As I mentioned in the thread regarding the previous attacks, I worked in a closely related field back in 2008-2009.

One thing I see repeatedly brought up here in this discussion is "Why can't we just set the refrigerator temperature with a knob and walk away?"

The problem is that these refrigerator cases are not as simple as your refrigerator at home. As a simple example, many systems allow you have control over the deadband: the exact low temperature at which the compressor turns off and the high temperature at which the compressor turns back on. You also have control over defrost cycles, compressor pressure and many other things (I worked with this a long while ago, and I don't remember all the details).

Take a look at some of these manuals, for example: https://www.hillphoenix.com/resource/installation-manuals-2/?type=Installation%20Manuals As far as I can tell, those manuals just cover the refrigerator cases, and not the outside compressors and heat exchangers, which are another layer to deal with.

This is not something that a non-expert supermarket employee would be able to handle well. The purpose of all these settings is optimize around energy usage, maintenance costs, customer experience, etc. Even if you only save $500/store/year, you can see that it really adds up over a chain of 1000 stores.

That's why this equipment is remotely accessible: it's not like your fridge at home and requires a lot more knowledge to get the most out of it. Of course, that does not excuse poor security implementations.

> The problem is that these refrigerator cases are not as simple as your refrigerator at home. As a simple example, many systems allow you have control over the deadband: the exact low temperature at which the compressor turns off and the high temperature at which the compressor turns back on. You also have control over defrost cycles, compressor pressure and many other things (I worked with this a long while ago, and I don't remember all the details). … This is not something that a non-expert supermarket employee would be able to handle well.

I still don't see why the expert has to be remote, or why an integrated computer can't do the optimization. Or why it needs to be fiddled with at any significant frequency.

And how much money the shop looses from the attack? It sounds it wiped out all the saving remote automation brought.

I don't see why saving $500 per store a year is better than exposing your systems to cyber attacks.

Sadly, the exact same hack happened in hundred of french grocery stores three weeks ago. I question people's ability to fix this kind of issues

and electric stations, municipal water pumps, cellular networks, over-the-air software updates to your car ...

I'm extrapolating a bit here based on Reddit hearsay, but I think this may have to do with rural stores having essentially consumer-grade internet routers connected to the mobile broadband network.

Much of the coverage in Swedish media drives the point that only 4G-uplinked stores have been hit so far. I think that's unfortunate, because really it wouldn't have differed if these stores were connected by 5G.

I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router. In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN, so my guess is that these control systems were simply findable on Shodan.

This also explains why this wasn't discovered after the recent French breach. Supposedly all the stores with "proper" uplinks were in compliance, and no one had thought of a way in for those non-compliant stores, because they "weren't even connected, so how would an attacker get in?"

"... I think this may have to do with rural stores having essentially consumer-grade internet routers connected to ..."

It has to do with refrigerators reachable on the Internet.

If the refrigerators were not reachable on the Internet, none of this fragility would exist.

The fragility of refrigerators reachable on the Internet was demonstrated just a few weeks ago. These refrigerators were left connected to the Internet.

This lack of discernment and misunderstanding of risks and fragility will not be solved with a better router or a different uplink.

Yeah

And it would be (mostly) fine if they were on the net, with read only access

The entire reason they are put on the Internet is to allow for remote control. What problem would it solve to allow remote monitoring of refrigerator data without control?

Do you think the code in these systems is secure enough to enforce read-only access?

It doesn't need to be perfect, it only needs to be better than what it is today (predictable passwords)

Many of these smaller stores (and probably some of the larger ones too) rent or lease refrigeration equipment from one of a handful big providers. These are large and expensive systems, and there is costly paperwork involved together with logistics suppliers to show that the cold chain is satisfactory.

These refrigeration providers work with local contractors and HVAC companies to set things up. Their installation techs do what they think is required to remotely operate these systems. If you bring up the question keeping these systems offline or at least on airgapped networks you will most likely get a shrug as reply.

This is not a technology problem. This is problem of responsibility. One can hope things will improve when litigation starts happening, but it doesn't look good considering these people had literally months of notice since the well-publicized attacks on the American fridges, then the French fridges, and now these.

Litigation is not how we fix things in Sweden, the system is very different from the US. The companies will have to take the losses or try to recoup from insurance and update their systems. They might be able to negotiate deals w the fridge install companies.

