Yet another Hacker News

Supermarket freezers in Belgium and Sweden hit by suspected cyber-attack

80 points xqcgrek2 2 hours ago 80 comments

noja 2 hours ago | parent

Will the insurance pay out on this? It would be negligent to have this exposed to the internet - was it?

kleiba2 2 hours ago | parent

Especially given the recent precedence of hacked freezers.

mariopt 1 hour ago | parent

That's an interesting angle, that would explain why some bothered to hack fridges and waste food.

pluc 2 hours ago | parent

Ireland too: https://news.ycombinator.com/item?id=50335252

ocd 2 hours ago | parent

I've fantasized a long time about a clearer separation of technology from life, since it's been depicted in some ways I appreciated in fiction. But at this point, I'd just take a set of laws around what types of items should ever have any sort of networking.

forlorn 2 hours ago | parent

I believe it's industrial protocols used to connect such devises to a SCADA system. It this case it's the SCADA system that has to be disconnected from any general purpose networks.

Proziam 2 hours ago | parent

The freezer itself doesn't need to connect to a SCADA. You can network power and temperature monitors, but those monitors don't need the ability to shut off the freezer.

These freezers are manually stocked and cleaned. If they need to be powered down it's a simple matter of a hardware switch that you flip when the unit is empty.

wronglebowski 2 hours ago | parent

It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?

ElProlactin 2 hours ago | parent

What makes you think Europe is uniquely vulnerable?

DC-3 2 hours ago | parent

In fairness they probably don't tend to use internet connected freezers in Africa.

afroboy 2 hours ago | parent

I live in Africa, still amazed by the idea of connected freezers haha. Didn't know it exists out there.

cyanydeez 2 hours ago | parent

The problem is the ironic "home grown" or "internal" security. These external attacks come after decades of fertilizing far right white politicians whose sole purpose is to dither any directed anger.

Brexit was the first to burst and despite their support of Ukraine, can at any moment capitulate to the ghost of nationalism and delusional escapism that is "white power". Americas on the verge of sinking further into the same. With those two entirely preoccupied, of course europe is next and already has the same underlying current.

traceroute66 2 hours ago | parent

> It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?

I'm quite sure your average American company is just as willing to plug random shit into the internet.

Hell, there are probably hundreds of reports out there of American companies failing to secure their AWS S3 buckets, so you don't even have to plug anything into the internet.

ElProlactin 2 hours ago | parent

Your average American company is running on China.

2000UltraDeluxe 2 hours ago | parent

It would take people listening to professionals and getting rid of several decades worth of bad habits amongst users. Same as most other places really.

kzrdude 2 hours ago | parent

It happened in France on 12 October: https://www.bbc.com/news/articles/crq5nzxv9q4yo

ilkkao 2 hours ago | parent

This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time. Or to take the freezers offline if an update isn't available.

I now read some interviews with local chains in Sweden and Finland, and they were still just investigating what to do at this point.

pumba_noob 2 hours ago | parent

Why do supermarket freezers need to be on the internet in the first place? A freezer has one job right.. keep things cold :/

sevenzero 2 hours ago | parent

Likely so that stores can be monitored remotely. A lot of supermarkets have a centralized orchestration somewhere, especially big chains.

oblio 2 hours ago | parent

For commercial uses some kind of global monitoring is not super crazy. Regular retail freezers being on the internet, that's the crazy talk.

xattt 2 hours ago | parent

If they want to get their pubic-facing remote monitoring jollies, why not implement ro access?

oblio 1 hour ago | parent

> pubic-facing remote monitoring jollies

Those freezers seem to be having lots of fun :-)

fifilura 2 hours ago | parent

But why can they control the temperature then?

