This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time. Or to take the freezers offline if an update isn't available.

I now read some interviews with local chains in Sweden and Finland, and they were still just investigating what to do at this point.

>Or to take the freezers offline if an update isn't available.

Why the heck would this be necessary? We have VPNs holy crap, the entire genesis of the technology was to solve this fucking problem. If it's not literally intended for the general random public to be able to randomly visit and use themselves, it shouldn't be exposed on the public internet it should be (heavily restricted) LAN-only with remote access done via VPN. While it's even better if every single last thing is well secured at the client-level too, it goes a long way with ancient (or new, but with ancient-equivalent software design expenditure/decisions) kit to protect it at the network level.

Creating a false binary of "take it offline!" when businesses have very good reasons for networking many classes of industrial hardware seems self-defeating vs "just get the cheap bare minimum basic network protection done". I mean shit, even if somehow they've gotten suckered into freezers which demand access to a non-self-hostable manufacturer server (hey EU! here's something useful to regulate! if nothing else order manufacturers to have WireGuard end points for connection) they could at least have the firewall allow !RFC1918 solely and exclusively to that address on those ports.

Yes, VPNs would be the correct solution.

However, we're talking about companies that put unprotected systems on the public network and did nothing about it even after getting three weeks advance warning.

Seems like the biggest chain in Sweden, ICA, had a VPN. They were affected but only the franchise takers that were (for whatever reason) outside their internal network.

Same in Finland, Kesko said they've heard reports from systems NOT connected to their centralized monitoring systems.

You can lead a horse to water, but ...

>However, we're talking about companies that put unprotected systems on the public network and did nothing about it even after getting three weeks advance warning.

I don't know the companies in question here, I'm not European and my EU family lives in France not Belgium or Sweden, but fwiw here in the states a lot of supermarkets are independent grocers or in a sort of formal or quasi-franchise arrangement where it's part of a "chain" but each store is still somewhat or quite decentralized in management when it comes to the physical stuff at the local store. Which is probably a strength in a lot of cases, makes it easier to adapt to local environment faster, but I suspect there's just plain a knowledge/skill/priority mismatch when it comes to IT. That'd also line up with some of the reports on this I read where there was some official central management system, except certain grocery stores just weren't using it?

The components of solutions for this exist and could even be really cheap, we're not talking much bandwidth here. Not hard to imagine even in a independent grocer association or loose franchise system they could tape together an SBC with preconfigured OPNsense or VyOS or whatever on it and a switch and be able to just tell stores "here, plug your freezers into this, access the portal here" as a default and it'd just route all their traffic to the franchise/IGA's management system. Someone still has to secure that of course, but at least it wouldn't be on the open internet.

Places that wanted to could of course do this other ways, I'm just saying that even with the very tight margins grocery stores tend to run on I think it's very doable to do better going forward, just will take some coordination and knowledge building. "The future is already here, it's just not evenly distributed" and all that.

The skill, and time, required to "take it offline" is far lower than any solution mentioning VPN. And given that, more likely to succeed while a better solution is found.

I dont think VPNs are the correct solution. They are one solution, sure, but if it is the correct solution depends on many things.

For example, where does the VPN connect to? The vendor? Do you trust the vendor more than the internet. Sure. Do you trust the vendor, that does not manage the firmware of their devices and uses inbound connections in the first place, enough to put them on a VPN?

How many devices and vendors do you have? How many VPNs can you establish with the existing networking hardware, and how many can you manage without IP clashes etc. IP clashes work both ways, btw. The vendor has to manage this themselves also if all their clients want VPNs.

Retailers are enterprises with 100s of vendors that run on a shoestring. On top, they use a lot of legacy architecture and hardware. They have teams that have a hard time making an architectural decision in the best of times, but even less so under stress. It is probably the same on the vendors side.

In my mind, the correct solution is indeed to deny any inbound connection to the network, now, to prevent further damage.