How do things get fixed if not by litigation?

Usually national associations get together, discuss issues, and come to some sort of agreement or recommendation that is then followed by most actors.

Litigation does of course occur but it's not the main mechanism.

Some countries have regulatory bodies that are empowered to effectively regulate industry.

Isn’t that just litigation brought by the government instead of private citizens?

No, most of the activity or function of regulatory bodies is not litigation. Litigation would be the last resort.

Litigation is the last resort in the US system, too. It is the threat of fines/damages that incentivizes a company to do right by its customers/other stakeholders.

It's a nice thought. I doubt it's true in reality. If it were true in this specific case for example, the industry wouldn't have the freezer situation to begin with (it implies non-effective regulation is already the context).

It is simultaneously true that:

1. many countries have higher regulatory burden than the US

2. that does not mean regulatory gaps don't exist

The person above was simply pointing out that litigation is not the only way to solve a problem. Which is plainly true, you can simply require compliance via other legal means. For example, a government could create a regulatory standard for security and require vendors to follow it. Whereas in the US the political appetite is to be more hands-off and allow people make vulnerable products if the market allows.

Parent is not correct. Litigation certainly is a thing, but it is less prevalent than in the US. Perhaps the food chain will take the loss, be covered by insurance, and the insurance company will sue.

If not buy insurance, the customers will have to pick up the tab. Vendors sell the product/service and are completely responsible for any losses.

That is the same way it works in the US.

All of the fridges stayed online after the hack. I ran a Shodan scan a few days later, and the number of reachable fridges actually increased. The first hack might have been a surprise, but anyone who was IT in a refrigerator management company should have been able to run a (free) Shodan scan like mine and get the whole list.

> I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router.

Why would there be accidental port mappings on their router though? I could maybe see owners setting it up so they could monitor from home, but even that is a bit of a stretch for rural supermarket owners

> Why would there be accidental port mappings on their router though?

That's the point of NAT-PMP / UPnP, it just works (for game servers, torrent clients, industrial control systems etc.)

The idea of a control system requesting a port forward rule using NAT-PMP is itself rather questionable.

My guess is setting up a port forward in the gateway router is part of the freezer install process. The customer probably had to give the tech the router credentials and the tech sets up the forward themselves.

absolutely unbelievable (even by the very low standards I see, being in iot myself) that any commercial equipment would be doing upnp

someone manually poking a hole in their firewall is way more likely

Reminds me of the AC at a large multinational Indian company I used to work for - the only way to adjust the temperature or airflow was by calling a service desk operated from, you guessed it, India. Bit of a nuisance when it's -10 degrees outside, while the support people are working in excess of 30; they just didn't understand why anyone would want anything higher than 16, nor were they willing to let it sit at a reasonable temperature.

Meanwhile, you have stores like CircleK that, at least in most of Europe, operate a large fleet of externally connected monitors that keep track of temperatures, but staff themselves adjust the fridges and freezers. All you get by breaching those would be a bunch of temperature readings. Great in a pinch if you're looking to buy an industrial fridge or freezer, not so much for anything else.

Back in 1995 this was so improbable it was one of the purported negative effects of the "Good Times" virus which was a parody of the virus warning e-mails that were being forwarded around at the time. Computers still can't give you Dutch elm disease, fortunately.

> It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty.

https://people.cs.rutgers.edu/~watrous/goodtimes-spoof.html

Discussion from 3 weeks ago on the refrigerator "hacks" in the french supermarkets:

https://news.ycombinator.com/item?id=50055304 (~1000 comments)

Thanks! Macroexpanded:

Hackers activate automatic defrosting in supermarket fridges across Europe - https://news.ycombinator.com/item?id=50055304 - Oct 2026 (1007 comments)

I think the military commissary's freezers were hacked - https://news.ycombinator.com/item?id=49508506 - Aug 2026 (239 comments)

Why isn't the brand of cooler or cooler-controller being named?

Was it a password break or an open admin console or SNMP or what?

In the attack on French supermarkets a few weeks ago, hackers pirated controllers mostly supplied by the Danish company Danfoss.