If I put a Zigbee thermometer in the freezer they can hack it all they want, but I am pretty sure they will not be able to set the temperature to 50C.

hahn-kev 1 hour ago | parent

Read access, sure. But being able to turn them off?

mrob 1 hour ago | parent

Monitoring doesn't need write access. RS-422 is simple and reliable. It uses separate receive and transmit pairs and you don't need to connect both. The freezer can continually transmit its telemetry over unidirectional RS-422 and a separate system can forward it over the Internet.

Hackers can still tamper with the telemetry and create false reports of problems, but actually changing the thermostat settings would require local access, so there's opportunity for somebody to verify the problem really exists.

dhx 1 hour ago | parent

Completely speculating as I don't know the situation in Europe, but some possible reasons are:

- Remote alerting for the store manager/head office to quickly respond to a refrigerator failure after hours, providing options for saving valuable stock (e.g. move stock to another refrigerator).

- Maintaining an audit trail for cold chain management (e.g. regulator says you must keep an audit trail proving that a frozen fish has been kept below -30oC since it was processed on a ship all the way up to point of sale in a supermarket).

- Refrigerator manufacturer says a condition of warranty is that the refrigerator must provide remote telemetry proving some warranty condition has been met (e.g. regular cleaning cycle operated).

Note: all these speculated reasons are unidirectional data flows. So even if a valid reason exists for Internet connectivity, why can't it be limited to unidirectional data flows?

Symbiote 1 hour ago | parent

Also so the temperature can be controlled to make use of cheaper electricity — if you know it's going to be windy from 02:00 to 04:00, then still until 06:00, you can run the freezers a bit extra while the electricity is super cheap.

antisol 1 hour ago | parent

Those might be reasons for them to be connected to a network. They are not reasons to connect them to the internet

bunderbunder 37 minutes ago | parent

If you want to be able to do that monitoring from a central location then at some point you will need some form of internetwork to support transferring data between local networks. And nowadays there is really only the one obvious choice of internetwork.

rocqua 1 hour ago | parent

On top of the monitoring mentioned by others, it's also to create a centralized log of actual temperatures. This then lets you show inspectors that you are keeping up with refrigeration requirements.

mrob 1 hour ago | parent

Creating a centralized log is monitoring. It doesn't need write access to the defrost setting.

rocqua 52 minutes ago | parent

Yep, but once you have internet connectivity, things escalate and people say "wouldn't it be convenient if we can also...."

DougN7 52 minutes ago | parent

You have to wonder about the monitoring - it apparently wasn’t alerting for someone to do something about it in time. What was the point of the monitoring in that case??

rocqua 18 minutes ago | parent

It might have dutifully logged that the temperature setting was changed, which will allow regulators to conclude that the safety of the food stored in these refrigerators can no longer be assured.

Compliance tends to warp the underlying goal quite a bit.

belorn 1 hour ago | parent

What I read from the last wave is that supermarket changes how cold freezers will run depending on how much customers they expect that will open and close the doors. Just having the freezers adapt based on the temperature of every single moment cost too much electricity or can result in unsafe temperatures.

prepend 1 hour ago | parent

I don’t know about supermarkets but for medical freezers it’s useful to be online for monitoring and calibration.

My org has lots of freezers that need to be at precise temperatures. Sometimes they drift so you have to check them a few times per day, log the check, and adjust as necessary. Doing this for a thousand freezers is tedious and error prone. Networking helps. “Cloud” lets it all be done remotely without getting IT very involved for vpns to be set up with specific vendors. It also helps with patching and auditing security so seems odd that these supermarket ones were out of date.

fifilura 51 minutes ago | parent

It seems like monitoring did not work out so great for them this time :)

(Assuming they didn't also patch the telemetry software, but that is a much harder attack than just raising the temperature).

beejiu 44 minutes ago | parent

Some large supermarkets (in the UK at least) sell their capacity to the National Grid so it can be balanced in times of demand. They agree to turn off their freezers for a set amount of time to create a "virtual battery".

elric 4 minutes ago | parent

Not just that. But why the fuck is the control software so weak? Why does it allow remotely bumping temperatures to near boiling without any checks? Which idiot designed this system? Why aren't they out of business? Same with the people who installed these systems. Why on earth didn't they think to secure it?

