Forgot your password?
Close
typodupeerror
Security Privacy

Hackers Heat French Supermarket Fridges, Sparking Fires and Spoiling Food (reuters.com) 55

Posted by BeauHD from the hackers-turned-up-the-heat dept.
Hackers remotely manipulated connected refrigeration systems at hundreds of French supermarkets, reportedly pushing some fridges and freezers to 50C (122F), spoiling food and even sparking fires. According to Reuters, French Prime Minister Sebastien Lecornu ordered a cybersecurity investigation into the hacks, with similar incidents reported in Spain, Portugal, Poland, Germany, and Belgium. In France, Carrefour reported 80 affected stores, Monoprix said 5% of its locations were hit, and Les Mousquetaires said refrigerators at roughly 150 Intermarche stores were heated to 50C for six hours. From the report: Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere. The source close to Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss.

Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems." The affected units "were running outdated firmware," Danfoss said, adding that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."

On August 9, cybersecurity firm Claroty's Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller. According to the report, software updates issued by Danfoss addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.

Hackers Heat French Supermarket Fridges, Sparking Fires and Spoiling Food More | Reply

Hackers Heat French Supermarket Fridges, Sparking Fires and Spoiling Food

Comments Filter:

  • They should migrate away from the internet (Score:3, Insightful)

    by Anonymous Coward on Monday October 12, 2026 @02:07PM (#66372590)

    How stupid can this be? Since when do supermarket refrigerators need to be controlled remotely? It's a real "WTF" moment.

    • Re: (Score:2)

      by dbialac ( 320955 )
      Yep. Critical infrastructure should never be connected to the internet. I wonder how many of these kinds of attacks need to occur before people get the message.

      • That would mean having your equipment managed and monitored locally instead of by the vendor through a service contract.
        Putting everything online is CHEAP.

        A lot of commercial "security" companies just sit in a central office with staff that monitors hundreds of different customer locations. All those cameras are online somewhere.

        • Re: (Score:2)

          by jhoegl ( 638955 )
          I dont see why we cant have it monitored remotely, but controlled, when security of IoT is terrible, then this is a bad design by a company who caters to sales people and not actual engineers who would warn against such things.
          Monitoring allows reaction by humans, control brings problems.

          • Re: (Score:2)

            by Etcetera ( 14711 )

            I dont see why we cant have it monitored remotely, but controlled, when security of IoT is terrible, then this is a bad design by a company who caters to sales people and not actual engineers who would warn against such things.

            Monitoring allows reaction by humans, control brings problems.

            Precisely. And in a sane world (15 years ago), people would be pushing for exactly this. Monitoring should be for alerting and observing; control should be distinct, and monitoring should never require the ability to control simply because some manger heard the phrase "autorecovery." Instead, we have this. I'd like to blame the rise of k8s, which made people feel like problems didn't need to be resolved or engineered, but it's also cost and lack of foresight/battle scars.

            If these were highly remote location

        • Every supermarket of any size has staff on duty 24 hours a day so local temperature management is trivial to do.

    • When you have 18000 freezers in hundreds of supermarkets, it's nice if ONE guy can check and detect problems and install updates.

      It's the same for their hundreds of heating systems, AC and whatnot.

      • You mean the people on site are incapable of noticing there's a problem?

        Not sure that's how you want to be framing this.

    • How stupid can this be? Since when do supermarket refrigerators need to be controlled remotely? It's a real "WTF" moment.

      Even more stupid, what do these hackers have against food? If the point was just to be dicks, or for fun, mission accomplished. If it was to illuminate insecurities, they missed the mark. If it was for ransom, they picked the wrong targets. In any case, while these systems were/are apparently insecure, there are valid arguments for internet access on them. There aren't any good arguments for spoiling/wasting food.

  • Stop hooking standalone things to the internet. (Score:5, Insightful)

    by AgTiger ( 458268 ) on Monday October 12, 2026 @02:11PM (#66372598) Homepage

    From the article: "Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere."

    Well, there's your problem. Stop doing stupid things like that.

    • There are multiple layers of stupid here:

      1) Connecting these devices to the open internet is stupid
      2) They were connected to the open internet so that "maintenance companies" can remotely control them - but those companies weren't remotely keeping the firmware up to date?
      3) Why is it even possible to set a refrigerator to 50C?

    • That's only even half of the stupid. There's no sense in a refrigerator even being able to be set to a temperature above about 70 F, as there's really no scenario in which you'd want to do that. You would just turn it off. Why on earth do they even allow these insane input values?

      • Read the article again. Nowhere does it say they were SET to 50C. It said some REACHED 50C. This is quite obviously because it was forced into hot gas defrost with the termination timer and temp sensor bypassed.