Multiple sources confirm that it's the same Danfoss problem this time, for example, https://www.hln.be/binnenland/centrum-voor-cybersecurity-bevestigt-aanval-op-koelinstallaties-in-belgische-supermarkten-maar-hoe-kan-dat~a9d993ad/ (in Dutch)

In the Reuters article on it weeks ago they mentioned finding 4500 similar freezers still available online, with the simple login bypass included. So yeah that was just a matter of time?

Glass half full: The scale of this is rather small overall, so most supermarkets etc. appear to have at least some form of basic security.

In France I believe that the password on the monitoring software, or the controllers, was updated daily. The date was somehow used as the new password, or as an input to the password sequence. So rolling the passwords didn't do anything when the attackers are aware of the "algorithm".

Sounds like other retail systems where lock screen passwords are the store number or similar conventions

The BBC names (and quotes) Sabcobel as one of the manufacturers.

https://www.bbc.co.uk/news/articles/cq1kd1nee80eo

Also hit a few smaller business in The Netherlands: https://nltimes.nl/2026/11/02/fridges-freezers-17-dutch-businesses-attacked-large-supermarkets-unaffected

With the following interesting quote from the supplier of the system:

After that attack, Danfoss advised its Dutch clients on October 13 to disconnect their systems from the internet and ensure they only reconnect via a secure network. “Most stores took action at that time, but a small number did not,” the spokesperson said. “They are now the ones suffering the consequences.” The spokesperson added that the systems hit last night were not on a secure network and were still using default passwords. The attack could have been prevented if measures had been taken, he said.

Probably most of them had exactly zero inhouse expertise in cybersec and just pretended there’s nothing to worry about because having to worry would be inconvenient. Maybe some of them made a call to their cold chain supplier and were told that there’s nothing to worry about.

I wonder how many people working in any given supermarket chain actually know that their fridges are connected to a network at all.

Not many, probably, but their cold chain people definitely would have known. Instrumented and remote monitored cold chains are standard these days because keeping stuff refridgerated end to end is a pretty big deal.

Depends. Lidl wants to be a tech company.

https://en.wikipedia.org/wiki/Schwarz_Digits

It really depends on the grocery. Kroger gets a big chunk of their profits from their data stack.

I wouldn't be surprised if its their own agencies hacking these systems preemptively in order to force the issue and increase robustness against a larger multi-pronged attack.

I’m still trying to figure out why these freezers are connected to the Internet in the first place…

Monitoring, alerting, remote diagnostics and trouble shooting.

Commercial cold chains are expensive, high value collections of equipment that even small errors at the edges can cause huge monetary losses. And grocery stores are in an extremely low margin business.

Those are read-only. None of those things require the ability to heat up a fridge remotely.

Diagnostics and troubleshooting are not necessarily read only. Some of these systems have temperature controls that are centrally managed for operations centers for instance.

Monitoring should be in a DNZ that can talk to the otherwise “airgapped” network and push metrics out to the SaaS platform or whatever. Send a technician if something needs to be adjusted, or (only if some kind of remote access super critical) give the customer the ability to grant temp access to technicians for remote troubleshooting (but require someone to be in the facility).

None of this requires the customer to be technical, the ORM could ship the equipment with the network setup, and installation would just be connecting the DMZ device to the Internet.

The question wasn’t why these systems are setup insecurely (which has an obvious answer about cost prioritization).

Of course there are ways to setup these things securely, same with smart tvs and doorbell cameras and whatever else is getting hacked. People just have a bad time figuring out the cost benefit of all of this. And frankly we don’t know if that cost benefit has even been crossed yet, perhaps this doesn’t rate.

You yourself are engaging in cost prioritizing without adequate information. Sending a technician on site may be extremely expensive (opportunity costs and inventory risk on cold chains are wild).

Maybe we should stop connecting things to the Internet that don't need to be?

I don't understand why these things aren't on their own (V)LAN. Why they are open to internet?!

Brainstorming here; monitoring, logging, etc. The fact the store managers were called out of bed when there was an issue indicates it works. If a cooler broke down overnight or its temperature was too high for X amount of time, they have to discard the products. Without monitoring they likely wouldn't know until customers got sick.

I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.

All of this can be done without connecting edge devices directly to the internet (and potentially allowing inbound connections). The question is not why they have networking, but why the connectivity is such that an attack like this is even possible.

given they turned off the refrigerators (instead of something evil like turning them down for just long enough to allow bacterial growth and then turning them back up) customers would probably have noticed their ice cream being liquid, the frozen meat not being frozen, etc

I still don’t follow. You’ve said a lot of things about regulation and insurance requirements and all that, but I don’t see how any of it is necessary to get to “centralized management.” Let alone goofing up the centralized management.