Incident response is, in order:

    1. preparation (failed)
    2. identification (done)
    3. containment <--- we are here (take offline, put manual rota in place to manage fridge defrost cycles) 
    4. eradication (VPN, etc)
    5. recovery (take it back online, relieve manual rota)
    6. postmortem etc

> Retailers are enterprises with 100s of vendors that run on a shoestring. On top, they use a lot of legacy architecture and hardware.

That's a really strong argument for why systems like this need layered security and should not accept incoming connections from the internet at large.

>>Or to take the freezers offline if an update isn't available. > > Why the heck would this be necessary? We have VPNs holy crap

Each to their own… but why do fridges need to be connected to the internet in the first place?

They deserve to get burned and should get a hefty fine as well. I'm fed up with businesses completely ignoring all basic security and then blaming culprits for hacking them.

I don't care whether it's the Russians, Chinese, Norks or script kiddies. This should never have happened, especially since a similar incident happened in France three weeks ago so they got ample time to prepare themselves. They just don't care.

Why do supermarket freezers need to be on the internet in the first place? A freezer has one job right.. keep things cold :/

Completely speculating as I don't know the situation in Europe, but some possible reasons are:

- Remote alerting for the store manager/head office to quickly respond to a refrigerator failure after hours, providing options for saving valuable stock (e.g. move stock to another refrigerator).

- Maintaining an audit trail for cold chain management (e.g. regulator says you must keep an audit trail proving that a frozen fish has been kept below 30oC since it was processed on a ship all the way up to point of sale in a supermarket).

- Refrigerator manufacturer says a condition of warranty is that the refrigerator must provide remote telemetry proving some warranty condition has been met (e.g. regular cleaning cycle operated).

Note: all these speculated reasons are unidirectional data flows. So even if a valid reason exists for Internet connectivity, why can't it be limited to unidirectional data flows?

Also so the temperature can be controlled to make use of cheaper electricity — if you know it's going to be windy from 02:00 to 04:00, then still until 06:00, you can run the freezers a bit extra while the electricity is super cheap.

.. while they leave lighting on around the building and outside for 24 hours a day; they pay for ads who-knows-where.. The efficiency call is galling to me because we have had thirty years to increase efficiency with miracle tech like LED lighting, and yet little has been done.

Fridges and hvac consumes an order of magnitude more energy than lighting

Those might be reasons for them to be connected to a network. They are not reasons to connect them to the internet

If you want to be able to do that monitoring from a central location then at some point you will need some form of internetwork to support transferring data between local networks. And nowadays there is really only the one obvious choice of internetwork.

  > there is really only the one obvious choice of internetwork

Well, I wouldn't quite go that far - there's a bunch of alternatives to openvpn.

Hey did you notice how when the freezer connects to the on-prem VPN tunnel, it never actually touches the internet directly and has zero attack surface, and yet can still send the necessary data anywhere in the world? And that could even be bi-directional, sending commands back to the freezer, if you really really think you need that ability for some reason (but you don't).

> Maintaining an audit trail for cold chain management

It's this, primarily, or most importantly.

I work in the restaurant industry. Health departments require you to assure them that your hot things are kept hot and your cold things are kept cold. The old way was staff walking around the store reading thermometers and writing temperatures down on paper; the newer way was your staff walking around the store inputting temperatures on an iPad connected to your business-management software. The trouble with that is that staff forget to do it (despite threats of discipline, and push notifications to their phones), or even blatantly fake it.

Failing to keep an accurate temperature log means fines, and other consequences, up to and including loss of your health license. I am 100% in favor of this legislation, and solid enforcement of it. The main improvement I would make is to harmonize codes and enforcement across municipalities. I'm in the USA, every county has their own requirements - and their own "portal" for submitting documentation. It's a massive pain in the ass to write Standard Operating Procedures for staff across multiple stores in multiple enforcement districts when there simply aren't any SOPs.