Aboutplants 2 hours ago | parent

Yeah was about to say, if your a major chain this is on you

tclancy 2 hours ago | parent

Has anyone determined if these were separate from the attacks on US military PX refrigeration that happened well before that?

holsta 2 hours ago | parent

In the case of France, the vulnerability was announced in August, 2025.

I believe gigantic fines are appropriate. They need to be of a size where the entire management team has significant financial issues for many years to come, even after having sold their houses, big cars, etc.

Nothing will improve until there are personal consequences.

xoa 1 hour ago | parent

>Or to take the freezers offline if an update isn't available.

Why the heck would this be necessary? We have VPNs holy crap, the entire genesis of the technology was to solve this fucking problem. If it's not literally intended for the general random public to be able to randomly visit and use themselves, it shouldn't be exposed on the public internet it should be (heavily restricted) LAN-only with remote access done via VPN. While it's even better if every single last thing is well secured at the client-level too, it goes a long way with ancient (or new, but with ancient-equivalent software design expenditure/decisions) kit to protect it at the network level.

Creating a false binary of "take it offline!" when businesses have very good reasons for networking many classes of industrial hardware seems self-defeating vs "just get the cheap bare minimum basic network protection done". I mean shit, even if somehow they've gotten suckered into freezers which demand access to a non-self-hostable manufacturer server (hey EU! here's something useful to regulate! if nothing else order manufacturers to have WireGuard end points for connection) they could at least have the firewall allow !RFC1918 solely and exclusively to that address on those ports.

lrasinen 1 hour ago | parent

Yes, VPNs would be the correct solution.

However, we're talking about companies that put unprotected systems on the public network and did nothing about it even after getting three weeks advance warning.

fifilura 1 hour ago | parent

Seems like the biggest chain in Sweden, ICA, had a VPN. They were affected but only the franchise takers that were (for whatever reason) outside their internal network.

lrasinen 54 minutes ago | parent

Same in Finland, Kesko said they've heard reports from systems NOT connected to their centralized monitoring systems.

You can lead a horse to water, but ...

xoa 38 minutes ago | parent

>However, we're talking about companies that put unprotected systems on the public network and did nothing about it even after getting three weeks advance warning.

I don't know the companies in question here, I'm not European and my EU family lives in France not Belgium or Sweden, but fwiw here in the states a lot of supermarkets are independent grocers or in a sort of formal or quasi-franchise arrangement where it's part of a "chain" but each store is still somewhat or quite decentralized in management when it comes to the physical stuff at the local store. Which is probably a strength in a lot of cases, makes it easier to adapt to local environment faster, but I suspect there's just plain a knowledge/skill/priority mismatch when it comes to IT. That'd also line up with some of the reports on this I read where there was some official central management system, except certain grocery stores just weren't using it?

The components of solutions for this exist and could even be really cheap, we're not talking much bandwidth here. Not hard to imagine even in a independent grocer association or loose franchise system they could tape together an SBC with preconfigured OPNsense or VyOS or whatever on it and a switch and be able to just tell stores "here, plug your freezers into this, access the portal here" as a default and it'd just route all their traffic to the franchise/IGA's management system. Someone still has to secure that of course, but at least it wouldn't be on the open internet.

Places that wanted to could of course do this other ways, I'm just saying that even with the very tight margins grocery stores tend to run on I think it's very doable to do better going forward, just will take some coordination and knowledge building. "The future is already here, it's just not evenly distributed" and all that.

james_marks 31 minutes ago | parent

The skill, and time, required to "take it offline" is far lower than any solution mentioning VPN. And given that, more likely to succeed while a better solution is found.

prennert 19 minutes ago | parent

I dont think VPNs are the correct solution. They are one solution, sure, but if it is the correct solution depends on many things.