I’m just a software person, not a supermarket expert, so maybe I’m being a bit simpleminded here, but for the entirety of my career I’ve participated in a constant trend toward centralizing and automating operations. That’s been the case regardless of how highly regulated the industry was. The motivating force has always been making things easier, cheaper and less error prone.

I suppose we could throw a rant about regulation into the mix, but, in the words of Laplace, I have no need of that hypothesis.

After hearing of such attacks, I always wonder what is the possible benefit anyone gets from acts like these

Destabilising.

We can’t get food in the supermarket. People get scared. Better not poke the bear. This government sucks, let’s get the populist one that will fix all this overnight somehow.

Possibly Russia looking to destabilize Europe.

This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time. Or to take the freezers offline if an update isn't available.

I now read some interviews with local chains in Sweden and Finland, and they were still just investigating what to do at this point.

I dont think VPNs are the correct solution. They are one solution, sure, but if it is the correct solution depends on many things.

For example, where does the VPN connect to? The vendor? Do you trust the vendor more than the internet. Sure. Do you trust the vendor, that does not manage the firmware of their devices and uses inbound connections in the first place, enough to put them on a VPN?

How many devices and vendors do you have? How many VPNs can you establish with the existing networking hardware, and how many can you manage without IP clashes etc. IP clashes work both ways, btw. The vendor has to manage this themselves also if all their clients want VPNs.

Retailers are enterprises with 100s of vendors that run on a shoestring. On top, they use a lot of legacy architecture and hardware. They have teams that have a hard time making an architectural decision in the best of times, but even less so under stress. It is probably the same on the vendors side.

In my mind, the correct solution is indeed to deny any inbound connection to the network, now, to prevent further damage.

Incident response is, in order:

    1. preparation (failed)
    2. identification (done)
    3. containment <--- we are here (take offline, put manual rota in place to manage fridge defrost cycles) 
    4. eradication (VPN, etc)
    5. recovery (take it back online, relieve manual rota)
    6. postmortem etc

Yes, VPNs would be the correct solution.

However, we're talking about companies that put unprotected systems on the public network and did nothing about it even after getting three weeks advance warning.

Seems like the biggest chain in Sweden, ICA, had a VPN. They were affected but only the franchise takers that were (for whatever reason) outside their internal network.

Same in Finland, Kesko said they've heard reports from systems NOT connected to their centralized monitoring systems.

You can lead a horse to water, but ...

>However, we're talking about companies that put unprotected systems on the public network and did nothing about it even after getting three weeks advance warning.

I don't know the companies in question here, I'm not European and my EU family lives in France not Belgium or Sweden, but fwiw here in the states a lot of supermarkets are independent grocers or in a sort of formal or quasi-franchise arrangement where it's part of a "chain" but each store is still somewhat or quite decentralized in management when it comes to the physical stuff at the local store. Which is probably a strength in a lot of cases, makes it easier to adapt to local environment faster, but I suspect there's just plain a knowledge/skill/priority mismatch when it comes to IT. That'd also line up with some of the reports on this I read where there was some official central management system, except certain grocery stores just weren't using it?

The components of solutions for this exist and could even be really cheap, we're not talking much bandwidth here. Not hard to imagine even in a independent grocer association or loose franchise system they could tape together an SBC with preconfigured OPNsense or VyOS or whatever on it and a switch and be able to just tell stores "here, plug your freezers into this, access the portal here" as a default and it'd just route all their traffic to the franchise/IGA's management system. Someone still has to secure that of course, but at least it wouldn't be on the open internet.

Places that wanted to could of course do this other ways, I'm just saying that even with the very tight margins grocery stores tend to run on I think it's very doable to do better going forward, just will take some coordination and knowledge building. "The future is already here, it's just not evenly distributed" and all that.

The skill, and time, required to "take it offline" is far lower than any solution mentioning VPN. And given that, more likely to succeed while a better solution is found.

>>Or to take the freezers offline if an update isn't available. > > Why the heck would this be necessary? We have VPNs holy crap

Each to their own… but why do fridges need to be connected to the internet in the first place?