The majority of the fines our (responsible, and genuinely trying-to-do-it-right) company received were things like a staff member moving from a store in County A to a store in County B - just for a few days, to cover someone's PTO, or something - and inadvertently followed County A's logging requirements rather than County B's. Two genuine cases: logging every two hours, instead of every ninety minutes; using whole degrees, instead of tenths. We could appeal, but that takes a lawyer's time, so even if successful it wasn't always worth it.

Real-time data, from connected sensors, is unambiguously better. Staff get loads of time back, to make food, or help guests; all the logging gets done "right", for whatever jurisdiction; data's held by a third-party, so nothing can be faked.

That said, we're not connecting our infrastructure to the internet! We have a separate IoT sensor service that tracks the temps for us. I'm sure their security is also terrible, but that doesn't matter nearly as much. A year of their service is ~80% of the "routine", and totally innocent, fines and other costs that we were previously paying. That's the way all of these stores should go, in my opinion.

On top of the monitoring mentioned by others, it's also to create a centralized log of actual temperatures. This then lets you show inspectors that you are keeping up with refrigeration requirements.

Creating a centralized log is monitoring. It doesn't need write access to the defrost setting.

Yep, but once you have internet connectivity, things escalate and people say "wouldn't it be convenient if we can also...."

You have to wonder about the monitoring - it apparently wasn’t alerting for someone to do something about it in time. What was the point of the monitoring in that case??

It might have dutifully logged that the temperature setting was changed, which will allow regulators to conclude that the safety of the food stored in these refrigerators can no longer be assured.

Compliance tends to warp the underlying goal quite a bit.

For commercial uses some kind of global monitoring is not super crazy. Regular retail freezers being on the internet, that's the crazy talk.

Monitoring doesn't need write access. RS-422 is simple and reliable. It uses separate receive and transmit pairs and you don't need to connect both. The freezer can continually transmit its telemetry over unidirectional RS-422 and a separate system can forward it over the Internet.

Hackers can still tamper with the telemetry and create false reports of problems, but actually changing the thermostat settings would require local access, so there's opportunity for somebody to verify the problem really exists.

But why can they control the temperature then?

If I put a Zigbee thermometer in the freezer they can hack it all they want, but I am pretty sure they will not be able to set the temperature to 50C.

If they want to get their pubic-facing remote monitoring jollies, why not implement ro access?

> pubic-facing remote monitoring jollies

Those freezers seem to be having lots of fun :-)

Read access, sure. But being able to turn them off?

Likely so that stores can be monitored remotely. A lot of supermarkets have a centralized orchestration somewhere, especially big chains.

What I read from the last wave is that supermarket changes how cold freezers will run depending on how much customers they expect that will open and close the doors. Just having the freezers adapt based on the temperature of every single moment cost too much electricity or can result in unsafe temperatures.

I don’t know about supermarkets but for medical freezers it’s useful to be online for monitoring and calibration.

My org has lots of freezers that need to be at precise temperatures. Sometimes they drift so you have to check them a few times per day, log the check, and adjust as necessary. Doing this for a thousand freezers is tedious and error prone. Networking helps. “Cloud” lets it all be done remotely without getting IT very involved for vpns to be set up with specific vendors. It also helps with patching and auditing security so seems odd that these supermarket ones were out of date.

It seems like monitoring did not work out so great for them this time :)

(Assuming they didn't also patch the telemetry software, but that is a much harder attack than just raising the temperature).

Some large supermarkets (in the UK at least) sell their capacity to the National Grid so it can be balanced in times of demand. They agree to turn off their freezers for a set amount of time to create a "virtual battery".

Not just that. But why the fuck is the control software so weak? Why does it allow remotely bumping temperatures to near boiling without any checks? Which idiot designed this system? Why aren't they out of business? Same with the people who installed these systems. Why on earth didn't they think to secure it?

Go offer your services to these companies and see their answer.

The big IT firms syphon off all the talent with compensation these fridge and supermarket companies can't match. You won't find much talent there. Who is brilliant with computers and would want to work there?

