when he realized how much spoilage he was dealing with and got confused.
Re: (Score:2)
The starting fires part could be plausible if there's some equipment full of dust and cobwebs and then you have a hot compressor running on a continuous cycle and it becomes hot (or just starts burning by itself from the exertion).
But in that case the food would be even frozen and temp inside even more cold with thermostat no longer cutting the cooling cycle. I doubt that even commercial fridges or freezers have heat pumps in them so that you can turn them into heaters.
Re: (Score:2)
These are commercial refrigeration units. This is not the Kenmore in your mom kitchen.
They do have heating units because they do have to be completely defrosted and clean. Importantly this has to happen quickly not after just standing with the compressor off and the door open for two hours, time is money.
50C is going be less than 130F. So it is not like these things have a 'bake' mode, that seems pretty reasonable for an ice melt function. I only have experience with a 30 year old unit in our church bas
Re: (Score:2)
I could see a fire starting in an electrical distribution panel if, once the problem was discovered, someone set all of the fridges in the building back down to proper temp and the startup demands exceeded the panel's ability to supply power, but that's more of an electrical equipment fault in being faulty or undersized rather than an IT fault.
it's not like they didn't have plenty of warning (Score:1)
Hackaday reported on the Danfoss issue a month ago, about an incident that occurred a month before that: [1]https://hackaday.com/2026/09/0... [hackaday.com]
[1] https://hackaday.com/2026/09/04/this-week-in-security-baked-in-malware-freezers-not-freezing-zoom-snoops-clipboards-and-ai-makes-things-worse-faster/#:~:text=Freezers%20Hacked
i wonder... (Score:2)
Do they use the same default passwords on their generators?
Buck passed (Score:5, Insightful)
"outdated firmware" - Buck passed. Customer at fault.
Heat? (Score:2)
How could a refrigerator heat the contents to 50 degrees C?
Oopsies (Score:2)
I guarantee it's one of the two things that led to this:
"Yeeeeeah, that sounds like an awful lot of work" - whatever IT technician got that ticket to update all fridges.
"Updates scary! Updates break things!" - the CIO at every place I've ever worked, who refused to let us patch anything until our insurance company did a network scan and tripled our rates.
So many faults with the process (Score:2)
This should, (but won't), highlight the failure of processes.
Even with the supposed need to manage the fridges & freezers remotely, safe guards can be put in place. Like others have mentioned:
* Don't connect anything directly to the Internet, unless its purpose is for the Internet. Like a shopping site.
* Use a VPN gateway, with changing credentials. Including changing the credentials early when staff leave.
* Make the remote access Read Only by default.
* Have authorized onsite personal verify requ
Lots of not RTFA problems here (Score:2)
As usual.
Still... (Score:2)
You'd think one of the stockers or managers of the store would've noticed the freezer aisle is suddenly very hot and do something like... oh I dunno... unplug them?
Heated to 50C? (Score:2)
How did the hackers manage to actually heat these?
Re: (Score:2)
The refrigerators normally cool to -50 and they flipped the sign bit.
Obvs.
First zey came for ze Crimeans. (Score:2)
First zey came for ze Crimeans.
Et je did not speak out, because je ne suis pas Crimean.
Zen zey came for ze Ukrainians.
Et je did not speak out, because je ne suis pas Ukrainian.
Zen zey came for LE FROMAGE ?!
Sacre blue ! Enouef !
This barely counts as a malicious attack. (Score:2)
I mean, come on. The freezers are on the Internet, no firewalls, fully accessible to anyone with a browser. Their "security" consists of rotating the admin password daily... to the current date. There are guppies out there that could gain access to these. The root cause here is willful negligence by the retailer's IT department.
Connecting insecure stuff to the Internet... (Score:2)
... always a bad idea. With LLMs, basically incompetent people can hack all instances of such a device everywhere for cheap now.
They should migrate away from the internet (Score:3, Insightful)
How stupid can this be? Since when do supermarket refrigerators need to be controlled remotely? It's a real "WTF" moment.
Re: (Score:2)
Yep. Critical infrastructure should never be connected to the internet. I wonder how many of these kinds of attacks need to occur before people get the message.
Re: (Score:3)
That would mean having your equipment managed and monitored locally instead of by the vendor through a service contract.
Putting everything online is CHEAP.
A lot of commercial "security" companies just sit in a central office with staff that monitors hundreds of different customer locations. All those cameras are online somewhere.
Re: (Score:2)
I dont see why we cant have it monitored remotely, but controlled, when security of IoT is terrible, then this is a bad design by a company who caters to sales people and not actual engineers who would warn against such things.
Monitoring allows reaction by humans, control brings problems.
Re: (Score:2)
> I dont see why we cant have it monitored remotely, but controlled, when security of IoT is terrible, then this is a bad design by a company who caters to sales people and not actual engineers who would warn against such things.
> Monitoring allows reaction by humans, control brings problems.
Precisely. And in a sane world (15 years ago), people would be pushing for exactly this. Monitoring should be for alerting and observing; control should be distinct, and monitoring should never require the ability to control simply because some manger heard the phrase "autorecovery." Instead, we have this. I'd like to blame the rise of k8s, which made people feel like problems didn't need to be resolved or engineered, but it's also cost and lack of foresight/battle scars.
If these were highly remote location
Re: (Score:2)
When you have 18000 freezers in hundreds of supermarkets, it's nice if ONE guy can check and detect problems and install updates.
It's the same for their hundreds of heating systems, AC and whatnot.
Re: (Score:2)
You mean the people on site are incapable of noticing there's a problem?
Not sure that's how you want to be framing this.
Re: (Score:2)
> How stupid can this be? Since when do supermarket refrigerators need to be controlled remotely? It's a real "WTF" moment.
Even more stupid, what do these hackers have against food? If the point was just to be dicks, or for fun, mission accomplished. If it was to illuminate insecurities, they missed the mark. If it was for ransom, they picked the wrong targets. In any case, while these systems were/are apparently insecure, there are valid arguments for internet access on them. There aren't any good arguments for spoiling/wasting food.