Completely speculating as I don't know the situation in Europe, but some possible reasons are:

- Remote alerting for the store manager/head office to quickly respond to a refrigerator failure after hours, providing options for saving valuable stock (e.g. move stock to another refrigerator).

- Maintaining an audit trail for cold chain management (e.g. regulator says you must keep an audit trail proving that a frozen fish has been kept below -30oC since it was processed on a ship all the way up to point of sale in a supermarket).

- Refrigerator manufacturer says a condition of warranty is that the refrigerator must provide remote telemetry proving some warranty condition has been met (e.g. regular cleaning cycle operated).

Note: all these speculated reasons are unidirectional data flows. So even if a valid reason exists for Internet connectivity, why can't it be limited to unidirectional data flows?

Also so the temperature can be controlled to make use of cheaper electricity — if you know it's going to be windy from 02:00 to 04:00, then still until 06:00, you can run the freezers a bit extra while the electricity is super cheap.

Fridges and hvac consumes an order of magnitude more energy than lighting

> Maintaining an audit trail for cold chain management

It's this, primarily, or most importantly.

I work in the restaurant industry. Health departments require you to assure them that your hot things are kept hot and your cold things are kept cold. The old way was staff walking around the store reading thermometers and writing temperatures down on paper; the newer way was your staff walking around the store inputting temperatures on an iPad connected to your business-management software. The trouble with that is that staff forget to do it (despite threats of discipline, and push notifications to their phones), or even blatantly fake it.

Failing to keep an accurate temperature log means fines, and other consequences, up to and including loss of your health license. I am 100% in favor of this legislation, and solid enforcement of it. The main improvement I would make is to harmonize codes and enforcement across municipalities. I'm in the USA, every county has their own requirements - and their own "portal" for submitting documentation. It's a massive pain in the ass to write Standard Operating Procedures for staff across multiple stores in multiple enforcement districts when there simply aren't any SOPs.

The majority of the fines our (responsible, and genuinely trying-to-do-it-right) company received were things like a staff member moving from a store in County A to a store in County B - just for a few days, to cover someone's PTO, or something - and inadvertently followed County A's logging requirements rather than County B's. Two genuine cases: logging every two hours, instead of every ninety minutes; using whole degrees, instead of tenths. We could appeal, but that takes a lawyer's time, so even if successful it wasn't always worth it.

Real-time data, from connected sensors, is unambiguously better. Staff get loads of time back, to make food, or help guests; all the logging gets done "right", for whatever jurisdiction; data's held by a third-party, so nothing can be faked.

That said, we're not connecting our infrastructure to the internet! We have a separate IoT sensor service that tracks the temps for us. I'm sure their security is also terrible, but that doesn't matter nearly as much. A year of their service is ~80% of the "routine", and totally innocent, fines and other costs that we were previously paying. That's the way all of these stores should go, in my opinion.

Those might be reasons for them to be connected to a network. They are not reasons to connect them to the internet

If you want to be able to do that monitoring from a central location then at some point you will need some form of internetwork to support transferring data between local networks. And nowadays there is really only the one obvious choice of internetwork.

Some large supermarkets (in the UK at least) sell their capacity to the National Grid so it can be balanced in times of demand. They agree to turn off their freezers for a set amount of time to create a "virtual battery".

Supermarket freezers are a bit more complicated than that. They can run at different temperatures and can consume a lot of power, so are part of a bigger store HVAC and electrical system as they may load-balance. Stores do not have qualified engineers on site to do anything with refrigeration equipment and it is better to have minimum wage offsite monitoring than expect a minimum wage shelf packer who only gets one toilet break a day to care about the fridges.

Very likely they shipped with an ADMIN/ADMIN username/password and nobody changed it. Because who would want to break in to a freezer, right? It's not like there's bitcoin in there.

We've been telling people for years that naive threat modeling was going to bite everybody one day. And finally, here we are.

Approximately. These models had been deprecated by 5 or 10 years, and a successor model last year had a software update issued because they had a secret "password of the day" that allowed you to use the date as the admin password.

I don’t know about supermarkets but for medical freezers it’s useful to be online for monitoring and calibration.