        • Defrost? They're not frost free? What year is it? It's not like they're deep freezes.

          • Confidently displaying your ignorance on a topic isn't a great look. Internalize that you don't know how commercial refrigeration works and either solve that by learning or decide it doesn't matter and move on. Doubling down on stupid shouldn't be the option you choose but based on so much of your incessant posting it seems to by your favorite.

    • Like Ron White said "You can't fix stupid."
      France is NOT known for having businesses staffed continuously.
      So, I get being connected 'securely' as it were to the internet so temperature/status can be monitored 24/7/365.
      I can also understand a management desire to be able to increase cooling a FEW degrees over a limited time to mitigate an issue until staff can go onsite.
      I am ROTFL that via remote connection there were no constraints to setting refrigeration systems to temperatures FAR outside of any 'food sa

    • Re: (Score:2)

      by Ogive17 ( 691899 )
      I definitely don't like the idea of having everything plugged into the internet. In this case, a key benefit to the store would be knowing someone is monitoring 24/7. If a unit shows signs of failing, the company can get a repair person dispatched before any employee at the store would even know what was going on. If a unit fails and the store itself is responsible for monitoring and scheduling maintenance, that alone could lead to food spoilage or extra labor to move all the impacted items to another fr

    • Supermarkets usually work at a marge of 1,5%, you can't hire hundreds of extra people and expect to still make a profit.

      This is not longer the century of the fruit-bat.

  • Nice weasel wording (Score:3)

    by newslash.formatblows ( 2011678 ) on Monday October 12, 2026 @02:14PM (#66372614)
    "aware of incidents in France affecting a limited number of refrigeration management systems."

    That's reassuring. I was afraid for a minute that an infinite number of refrigerators had been hacked.

    • I was afraid for a minute that an infinite number of refrigerators had been hacked.

      I understand that's to be the premise of the next DC Universe reboot.

    • Came here for exactly that.

      Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems."

      would be perfectly true if the "limited number" was 100%. This standard corporate PR-speak is such weak tea . . .

  • First, they are refrigerators. They do not need to be connected to the internet and should not be, period. You want to remotely manage them? Use anything but the internet.

    Second, why would you make them remotely accessible FROM ANY IP ADDRESS? Do you not know what a firewall is? A whitelist? Conditional access?

    Third, why the fuck would a REFRIGERATOR need the ability to COOK anything? Did someone forget the difference between Fahrenheit and Celsius and give them a max temp of 50C when it should've been 5

    • Re: (Score:3)

      by TWX ( 665546 )

      First, they are refrigerators. They do not need to be connected to the internet and should not be, period. You want to remotely manage them? Use anything but the internet.

      I'll bite, what sort of remote control can you do that isn't, some how, some way, using the Internet? You gonna lease RF spectrum and set up some kind of radio controls?

      Second, why would you make them remotely accessible FROM ANY IP ADDRESS? Do you not know what a firewall is? A whitelist? Conditional access?

      This is realistically where the failure sits, but it's unlikely that in an IPv4 network, that the IPs of the IoT endpoints would be directly exposed to the Internet as they'd normally be RFC1918 addresses and would require someone to explicitly set up inbound NAT rules to forward to those endpoints for them to be directly exposed. So the q

      • I'll bite, what sort of remote control can you do that isn't, some how, some way, using the Internet? You gonna lease RF spectrum and set up some kind of radio controls?

        Well, dedicated/proprietary lines are a thing. I don't know about the cost:benefit ratio of deploying them for this in France would be, but it doesn't have to be RF like there's no other option. You can use regular wired network connections without routing through publicly addressable connections. That's a thing ATMs still sometimes do, at least in the US; it used to be ubiquitous but as encryption software has gotten better they've reportedly been relaxing this requirement, but banks still use dedicated li

        • Re: (Score:2)

          by TWX ( 665546 )

          I'll bite, what sort of remote control can you do that isn't, some how, some way, using the Internet? You gonna lease RF spectrum and set up some kind of radio controls?

          Well, dedicated/proprietary lines are a thing. I don't know about the cost:benefit ratio of deploying them for this in France would be, but it doesn't have to be RF like there's no other option. You can use regular wired network connections without routing through publicly addressable connections. That's a thing ATMs still sometimes do, at least in the US; it used to be ubiquitous but as encryption software has gotten better they've reportedly been relaxing this requirement, but banks still use dedicated lines for this. I used to work at a large investment bank that even used dedicated lines for international conference calls. AIUI, home DSL lines even typically (always?) start with a short run over a proprietary ATM backhaul.