But look also at how underfunded the basic blocks of IT are, how open-source is left to fend for itself. It is the whole culture of modern IT to hack things together and not make them well-defined and reliable.

> The big IT firms syphon off all the talent with compensation these fridge and supermarket companies can't match.

That may have been true 3+ years ago, but now there is a glut of tech people begging for jobs.

Very likely they shipped with an ADMIN/ADMIN username/password and nobody changed it. Because who would want to break in to a freezer, right? It's not like there's bitcoin in there.

We've been telling people for years that naive threat modeling was going to bite everybody one day. And finally, here we are.

Approximately. These models had been deprecated by 5 or 10 years, and a successor model last year had a software update issued because they had a secret "password of the day" that allowed you to use the date as the admin password.

Supermarket freezers are a bit more complicated than that. They can run at different temperatures and can consume a lot of power, so are part of a bigger store HVAC and electrical system as they may load-balance. Stores do not have qualified engineers on site to do anything with refrigeration equipment and it is better to have minimum wage offsite monitoring than expect a minimum wage shelf packer who only gets one toilet break a day to care about the fridges.

Has anyone determined if these were separate from the attacks on US military PX refrigeration that happened well before that?

Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

I worked in IT for a major retail chain in the US. I was on the team in charge of store systems. We knew what devices were connected to the network, and if we had a vulberable device like this, we would have sent an urgent message to store managers to disconnect themm immediatly, and we would have followed up with scans over several days to ensure it happened. There is no excuse. (If we really needed the devices connected, we would have put them on a firewalled VLAN, which we could have pushed out in hours and had across the nation within days at most.). Granted, ideally we would have already had them VLANed.

It is incompetence to not have this capabilty.

Sounds like they might have to pay experts to do it.

The question is whether this is attack has cost them more than that would have.

I do work in the retail refrigeration world nowadays and "just updating the software" is much easier said than done. I'm usually touching grocery stores with 20+ year old hardware from the dawn of centralized control and monitoring. It's not s trivial thing to rip out the controllers and install new ones.

Yeah was about to say, if your a major chain this is on you

In the case of France, the vulnerability was announced in August, 2025.

I believe gigantic fines are appropriate. They need to be of a size where the entire management team has significant financial issues for many years to come, even after having sold their houses, big cars, etc.

Nothing will improve until there are personal consequences.

I hear you're passionate about this, but why a fine? They were the victims, in our society the victim of a crime doesn't need to be penalized further, moreover, the only damage was to themselves.

>This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time.

Came into the thread thinking it would be a new report about the same incident not a new one, yikes.

To be fair, wouldn't the chains probably be reliant on their vendors for an update? and turning off all the fridges for weeks is probably not a sustainable solution... :/

This very likely first happened in the USA at military commissaries in August. https://www.stripes.com/theaters/us/2026-09-01/army-cid-inve...

Back in 1995 this was so improbable it was one of the purported negative effects of the "Good Times" virus which was a parody of the virus warning e-mails that were being forwarded around at the time. Computers still can't give you Dutch elm disease, fortunately.

> It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty.

https://people.cs.rutgers.edu/~watrous/goodtimes-spoof.html

Somebody made that into a song. Never knew where the lyrics came from.

https://open.spotify.com/track/1mvK5h91yWsm97sAugKy6K?si=wXw...

Thanks! Also available without login on YT https://www.youtube.com/watch?v=uqZZ72UbOgA

There was an interview with an angry store manager, he's mad at the attackers, but I didn't hear the media ask him why they didn't improve security after the French attacks. Only now do they appear to want to start a review of their monitoring system.

https://www.svt.se/nyheter/lokalt/skane/icas-kylar-och-frysa...

The store managers don't manage the IT security of the chain though.

No, and I get that, but working in the industry, he can't have been in the dark about the events in France. If he doesn't deal with the monitoring of the fridges himself, he should be equally upset that the chain has failed to act.