My org has lots of freezers that need to be at precise temperatures. Sometimes they drift so you have to check them a few times per day, log the check, and adjust as necessary. Doing this for a thousand freezers is tedious and error prone. Networking helps. “Cloud” lets it all be done remotely without getting IT very involved for vpns to be set up with specific vendors. It also helps with patching and auditing security so seems odd that these supermarket ones were out of date.

It seems like monitoring did not work out so great for them this time :)

(Assuming they didn't also patch the telemetry software, but that is a much harder attack than just raising the temperature).

On top of the monitoring mentioned by others, it's also to create a centralized log of actual temperatures. This then lets you show inspectors that you are keeping up with refrigeration requirements.

Creating a centralized log is monitoring. It doesn't need write access to the defrost setting.

Yep, but once you have internet connectivity, things escalate and people say "wouldn't it be convenient if we can also...."

You have to wonder about the monitoring - it apparently wasn’t alerting for someone to do something about it in time. What was the point of the monitoring in that case??

It might have dutifully logged that the temperature setting was changed, which will allow regulators to conclude that the safety of the food stored in these refrigerators can no longer be assured.

Compliance tends to warp the underlying goal quite a bit.

What I read from the last wave is that supermarket changes how cold freezers will run depending on how much customers they expect that will open and close the doors. Just having the freezers adapt based on the temperature of every single moment cost too much electricity or can result in unsafe temperatures.

For commercial uses some kind of global monitoring is not super crazy. Regular retail freezers being on the internet, that's the crazy talk.

Monitoring doesn't need write access. RS-422 is simple and reliable. It uses separate receive and transmit pairs and you don't need to connect both. The freezer can continually transmit its telemetry over unidirectional RS-422 and a separate system can forward it over the Internet.

Hackers can still tamper with the telemetry and create false reports of problems, but actually changing the thermostat settings would require local access, so there's opportunity for somebody to verify the problem really exists.

But why can they control the temperature then?

If I put a Zigbee thermometer in the freezer they can hack it all they want, but I am pretty sure they will not be able to set the temperature to 50C.

Read access, sure. But being able to turn them off?

Likely so that stores can be monitored remotely. A lot of supermarkets have a centralized orchestration somewhere, especially big chains.

I do work in the retail refrigeration world nowadays and "just updating the software" is much easier said than done. I'm usually touching grocery stores with 20+ year old hardware from the dawn of centralized control and monitoring. It's not s trivial thing to rip out the controllers and install new ones.

This very likely first happened in the USA at military commissaries in August. https://www.stripes.com/theaters/us/2026-09-01/army-cid-investigates-commissary-refrigerator-outages-22721718.html

Has anyone determined if these were separate from the attacks on US military PX refrigeration that happened well before that?

Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

I worked in IT for a major retail chain in the US. I was on the team in charge of store systems. We knew what devices were connected to the network, and if we had a vulberable device like this, we would have sent an urgent message to store managers to disconnect themm immediatly, and we would have followed up with scans over several days to ensure it happened. There is no excuse. (If we really needed the devices connected, we would have put them on a firewalled VLAN, which we could have pushed out in hours and had across the nation within days at most.). Granted, ideally we would have already had them VLANed.

It is incompetence to not have this capabilty.

>This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time.

Came into the thread thinking it would be a new report about the same incident not a new one, yikes.

To be fair, wouldn't the chains probably be reliant on their vendors for an update? and turning off all the fridges for weeks is probably not a sustainable solution... :/

In the case of France, the vulnerability was announced in August, 2025.

I believe gigantic fines are appropriate. They need to be of a size where the entire management team has significant financial issues for many years to come, even after having sold their houses, big cars, etc.

Nothing will improve until there are personal consequences.

I hear you're passionate about this, but why a fine? They were the victims, in our society the victim of a crime doesn't need to be penalized further, moreover, the only damage was to themselves.

This is what happens when you over-optimize and over-automate. You should just be able to plug those freezers into power and turn a knob to set the temperature. There is no reason for them to ever have an internet connection.

The temperatures of these freezers need to have a centralised audit trail, to comply with foodchain regulations. While such an audit trail could be built without Internet, Internet seems like an obvious solution.

The true problem doesn't lie with Internet access, it lies with low quality software.

The internet seems like the easy solution, not the obvious solution. For years, we have used the internet for things that didn't need it because it was easier and it seemed safe enough. I think that the coming months and years are going to see a lot of companies burned by that decision and scrambling to undo it.