          I could not speak to the cost/benefit ratio in Europe, but in the United States, 1.544Mb on a Frame Relay would cost more than 1Gb on a Metro Ethernet fiber connection. I know because I retired a Nortel Meridian telephone system using T1 links specifically because it was costing more than the 1Gb and later 10Gb Metro Ethernet L2 MPLS connection and had far, far less flexibility. We migrated over to VOIP phones and saved a ton of money on the ~75 service entrances we were taking care of, and the VOIP traff

  • I'm smelling some bullshit on this one. There's no way I can believe setting the temp to 50C on a refrigerator did anything beyond shut it off. Starting fires? Really? Maybe you saw smoke pouring out of the store manager's ears when he realized how much spoilage he was dealing with and got confused.

    • Re: (Score:2)

      by Zarhan ( 415465 )

      The starting fires part could be plausible if there's some equipment full of dust and cobwebs and then you have a hot compressor running on a continuous cycle and it becomes hot (or just starts burning by itself from the exertion).

      But in that case the food would be even frozen and temp inside even more cold with thermostat no longer cutting the cooling cycle. I doubt that even commercial fridges or freezers have heat pumps in them so that you can turn them into heaters.

    • Re: (Score:3)

      by DarkOx ( 621550 )

      These are commercial refrigeration units. This is not the Kenmore in your mom kitchen.

      They do have heating units because they do have to be completely defrosted and clean. Importantly this has to happen quickly not after just standing with the compressor off and the door open for two hours, time is money.

      50C is going be less than 130F. So it is not like these things have a 'bake' mode, that seems pretty reasonable for an ice melt function. I only have experience with a 30 year old unit in our church bas

    • Re: (Score:2)

      by TWX ( 665546 )

      I could see a fire starting in an electrical distribution panel if, once the problem was discovered, someone set all of the fridges in the building back down to proper temp and the startup demands exceeded the panel's ability to supply power, but that's more of an electrical equipment fault in being faulty or undersized rather than an IT fault.

  • Hackaday reported on the Danfoss issue a month ago, about an incident that occurred a month before that: https://hackaday.com/2026/09/0... [hackaday.com]

  • Do they use the same default passwords on their generators?

  • Buck passed (Score:5, Insightful)

    by jrq ( 119773 ) on Monday October 12, 2026 @02:38PM (#66372678)
    "outdated firmware" - Buck passed. Customer at fault.

  • How could a refrigerator heat the contents to 50 degrees C?

  • I guarantee it's one of the two things that led to this:
    "Yeeeeeah, that sounds like an awful lot of work" - whatever IT technician got that ticket to update all fridges.
    "Updates scary! Updates break things!" - the CIO at every place I've ever worked, who refused to let us patch anything until our insurance company did a network scan and tripled our rates.
  • This should, (but won't), highlight the failure of processes.

    Even with the supposed need to manage the fridges & freezers remotely, safe guards can be put in place. Like others have mentioned:

    * Don't connect anything directly to the Internet, unless its purpose is for the Internet. Like a shopping site.
    * Use a VPN gateway, with changing credentials. Including changing the credentials early when staff leave.
    * Make the remote access Read Only by default.
    * Have authorized onsite personal verify requ

    • Re: (Score:2)

      by HiThere ( 15173 )

      At the refrigerator end you're talking about grocery stores. I think you have unreasonable expectations. KISS. No remote control, only remote read. Have a technician come by and make and change commands. That shouldn't be needed very often, and you can monitor (but not control) it remotely.

  • You'd think one of the stockers or managers of the store would've noticed the freezer aisle is suddenly very hot and do something like... oh I dunno... unplug them?

  • How did the hackers manage to actually heat these?

  • First zey came for ze Crimeans.
    Et je did not speak out, because je ne suis pas Crimean.

    Zen zey came for ze Ukrainians.
    Et je did not speak out, because je ne suis pas Ukrainian.

    Zen zey came for LE FROMAGE ?!
    Sacre blue ! Enouef !

  • I mean, come on. The freezers are on the Internet, no firewalls, fully accessible to anyone with a browser. Their "security" consists of rotating the admin password daily... to the current date. There are guppies out there that could gain access to these. The root cause here is willful negligence by the retailer's IT department.

  • ... always a bad idea. With LLMs, basically incompetent people can hack all instances of such a device everywhere for cheap now.

    • Nothing is really secure, no need to qualify it with 'secure'. Simply stop putting things on-the-line that have no business or need to be there. It seems no one learned from the multitude of printers that regularly get abused because someone blindly put them on the outward facing network.
  • Don't put things on the internet that have no business being on the internet. Next time it will be some unsuspecting infrastructure attack.

Slashdot Top Deals

When bad men combine, the good must associate; else they will fall one by one, an unpitied sacrifice in a contemptible struggle. - Edmund Burke

Close