Forgot your password?
Close
typodupeerror
Security Privacy

Hackers Heat French Supermarket Fridges, Sparking Fires and Spoiling Food (reuters.com) 105

Posted by BeauHD from the hackers-turned-up-the-heat dept.
Hackers remotely manipulated connected refrigeration systems at hundreds of French supermarkets, reportedly pushing some fridges and freezers to 50C (122F), spoiling food and even sparking fires. According to Reuters, French Prime Minister Sebastien Lecornu ordered a cybersecurity investigation into the hacks, with similar incidents reported in Spain, Portugal, Poland, Germany, and Belgium. In France, Carrefour reported 80 affected stores, Monoprix said 5% of its locations were hit, and Les Mousquetaires said refrigerators at roughly 150 Intermarche stores were heated to 50C for six hours. From the report: Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere. The source close to Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss.

Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems." The affected units "were running outdated firmware," Danfoss said, adding that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions."

On August 9, cybersecurity firm Claroty's Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller. According to the report, software updates issued by Danfoss addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.
This discussion has been archived. No new comments can be posted.

Hackers Heat French Supermarket Fridges, Sparking Fires and Spoiling Food More

Hackers Heat French Supermarket Fridges, Sparking Fires and Spoiling Food

Comments Filter:

  • They should migrate away from the internet (Score:5, Insightful)

    by Anonymous Coward on Monday October 12, 2026 @01:07PM (#66372590)

    How stupid can this be? Since when do supermarket refrigerators need to be controlled remotely? It's a real "WTF" moment.

    • Re: (Score:3)

      by dbialac ( 320955 )
      Yep. Critical infrastructure should never be connected to the internet. I wonder how many of these kinds of attacks need to occur before people get the message.

      • Re:They should migrate away from the internet (Score:5, Informative)

        by OrangeTide ( 124937 ) on Monday October 12, 2026 @01:56PM (#66372722) Homepage Journal

        That would mean having your equipment managed and monitored locally instead of by the vendor through a service contract.
        Putting everything online is CHEAP.

        A lot of commercial "security" companies just sit in a central office with staff that monitors hundreds of different customer locations. All those cameras are online somewhere.

        • Re:They should migrate away from the internet (Score:5, Insightful)

          by jhoegl ( 638955 ) on Monday October 12, 2026 @03:34PM (#66372972)
          I dont see why we cant have it monitored remotely, but controlled, when security of IoT is terrible, then this is a bad design by a company who caters to sales people and not actual engineers who would warn against such things.
          Monitoring allows reaction by humans, control brings problems.

          • Re: (Score:3)

            by Etcetera ( 14711 )

            I dont see why we cant have it monitored remotely, but controlled, when security of IoT is terrible, then this is a bad design by a company who caters to sales people and not actual engineers who would warn against such things.

            Monitoring allows reaction by humans, control brings problems.

            Precisely. And in a sane world (15 years ago), people would be pushing for exactly this. Monitoring should be for alerting and observing; control should be distinct, and monitoring should never require the ability to control simply because some manger heard the phrase "autorecovery." Instead, we have this. I'd like to blame the rise of k8s, which made people feel like problems didn't need to be resolved or engineered, but it's also cost and lack of foresight/battle scars.

            If these were highly remote location

            • If these were highly remote locations and getting a human to them in time to fix a problem was going to be a challenge, then maybe remote controllability would be important. But this is a damn supermarket; there's going to be somewhere there or nearby constantly. Dear Lord.

              There's no reason that there can't be a thermometer and controls built in, and only accessible from the back. Add on a clipboard with pages printed with lines for date, time, temperature, initials and you have a way to keep track of t
        • Every supermarket of any size has staff on duty 24 hours a day so local temperature management is trivial to do.

        • Its a freaking fridge. A thermostat controller standard on those commercial fridges is $20 (I know, I installed one on a regular refrigerator I modified to use as a homebrew beeer keg fridge so I could keep the beer at a precise 6c . It doesnt need to be some insane IoT thing.