The fact was that it was never safe, it was never secure, but that taking advantage of those problems was hard, and generally not monetarily worth it, meant we ignored the issues. That's no longer the case.

As for low quality software, the floor for the quality that internet connected software needs to have is now dramatically higher than the quality that non-connected software needs. I think that in many applications, it may no longer be economically worth it, or maybe even possible at all, to hit the necessary quality.

I think it's a tough question.

First, I don't think people will give up the convenience of having instant access to the information.

Second, hackers are way ahead in terms of using AI. But it doesn't mean that it's going to stay that way. AI is going to be used for cyber security more. The implication is that the operating costs will be higher. In this case, it will make your groceries more expensive.

isn't it closer to the internet is owned by business interests, even though most of it was built out by the public and it was just slowly moved into the hands of people who don't care particularly about how it's secured.

The audit trail (status in general) could be read only. Enabling remote defrost (control in general) is an optional convenience which requires better quality software.

Those regulations need an update.

And the simplest solution is to air gap these systems, then figure out how everything else should work.

In NL we use paper and pencils for elections because it makes fraud incredibly hard. It makes the process harder as well but the baseline is that it breaks nation-scale attacks. Why this level of thinking isn't applied to our foodchain is beyond me.

What if high quality software exists, but the supermarkets did not pay to install the last 10 years of updates?

So then you have a connection going one way (freezer to data-logging endpoint) and not the other.

You should only ever have hardware visible in the internal network, no need to put them on the Internet at all.

These need to have an audit trail. Making it centralized is an addition, no?

The simple plug + knob is the right solution. It’s the most resilient.

The auditors should have their own devices separate from the temperature control to monitor them. All it needs is a few sensors, temp, humidity, etc.

No need for complicated cloud this-and-that nor air-gapping a grocery chain. Keep it simple.

I'm not sure about freezers (I guess there was no monitoring) but when I worked for a large UK supermarket chain in the 2000s this was how the POSs worked.

When I first started credit cards were not taken as online payments, the system just stored your card details and the amount. That was sent to server in the back office, which collected all the data, then every night it would make a dial up or ISDN connection to the head office and send all the data there.

>the system just stored your card details and the amount.

At least with CC's this would get your account cancelled now.

most issuers still have this as an option.

Which is easier, getting the audit trail from non-internet-connected devices, or keeping all the devices patched?

The right answer isn't forever patching freezer software. The answer is either to not have them on the internet, or to have something in front of them, and keep that thing very up-to-date. (Or maybe several layers of "something" in front of them.)

Just keep them read-only, if a freezer need to be defrosted send an SMS to the store manager with the message “go hit the defrost button”.

It's useful to have a central monitoring system, so you can detect if a particular device fails so you can dispatch someone to fix it, move the stock elsewhere, etc. Of course, such systems can also be weaponised against you, as this proves.

Monitoring doesn't require anything more than read-only access to fridge data.

Ironically, were the monitoring system competently made, not only would it have been unable to cause this problem, but it would have also been able to alert about it in time to prevent significant loss.

even with remote access, they shouldn't have controls that allow for unsafe conditions.

It's more just what happens when you don't have sensible monitoring and/or incident response.

> There is no reason for them to ever have an internet connection.

You can't know this.

Why do they need to change the temperature? I thought it was supposed to be constant.

If you're changing the contents and need to change the temperature, shouldn't someone at the local store be there changing the contents?

I'm not even sure of a scenario where remote control from off site is faster or more convenient. I could see a managers office wanting a connection to them maybe.

Monitoring for compliance is almost certainly easier to manage remotely, which is probably why they're connected in the first place. I would guess control was likely a nice value add. e.g. so someone could respond to an alert remotely

Similar thing in Estonia: https://news.err.ee/1610183296/hackers-raised-freezer-temperature-at-selver-supermarket-to-50-c

If you definitely need to connect them to the internet, make them read only?

I was talking yesterday to my AI imaginary friend about creating an MCP for one of my apps, and the first thing she told me was to make everything read only. No matter how many security layers you have in place, passwords, auth libs, whatever, it will be leaked/hacked so you better be prepared for minimum damage

Monitor your freezers temperature? yes, but never allow their thermostat to be set over the internet. I hope the lesson is learned. Applies to all appliances

They do it to take advantage of energy price fluctuations, but the connection should be more secure. What makes no sense is not having a fallback to take the freezers offline after the attack, so their solution is to just fully turn them off?