Isn't it more than logical for a store manager to be upset?

At the human being level, this attack is mind boggling. What do you get out of this, other than making good food go to waste?

Edit: Also keep in mind that there's franchising in supermarkets as well. So the guy might literally be looking at losing a chunk of money as a result of something out of his control. Doesn't change the situation, but not having done something doesn't make them deserve this...

He was sitting in a car behind the wheel driving with 120 down the cliff and just closed his eyes instead of stopping the car, 'but not having done something doesn't make them deserve this'.

Similar thing in Estonia: https://news.err.ee/1610183296/hackers-raised-freezer-temper...

I've fantasized a long time about a clearer separation of technology from life, since it's been depicted in some ways I appreciated in fiction. But at this point, I'd just take a set of laws around what types of items should ever have any sort of networking.

I believe it's industrial protocols used to connect such devises to a SCADA system. It this case it's the SCADA system that has to be disconnected from any general purpose networks.

The freezer itself doesn't need to connect to a SCADA. You can network power and temperature monitors, but those monitors don't need the ability to shut off the freezer.

These freezers are manually stocked and cleaned. If they need to be powered down it's a simple matter of a hardware switch that you flip when the unit is empty.

Ireland too: https://news.ycombinator.com/item?id=50335252

Maybe we should stop connecting things to the Internet that don't need to be?

I don't understand why these things aren't on their own (V)LAN. Why they are open to internet?!

Brainstorming here; monitoring, logging, etc. The fact the store managers were called out of bed when there was an issue indicates it works. If a cooler broke down overnight or its temperature was too high for X amount of time, they have to discard the products. Without monitoring they likely wouldn't know until customers got sick.

I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.

given they turned off the refrigerators (instead of something evil like turning them down for just long enough to allow bacterial growth and then turning them back up) customers would probably have noticed their ice cream being liquid, the frozen meat not being frozen, etc

>I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.

People won't steelman because the answer to "why are the fridges slapdashedly networked?" is too often "because people of my ideological bent and demographics if not literally me previously demanded paper trails, audit-ability and regulatory compliance that was impossible for a low margin industry to pull off any other way."

That seems like a pretty wild nonsequitur at first glance. How exactly do we get to “too much regulation” from “a subset of stores’ centrally managed equipment was left off the VPN”?

My point, which will inevitably be straw manned to hell and back, is that a large part of the reason these systems all came about is to cheaply satisfy externally imposed requirements (save energy, facilitate audits, remove responsibility from store employees, etc, etc) that the peanut gallery (and more concerningly, real people doing real work deciding things) cheers for when examined in isolation.

Requirements in the food industry come not just from government rules and suggested best practices (that are more than suggestions in practice) but also indirectly as a result of requirements imposed by insurers, financiers and trade groups. In response to this companies that run supermarket chains or manufacture major brands of food have not quite the same verbosity but certainly comparable degrees of retention in their record keeping as medical and aviation.

This monitoring and control is increasingly centralized in response to all these requirements because it's most efficient that way. If you're gonna have one guy in an office deciding things you might as well automate away the middle man and have him set them too and let the people on the ground spend more time doing their core work.

If fifteen of the twenty thousand dozen systems (pulling that number out of my ass FYI) in an industry are being centrally controlled through computer systems it's inevitable that some of them wind up off the VPN and this happens. It's just a natural tradeoff or risk you run when doing that and it's completely foreseeable.

But the internet peanut gallery will not generally have any sort of adult discussion about these tradeoffs because "we saved X (maybe X is money, maybe energy, who knows, who cares) by operating the fridges more centrally" is a nice easy win for them and rather than have a discussion about subjective and hard to pin down long tail risks it's easier to just screech about "we should fine the people who did it wrong" or whatever when one of those long tail risks rears its ugly heads.

I still don’t follow. You’ve said a lot of things about regulation and insurance requirements and all that, but I don’t see how any of it is necessary to get to “centralized management.” Let alone goofing up the centralized management.