        • Re: (Score:1)

          by hoofie ( 201045 )

          Come on it's been done this way since the 1990s. If a Fridge dies, you lose the product in them - full loss. It makes sense to monitor it.

          The same happens in hospitals with the Fridges and Freezers - all monitored remotely with alarms etc. You would be surprised how many there are in a hospital that have nothing to do with food.

        • That would mean having your equipment managed and monitored locally instead of by the vendor through a service contract. Putting everything online is CHEAP.

          The monitoring can be done via one way communications. Literally a box with standard input and output connectors and where the RX wiring (receive) is missing.

        • Putting everything online is CHEAP.

          Cheap is only one side of the coin, the other side is effective. As population and complexity increase the ability to manage something becomes far more difficult. Being able to predictively plan maintenance based on current operational conditions is almost essential when you have a fleet of potentially 1000s of commercial fridges across your stores in a city. Relying on locally identified problems and then doing a callout isn't just a case of being expensive, it's potentially unworkable with maintenance cre

    • When you have 18000 freezers in hundreds of supermarkets, it's nice if ONE guy can check and detect problems and install updates.

      It's the same for their hundreds of heating systems, AC and whatnot.

      • You mean the people on site are incapable of noticing there's a problem?

        Not sure that's how you want to be framing this.

      • Re: (Score:2)

        by Askmum ( 1038780 )
        Well, that one guy did not detect any problems, did he? Because the problem was only detected when the supermarkets opened in the morning. So what good is this monitoring anyway?

        And as multiple people have said: monitoring is one thing. Controlling is another. Why do you need to control a refrigirator that is set to -18 C. And why does that refrigirator have the ability to heat up to 50 C?

        So many stupid decisions and red flags here, it is almost a good thing they got hacked so they have to rethink their s

    • Re:They should migrate away from the internet (Score:4, Insightful)

      by fahrbot-bot ( 874524 ) on Monday October 12, 2026 @03:10PM (#66372936)

      How stupid can this be? Since when do supermarket refrigerators need to be controlled remotely? It's a real "WTF" moment.

      Even more stupid, what do these hackers have against food? If the point was just to be dicks, or for fun, mission accomplished. If it was to illuminate insecurities, they missed the mark. If it was for ransom, they picked the wrong targets. In any case, while these systems were/are apparently insecure, there are valid arguments for internet access on them. There aren't any good arguments for spoiling/wasting food.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      If you're a large retailer with a footprint of hundreds or thousands you likely have a "NOC" for your global refrigeration and climate control systems to proactively monitor them for issues and dispatch service techs when anomalies are detected. I know Walmart does - the staff onsite can't even set the temperature themselves.

      You do this because it lets you have a small dedicated team do the management of these systems and let the local staff do other things instead of babysitting HVAC controllers that they

    • Re: (Score:2)

      by hoofie ( 201045 )

      I was selling tiny portable models to supermarket and fridge/freezer companies in 1990 so they could report their temps and status back home and be controlled remotely. If one breaks you instantly lose a lot of product and therefore money.

    • Since you centralised all your management. And the time to implement a secure VPN is *expensive*, man! Think of the quarterly results!
    • On the plus these environmentalist hackers are exposing exploits that will now be patched. They are reducing the tools available to the more malicious hackers.

    • How stupid can this be? Since when do supermarket refrigerators need to be controlled remotely? It's a real "WTF" moment.

      Need is the wrong question. We don't need any internet at all for anything. It's a question of want. Centralised maintenance and predictive planning that is automated has driven down cost of ownership which is critical when you're running potentially thousands of fridges in a city.

    • Re: (Score:3)

      by AmiMoJo ( 196126 )

      Because it saves them vastly more money than this hack has cost them.