That would be cool, do you have any source that confirms they used this for taking advantage of price fluctuations?

I've fantasized a long time about a clearer separation of technology from life, since it's been depicted in some ways I appreciated in fiction. But at this point, I'd just take a set of laws around what types of items should ever have any sort of networking.

I believe it's industrial protocols used to connect such devises to a SCADA system. It this case it's the SCADA system that has to be disconnected from any general purpose networks.

The freezer itself doesn't need to connect to a SCADA. You can network power and temperature monitors, but those monitors don't need the ability to shut off the freezer.

These freezers are manually stocked and cleaned. If they need to be powered down it's a simple matter of a hardware switch that you flip when the unit is empty.

Ireland too: https://news.ycombinator.com/item?id=50335252

> Danfoss said it had identified security flaws last year and had “long recommended” customers install updates.

This is a cyber-attack made possible through severe negligence on the victims’ part. It’s like a home burglary where the victim left the door wide open for months without ever checking on their home.

Therefore, the news should be about that negligence. That's the interesting part.

No joke, yes they did. The markets hit here in Sweden are all in rural communities with very low number of tech workers. They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.

But then the supplier is responsible, why would you ever put a fridge online if you are are tech noob. Someone told these people to put these fridges online, they didn't put an Ethernet cable in the back by themselves for the fun of it.

The company installing the fridges did. The person who is an expert in food chain logistics bought the shiny fridges and was enamoured by the real business benefits they had of centralised monitoring and alarming of their fridges.

>The markets hit here in Sweden are all in rural communities with very low number of tech workers.

Hej! You are wrong, here in the middle of Stockholm got hit.

https://www.mitti.se/nyheter/icabutikens-frysar-hackades--fick-slanga-allt-6.3.394424.4854a6a166

ICA Baronen on Odengatan is one of several stores in Sweden that have suffered a major hacker attack. On Monday, their freezers were cancelled at 50 degrees.

This is in Stockholm - https://maps.app.goo.gl/BwbDST4dPVkjcdgA8

So no lack of IT workers/tech workers... Nor is it very rural.

>They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.

The first thing to do when you get access to these as a hacker? You disable the alarms...!

Now, the supplier should have set them up correctly over VPN, good passwords, Zero Trust etc but these an OT/SCADA are usually just open to the internet due to the simplicity of use.

Hence why you need an alarm for alarm disablement

(I mean, you need also a bunch of other things but yes)

Some of them (Coop) got new equipment after what happened in France and where gonna upgrade them in two days.

Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT of course but they usually do POS and desktops/servers.

The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

ICA is franchised, so stores are owned and run by operators. The central company offers some services, but a lot of the decisions comes down to the individual stores.

The bizarre thing is it is the second time for Delhaize, although the incident of two weeks ago was related to the pricing system.

After the PHP vulnerability, we got some clients asking if our SaaS product used PHP (it didn't). It's possible that they just contacted their vendor, who assured them that everything was fine.

There was an interview with an angry store manager, he's mad at the attackers, but I didn't hear the media ask him why they didn't improve security after the French attacks. Only now do they appear to want to start a review of their monitoring system.

https://www.svt.se/nyheter/lokalt/skane/icas-kylar-och-frysar-i-sjobo-hackade-haller-ej-temperaturen

Isn't it more than logical for a store manager to be upset?

At the human being level, this attack is mind boggling. What do you get out of this, other than making good food go to waste?

Edit: Also keep in mind that there's franchising in supermarkets as well. So the guy might literally be looking at losing a chunk of money as a result of something out of his control. Doesn't change the situation, but not having done something doesn't make them deserve this...

The store managers don't manage the IT security of the chain though.

No, and I get that, but working in the industry, he can't have been in the dark about the events in France. If he doesn't deal with the monitoring of the fridges himself, he should be equally upset that the chain has failed to act.

Thats interesting something similar happened at military grocery stores in the US a couple months ago

Every time I read news like this I am wondering what an average household has hanging on the internet, totally vulnerable.

https://news.ycombinator.com/item?id=50335602

https://news.ycombinator.com/item?id=50335252