For example, where does the VPN connect to? The vendor? Do you trust the vendor more than the internet. Sure. Do you trust the vendor, that does not manage the firmware of their devices and uses inbound connections in the first place, enough to put them on a VPN?

How many devices and vendors do you have? How many VPNs can you establish with the existing networking hardware, and how many can you manage without IP clashes etc. IP clashes work both ways, btw. The vendor has to manage this themselves also if all their clients want VPNs.

Retailers are enterprises with 100s of vendors that run on a shoestring. On top, they use a lot of legacy architecture and hardware. They have teams that have a hard time making an architectural decision in the best of times, but even less so under stress. It is probably the same on the vendors side.

In my mind, the correct solution is indeed to deny any inbound connection to the network, now, to prevent further damage.

Incident response is, in order:

    1. preparation (failed)
    2. identification (done)
    3. containment <--- we are here (take offline, put manual rota in place to manage fridge defrost cycles) 
    4. eradication (VPN, etc)
    5. recovery (take it back online, relieve manual rota)
    6. postmortem etc

vlachen 1 hour ago | parent

I do work in the retail refrigeration world nowadays and "just updating the software" is much easier said than done. I'm usually touching grocery stores with 20+ year old hardware from the dawn of centralized control and monitoring. It's not s trivial thing to rip out the controllers and install new ones.

Caloric3002Swed 1 hour ago | parent

Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

nkrisc 1 hour ago | parent

Sounds like they might have to pay experts to do it.

The question is whether this is attack has cost them more than that would have.

limagnolia 1 hour ago | parent

I worked in IT for a major retail chain in the US. I was on the team in charge of store systems. We knew what devices were connected to the network, and if we had a vulberable device like this, we would have sent an urgent message to store managers to disconnect themm immediatly, and we would have followed up with scans over several days to ensure it happened. There is no excuse. (If we really needed the devices connected, we would have put them on a firewalled VLAN, which we could have pushed out in hours and had across the nation within days at most.). Granted, ideally we would have already had them VLANed.

It is incompetence to not have this capabilty.

hn_submit 1 hour ago | parent

They deserve to get burned and should get a hefty fine as well. I'm fed up with businesses completely ignoring all basic security and then blaming culprits for hacking them.

I don't care whether it's the Russians, Chinese, Norks or script kiddies. This should never have happened, especially since a similar incident happened in France three weeks ago so they got ample time to prepare themselves. They just don't care.

firefax 6 minutes ago | parent

>This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time.

Came into the thread thinking it would be a new report about the same incident not a new one, yikes.

To be fair, wouldn't the chains probably be reliant on their vendors for an update? and turning off all the fridges for weeks is probably not a sustainable solution... :/

HexnMarcusWolfe 2 hours ago | parent

... Who the fuck is putting this shit on a network that's not closed circuit?

jonasl 1 hour ago | parent

Two things worth keeping in mind:

1. Connecting them was probably considered best practice when they were installed in 2005 2. Their support contract required them to stay connected

Caloric3002Swed 1 hour ago | parent

Vendors install these so the store owner and them have easy access to alarms and controls.

A VPN per store would be too complex for the vendor so they just expose these to the open.

Same story as with all the hacked OT/SCADA systems in the past.

mrweasel 2 hours ago | parent

There was an interview with an angry store manager, he's mad at the attackers, but I didn't hear the media ask him why they didn't improve security after the French attacks. Only now do they appear to want to start a review of their monitoring system.

https://www.svt.se/nyheter/lokalt/skane/icas-kylar-och-frysa...

Cthulhu_ 1 hour ago | parent

The store managers don't manage the IT security of the chain though.

mrweasel 1 hour ago | parent

No, and I get that, but working in the industry, he can't have been in the dark about the events in France. If he doesn't deal with the monitoring of the fridges himself, he should be equally upset that the chain has failed to act.

hvb2 8 minutes ago | parent

Isn't it more than logical for a store manager to be upset?