      They could use a one-way link for simple monitoring, but by having a two way link they can adjust the set point temperature based on real-time electricity prices. Unlike residential customers, large businesses usually pay a variable rate based on 15 minute demand pricing. The pricing is announced 24 hours in advance based on predictions for demand. They drop the set temperature a degree or two when it is cheap, and raise it a degree or two

    • Why? So that there can be one central small group of competent people who controls them over large numbers of stores, instead of a large set of incompetent people who control them locally each at one store.

  • Stop hooking standalone things to the internet. (Score:5, Insightful)

    by AgTiger ( 458268 ) on Monday October 12, 2026 @01:11PM (#66372598) Homepage

    From the article: "Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere."

    Well, there's your problem. Stop doing stupid things like that.

    • There are multiple layers of stupid here:

      1) Connecting these devices to the open internet is stupid
      2) They were connected to the open internet so that "maintenance companies" can remotely control them - but those companies weren't remotely keeping the firmware up to date?
      3) Why is it even possible to set a refrigerator to 50C?

    • Re: (Score:3, Insightful)

      by drinkypoo ( 153816 )

      That's only even half of the stupid. There's no sense in a refrigerator even being able to be set to a temperature above about 70 F, as there's really no scenario in which you'd want to do that. You would just turn it off. Why on earth do they even allow these insane input values?

    • Like Ron White said "You can't fix stupid."
      France is NOT known for having businesses staffed continuously.
      So, I get being connected 'securely' as it were to the internet so temperature/status can be monitored 24/7/365.
      I can also understand a management desire to be able to increase cooling a FEW degrees over a limited time to mitigate an issue until staff can go onsite.
      I am ROTFL that via remote connection there were no constraints to setting refrigeration systems to temperatures FAR outside of any 'food sa

    • Re: (Score:2)

      by Ogive17 ( 691899 )
      I definitely don't like the idea of having everything plugged into the internet. In this case, a key benefit to the store would be knowing someone is monitoring 24/7. If a unit shows signs of failing, the company can get a repair person dispatched before any employee at the store would even know what was going on. If a unit fails and the store itself is responsible for monitoring and scheduling maintenance, that alone could lead to food spoilage or extra labor to move all the impacted items to another fr

    • Supermarkets usually work at a marge of 1,5%, you can't hire hundreds of extra people and expect to still make a profit.

      This is not longer the century of the fruit-bat.

    • Re:Stop hooking standalone things to the internet. (Score:5, Insightful)

      by tlhIngan ( 30335 ) <slashdot&worf,net> on Monday October 12, 2026 @06:32PM (#66373228)

      From the article: "Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere."

      Well, there's your problem. Stop doing stupid things like that.

      But then if something goes wrong, you realize there's no one in the store who can fix it, right? The store manager would have no idea what the panel does. They're going to have to get a technician over to fix whatever it is.

      Maybe you haven't done the whole "drive two hours to flip a power switch" thing, but you'll find the vast majority of issues people have are trivially easy to fix things like that. People don't interact with the panels, other than maybe accidentally by bumping into it or something and then changing a setting. You don't want someone who doesn't know what they're doing (i.e. a teenager who bumped the control panel while bringing in more pop tarts from the back) to fix it. But you also don't want to call in a $200/hr technician to push the button to turn it back on as well.

      Those things pretty much have to be remotely monitored and often adjusted remotely because there will not be anyone in the store who knows anything more than "The panel has a beeping red light on it".

      Granted, the security should be better - VPNs and such aren't terribly expensive things, and any reasonable supermarket with a backend inventory system already has a VPN to corporate so the HVAC techsn can access every panel through the VPN that already exist.

      (One should also note this happened in France, and shopping habits in Europe are quite different from the US - namely in that many people shop daily - they pop into a really tiny supermarket for a few bits of produce and such and 5 minutes later they're back out with dinner ingredients. The weekly "big shop" you do in the US isn't really a thing.

    • Stop doing stupid things like that.

      What's the alternative? You're applying home thinking to large scale commercial enterprises. Not doing those "stupid" things becomes a problem that may not only be expensive, but could potentially also be unworkable with fridges potentially out for days or weeks due to lack of predictive / condition based maintenance, which typically requires close to real time data understood by people who know what the data means - i.e. you need to get the data out of the store.