I’m just a software person, not a supermarket expert, so maybe I’m being a bit simpleminded here, but for the entirety of my career I’ve participated in a constant trend toward centralizing and automating operations. That’s been the case regardless of how highly regulated the industry was. The motivating force has always been making things easier, cheaper and less error prone.

I suppose we could throw a rant about regulation into the mix, but, in the words of Laplace, I have no need of that hypothesis.

All of this can be done without connecting edge devices directly to the internet (and potentially allowing inbound connections). The question is not why they have networking, but why the connectivity is such that an attack like this is even possible.

Monitoring and logging can be done without access to controls.

Will the insurance pay out on this? It would be negligent to have this exposed to the internet - was it?

Especially given the recent precedence of hacked freezers.

That's an interesting angle, that would explain why some bothered to hack fridges and waste food.

Why can a fridge go to 50ºC ?!

You want them back to use very fast after they have certain amount of icing. So you want powerful heating elements there and those are cheap anyway. Fridge or freezer not in use doesn't make money in a store.

In other words, it went into a defrost cycle.

It happened in France on 12 October: https://www.bbc.com/news/articles/crq5nzxv9q4yo

i know some of us are thinking "if you consistently fail to ensure your ability to make high-severity security patches reach critical internet-exposed systems on time you lose your ability to operate the business and probably get jail time"

but what about the deranged (and very prediction market–brained) version of this idea: the government develops ransomware, in a manner functionally similar to towing cars or confiscating illegal items, and uses it against companies in proportion to their revenue and obviously puts the money towards improving the ransomware

"the r in rsi stands for…"

i'm not sure it's something i want to see, but i don't know if it's impossible for it to actually come to pass or merely unlikely

(of course, cross-government versions of this are much more likely to come about but not as ransomware)

This is exactly the kind of thing we've all been warning about ...

(... in hacker forums)

It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?

It would take people listening to professionals and getting rid of several decades worth of bad habits amongst users. Same as most other places really.

What makes you think Europe is uniquely vulnerable?

In fairness they probably don't tend to use internet connected freezers in Africa.

I live in Africa, still amazed by the idea of connected freezers haha. Didn't know it exists out there.

> It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?

I'm quite sure your average American company is just as willing to plug random shit into the internet.

Hell, there are probably hundreds of reports out there of American companies failing to secure their AWS S3 buckets, so you don't even have to plug anything into the internet.

Your average American company is running on China.

The problem is the ironic "home grown" or "internal" security. These external attacks come after decades of fertilizing far right white politicians whose sole purpose is to dither any directed anger.

Brexit was the first to burst and despite their support of Ukraine, can at any moment capitulate to the ghost of nationalism and delusional escapism that is "white power". Americas on the verge of sinking further into the same. With those two entirely preoccupied, of course europe is next and already has the same underlying current.

aside from multiple of edgy keywords with vague insinuations I have no idea what you're trying to argue here

Isn't Europe just following US Army's example then? A similar incident in US Army commissaries has been reported since August [1]. It only took them two full months to launch an investigation [2].

[1] https://signalandsilence.substack.com/p/i-think-someone-hack...

[2] https://www.foxnews.com/us/mysterious-freezer-failures-us-mi...

This wave of attacks against refrigerators started in USA with many refrigerators serving the personnel at several military bases, a couple of months ago.

Therefore even the US Army has not been better prepared than supermarket chains.

... Who the fuck is putting this shit on a network that's not closed circuit?

Vendors install these so the store owner and them have easy access to alarms and controls.

A VPN per store would be too complex for the vendor so they just expose these to the open.

Same story as with all the hacked OT/SCADA systems in the past.

Two things worth keeping in mind:

1. Connecting them was probably considered best practice when they were installed in 2005 2. Their support contract required them to stay connected

Comments moved to https://news.ycombinator.com/item?id=50335615 which is currently on the frontpage.