At the human being level, this attack is mind boggling. What do you get out of this, other than making good food go to waste?

andy_ppp 2 hours ago | parent

Maybe we should stop connecting things to the Internet that don't need to be?

baal80spam 2 hours ago | parent

I don't understand why these things aren't on their own (V)LAN. Why they are open to internet?!

Cthulhu_ 1 hour ago | parent

Brainstorming here; monitoring, logging, etc. The fact the store managers were called out of bed when there was an issue indicates it works. If a cooler broke down overnight or its temperature was too high for X amount of time, they have to discard the products. Without monitoring they likely wouldn't know until customers got sick.

I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.

tensegrist 1 hour ago | parent

given they turned off the refrigerators (instead of something evil like turning them down for just long enough to allow bacterial growth and then turning them back up) customers would probably have noticed their ice cream being liquid, the frozen meat not being frozen, etc

cucumber3732842 1 hour ago | parent

>I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.

People won't steelman because the answer to "why are the fridges slapdashedly networked?" is too often "because people of my ideological bent and demographics if not literally me previously demanded paper trails, audit-ability and regulatory compliance that was impossible for a low margin industry to pull off any other way."

bunderbunder 27 minutes ago | parent

That seems like a pretty wild nonsequitur at first glance. How exactly do we get to “too much regulation” from “a subset of stores’ centrally managed equipment was left off the VPN”?

hackingonempty 1 hour ago | parent

Back in 1995 this was so improbable it was one of the purported negative effects of the "Good Times" virus which was a parody of the virus warning e-mails that were being forwarded around at the time. Computers still can't give you Dutch elm disease, fortunately.

> It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty.

https://people.cs.rutgers.edu/~watrous/goodtimes-spoof.html

marttt 1 hour ago | parent

amelius 1 hour ago | parent

This is exactly the kind of thing we've all been warning about ...

(... in hacker forums)

tensegrist 1 hour ago | parent

i know some of us are thinking "if you consistently fail to ensure your ability to make high-severity security patches reach critical internet-exposed systems on time you lose your ability to operate the business and probably get jail time"

but what about the deranged (and very prediction market–brained) version of this idea: the government develops ransomware, in a manner functionally similar to towing cars or confiscating illegal items, and uses it against companies in proportion to their revenue and obviously puts the money towards improving the ransomware

"the r in rsi stands for…"

i'm not sure it's something i want to see, but i don't know if it's impossible for it to actually come to pass or merely unlikely

(of course, cross-government versions of this are much more likely to come about but not as ransomware)

spenjovewkwhalo 1 hour ago | parent

Why can a fridge go to 50ºC ?!

Ekaros 1 hour ago | parent

You want them back to use very fast after they have certain amount of icing. So you want powerful heating elements there and those are cheap anyway. Fridge or freezer not in use doesn't make money in a store.

beejiu 37 minutes ago | parent

In other words, it went into a defrost cycle.

elorant 1 hour ago | parent

Why the fuck does a freezer need access to the Internet in the first place?

ahoka 21 minutes ago | parent

Monitoring, I guess?

Kuyawa 49 minutes ago | parent

If you definitely need to connect them to the internet, make them read only?

I was talking yesterday to my AI imaginary friend about creating an MCP for one of my apps, and the first thing she told me was to make everything read only. No matter how many security layers you have in place, passwords, auth libs, whatever, it will be leaked/hacked so you better be prepared for minimum damage

Monitor your freezers temperature? yes, but never allow their thermostat to be set over the internet. I hope the lesson is learned. Applies to all appliances

jttnr 43 minutes ago | parent

Discussion from 3 weeks ago on the refrigerator "hacks" in the french supermarkets:

https://news.ycombinator.com/item?id=50055304 (~1000 comments)

hackersnooze1 26 minutes ago | parent

Thats interesting something similar happened at military grocery stores in the US a couple months ago