  • Nice weasel wording (Score:5, Funny)

    by newslash.formatblows ( 2011678 ) on Monday October 12, 2026 @01:14PM (#66372614)
    "aware of incidents in France affecting a limited number of refrigeration management systems."

    That's reassuring. I was afraid for a minute that an infinite number of refrigerators had been hacked.
  • First, they are refrigerators. They do not need to be connected to the internet and should not be, period. You want to remotely manage them? Use anything but the internet.

    Second, why would you make them remotely accessible FROM ANY IP ADDRESS? Do you not know what a firewall is? A whitelist? Conditional access?

    Third, why the fuck would a REFRIGERATOR need the ability to COOK anything? Did someone forget the difference between Fahrenheit and Celsius and give them a max temp of 50C when it should've been 5

    • Re: (Score:3)

      by TWX ( 665546 )

      First, they are refrigerators. They do not need to be connected to the internet and should not be, period. You want to remotely manage them? Use anything but the internet.

      I'll bite, what sort of remote control can you do that isn't, some how, some way, using the Internet? You gonna lease RF spectrum and set up some kind of radio controls?

      Second, why would you make them remotely accessible FROM ANY IP ADDRESS? Do you not know what a firewall is? A whitelist? Conditional access?

      This is realistically where the failure sits, but it's unlikely that in an IPv4 network, that the IPs of the IoT endpoints would be directly exposed to the Internet as they'd normally be RFC1918 addresses and would require someone to explicitly set up inbound NAT rules to forward to those endpoints for them to be directly exposed. So the q

      • I'll bite, what sort of remote control can you do that isn't, some how, some way, using the Internet? You gonna lease RF spectrum and set up some kind of radio controls?

        Well, dedicated/proprietary lines are a thing. I don't know about the cost:benefit ratio of deploying them for this in France would be, but it doesn't have to be RF like there's no other option. You can use regular wired network connections without routing through publicly addressable connections. That's a thing ATMs still sometimes do, at least in the US; it used to be ubiquitous but as encryption software has gotten better they've reportedly been relaxing this requirement, but banks still use dedicated li

        • Re: (Score:2)

          by TWX ( 665546 )

          I'll bite, what sort of remote control can you do that isn't, some how, some way, using the Internet? You gonna lease RF spectrum and set up some kind of radio controls?

          Well, dedicated/proprietary lines are a thing. I don't know about the cost:benefit ratio of deploying them for this in France would be, but it doesn't have to be RF like there's no other option. You can use regular wired network connections without routing through publicly addressable connections. That's a thing ATMs still sometimes do, at least in the US; it used to be ubiquitous but as encryption software has gotten better they've reportedly been relaxing this requirement, but banks still use dedicated lines for this. I used to work at a large investment bank that even used dedicated lines for international conference calls. AIUI, home DSL lines even typically (always?) start with a short run over a proprietary ATM backhaul.

          I could not speak to the cost/benefit ratio in Europe, but in the United States, 1.544Mb on a Frame Relay would cost more than 1Gb on a Metro Ethernet fiber connection. I know because I retired a Nortel Meridian telephone system using T1 links specifically because it was costing more than the 1Gb and later 10Gb Metro Ethernet L2 MPLS connection and had far, far less flexibility. We migrated over to VOIP phones and saved a ton of money on the ~75 service entrances we were taking care of, and the VOIP traff

        • Re: (Score:2)

          by hoofie ( 201045 )

          Are you kidding me? Do you have any idea how much that would cost? Supermarkets are a low margin business

    • Re: (Score:2)

      by hoofie ( 201045 )

      >>First, they are refrigerators. They do not need to be connected to the internet and should not be, period. You want to remotely manage them? Use anything but the internet.

      How else? I was selling tiny portable modems so integrators and companies to connect to supermarket fridges in 1990 in the UK. You could use a GSM backhaul which is very common in some areas as you don't need a wired internet connection but it still traverses the internet or carrier network somewhere.

      Even electronic utility meterin

  • I'm smelling some bullshit on this one. There's no way I can believe setting the temp to 50C on a refrigerator did anything beyond shut it off. Starting fires? Really? Maybe you saw smoke pouring out of the store manager's ears when he realized how much spoilage he was dealing with and got confused.

    • Re: (Score:2)

      by Zarhan ( 415465 )

      The starting fires part could be plausible if there's some equipment full of dust and cobwebs and then you have a hot compressor running on a continuous cycle and it becomes hot (or just starts burning by itself from the exertion).

      But in that case the food would be even frozen and temp inside even more cold with thermostat no longer cutting the cooling cycle. I doubt that even commercial fridges or freezers have heat pumps in them so that you can turn them into heaters.

    • Re: (Score:3)

      by DarkOx ( 621550 )

      These are commercial refrigeration units. This is not the Kenmore in your mom kitchen.

      They do have heating units because they do have to be completely defrosted and clean. Importantly this has to happen quickly not after just standing with the compressor off and the door open for two hours, time is money.

      50C is going be less than 130F. So it is not like these things have a 'bake' mode, that seems pretty reasonable for an ice melt function. I only have experience with a 30 year old unit in our church bas

    • Re: (Score:2)

      by TWX ( 665546 )

      I could see a fire starting in an electrical distribution panel if, once the problem was discovered, someone set all of the fridges in the building back down to proper temp and the startup demands exceeded the panel's ability to supply power, but that's more of an electrical equipment fault in being faulty or undersized rather than an IT fault.

    • Probably via activating the defrost elements on equipment that is stupidly designed without hardware failsafes in place. Yeah, in the old days you'd expect there to be one of those bimetallic limit switches that physically cuts power to the defrost element, but now you've got software monitoring a sensor instead. Add a little malicious code to ignore the output of the sensor and suddenly Oh lord Jesus, it's a fire! [youtube.com]

  • Hackaday reported on the Danfoss issue a month ago, about an incident that occurred a month before that: https://hackaday.com/2026/09/0... [hackaday.com]

  • Do they use the same default passwords on their generators?

  • Buck passed (Score:5, Insightful)

    by jrq ( 119773 ) on Monday October 12, 2026 @01:38PM (#66372678)
    "outdated firmware" - Buck passed. Customer at fault.

    • Re: (Score:2)

      by dargaud ( 518470 )

      "outdated firmware" - Buck passed. Customer at fault.

      Yeah, well, about that... I just bought an oldish electric car, so my first thought was to go update the firmware(s). On the manufacturer's website it just says 'no longer supported' and doesn't even tell me what the last version numbers were. Damn lazy fucks.

    • "outdated firmware" - Buck passed. Customer at fault.

      False. Things such as firmware are almost always the responsibility of whomever executes the maintenance contract on commercial enterprises such as this. The customer has virtually no control over this.

    • I installed the new firmware, but my unit froze...

  • How could a refrigerator heat the contents to 50 degrees C?

  • I guarantee it's one of the two things that led to this:
    "Yeeeeeah, that sounds like an awful lot of work" - whatever IT technician got that ticket to update all fridges.
    "Updates scary! Updates break things!" - the CIO at every place I've ever worked, who refused to let us patch anything until our insurance company did a network scan and tripled our rates.
  • This should, (but won't), highlight the failure of processes.

    Even with the supposed need to manage the fridges & freezers remotely, safe guards can be put in place. Like others have mentioned:

    * Don't connect anything directly to the Internet, unless its purpose is for the Internet. Like a shopping site.
    * Use a VPN gateway, with changing credentials. Including changing the credentials early when staff leave.
    * Make the remote access Read Only by default.
    * Have authorized onsite personal verify requ

    • Re: (Score:2)

      by HiThere ( 15173 )

      At the refrigerator end you're talking about grocery stores. I think you have unreasonable expectations. KISS. No remote control, only remote read. Have a technician come by and make and change commands. That shouldn't be needed very often, and you can monitor (but not control) it remotely.

  • You'd think one of the stockers or managers of the store would've noticed the freezer aisle is suddenly very hot and do something like... oh I dunno... unplug them?

  • How did the hackers manage to actually heat these?

  • First zey came for ze Crimeans.
    Et je did not speak out, because je ne suis pas Crimean.

    Zen zey came for ze Ukrainians.
    Et je did not speak out, because je ne suis pas Ukrainian.

    Zen zey came for LE FROMAGE ?!
    Sacre blue ! Enouef !

  • I mean, come on. The freezers are on the Internet, no firewalls, fully accessible to anyone with a browser. Their "security" consists of rotating the admin password daily... to the current date. There are guppies out there that could gain access to these. The root cause here is willful negligence by the retailer's IT department.

  • ... always a bad idea. With LLMs, basically incompetent people can hack all instances of such a device everywhere for cheap now.

    • Nothing is really secure, no need to qualify it with 'secure'. Simply stop putting things on-the-line that have no business or need to be there. It seems no one learned from the multitude of printers that regularly get abused because someone blindly put them on the outward facing network.

      • Re: (Score:2)

        by gweihir ( 88907 )

        Not true. Sorry, but that is my area of expertise. Things are insecure because they are cheaply or incompetently made, configured and operated, often all of that.

  • Don't put things on the internet that have no business being on the internet. Next time it will be some unsuspecting infrastructure attack.

  • This reminds me of the scene from Silicon Valley, where Jian Yang's smart fridge is hacked and ends up with a mime on the front
    https://www.youtube.com/watch?... [youtube.com]

  • There were reports of bery similar attacks in prebious weeks against commissaries at US military bases and a single event at a Sobeys at Fort York - the latter hasn't been publically confirmed to be a cyberattack but who knows.

  • More food retailers getting hit in EU (Score:3)

    by JaredOfEuropa ( 526365 ) on Tuesday October 13, 2026 @04:14AM (#66373686) Journal
    Same day, Albert Heyn and Delhaize got hit (Netherlands and Belgium). The nature of the incident is as yet unknown, but it is now clear that these supermarkets have had to shut down parts of their systems preemptively, following a "cyber incident". The shops are operating (and freezers are cold), but websites are down, self-checkout kinda works, payment systems are slow, and all home deliveries have been cancelled. Logistics to stores have also been affected.

  • This isn't a "cyber incident" it is a bad design that failed to account for an obvious known problem.
    The sad thing here is how we think about this and allow vendors to operate is broken and nothing is changing.
    In a sane world much of this would be illegal:
    - Designing durable appliances to fail quickly and contain vulnerabilities
    - Supporting those devices for a small fraction of what that appliance life really is.
    - Blaming the customer when they don't throw out the device
    Fundamentally until vendors get held

  • ...the password was hard-coded to today's date, and some "smart" people put it directly onto the Internet (or via port forwarding).

    To an outside person, this was virtually indistinguishable from an web-site, in fact from the screen-shots circulating on Fedi, it even looks well designed compared to many web-sites out there.

  • Much like the arson attacks and dragging anchors, hacking physical stuff leads to disruption.

  • replay of https://www.militarytimes.com/... [militarytimes.com] ?

    Aug 28, 2026 — More than a half-dozen commissaries on military bases in the continental U.S. reported refrigeration outages this week.
    Google AI Overview says...
    An unexplained wave of simultaneous refrigeration and freezer failures hit at least 14 to 18 U.S. military commissaries in late August 2026.

    Overview of the Outages
    Timing: The simultaneous system failures occurred overnight in late August 2026.
    Scale: Reports indicate between 14 and 18 Defense Commissa

Slashdot Top Deals

The closest to perfection a person ever comes is when he fills out a job application form. -- Stanley J. Randall

Close