Yet another Hacker News

Supermarket freezers across Europe hit by second suspected cyber-attack

101 points fergie 2 hours ago 95 comments

fergie 2 hours ago | parent

Hackers remotely override settings on thousands of freezers, fridges and chiller cabinets, pushing them from as low as -27C to well over 50C. Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains among those affected.

sylware 2 hours ago | parent

monoprix is french, and it seems it was limited to sweeden and belgium.

Hoax?

lrasinen 2 hours ago | parent

That sounds like the October event which was focused in France. The current one is all over Europe, from Ireland to Finland.

bestouff 1 hour ago | parent

All of GP's names are French

maeln 1 hour ago | parent

They are all french brands. I think he is referring to the previous hack that happen last month. Looks like a AI-generated comment tbf.

Jmstdy95 2 hours ago | parent

that's insane, they just got hit recently right?

testfrequency 2 hours ago | parent

“Hit by second”

pluc 2 hours ago | parent

https://news.ycombinator.com/item?id=50335602

https://news.ycombinator.com/item?id=50335252

vintagedave 1 hour ago | parent

Also https://news.ycombinator.com/item?id=50335324 - my submission, I linked here since this is the better thread.

thatsabadlook 1 hour ago | parent

Can't tell if it will be some asshole hacker group, Russia, the us, or what. But for the love of God please stop connecting everything to the Internet and also ai...

mirekrusin 1 hour ago | parent

...or ai lab bench maxxing.

frankharv 1 hour ago | parent

I have no problem with monitoring temps over internet.

Who ever thought it was OK to control freezers over the internet should be hung.

thatsabadlook 1 hour ago | parent

Analytics are very different from controls. People who model them the same tend to suffer. A lot of academics and project managers don't understand this unfortunately.

graemep 1 hour ago | parent

That implies you also ensure that they monitoring system is isolated from the control system. No one can be bothered to do that, and no one wants to spend the money on an extra microcontroller (a tiny fraction of the cost of each unit, but it comes straight out of your margin because no one pays extra for security).

coldpie 1 hour ago | parent

> Who ever thought it was OK to control freezers over the internet should be hung.

I've got really bad news for you about how many critical systems are connected to the Internet.

weatherlite 1 hour ago | parent

Isn't it a reasonable assumption that an LLM was involved in helping prepare this attack? §

thatsabadlook 1 hour ago | parent

No I was just saying generally, the number of security risks do to AI is ridiculous

monkeydust 1 hour ago | parent

Many would be thinking that, including me. Nefarious agents powered by LLMs operating 24x7 with a singular goal of finding attack vectors.

thatsabadlook 1 hour ago | parent

Highly doubtful. More than likely someone is picking targets here. Going for food supply is a war crime. So it could be an extremely hostile nation state. Or some really psychopathic disgruntled person/group. If there's no ransom it strongly leans toward a nation state in my opinion. A lot of turmoil between Europe and Russia+the us lately. That's my guess.

esseph 40 minutes ago | parent

>A lot of turmoil between Europe and Russia+the us lately. That's my guess.

Attacking power plants, grocery stores, sending drones into multiple countries over and over, setting up gun/dead-drops in German forests, sabotaging warehouses and factories, etc wasn't enough?

The hybrid war goes DEEP and has been happening for a long time. https://en.wikipedia.org/wiki/Russian_sabotage_operations_in...

puszczyk 1 hour ago | parent

I wonder if the companies affected this time missed the news about the French attack a few weeks back?

INTPenis 1 hour ago | parent

No joke, yes they did. The markets hit here in Sweden are all in rural communities with very low number of tech workers. They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.

Caloric3002Swed 1 hour ago | parent

>The markets hit here in Sweden are all in rural communities with very low number of tech workers.

Hej! You are wrong, here in the middle of Stockholm got hit.

https://www.mitti.se/nyheter/icabutikens-frysar-hackades--fi...

ICA Baronen on Odengatan is one of several stores in Sweden that have suffered a major hacker attack. On Monday, their freezers were cancelled at 50 degrees.

This is in Stockholm - https://maps.app.goo.gl/BwbDST4dPVkjcdgA8

So no lack of IT workers/tech workers... Nor is it very rural.

>They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.

The first thing to do when you get access to these as a hacker? You disable the alarms...!

Now, the supplier should have set them up correctly over VPN, good passwords, Zero Trust etc but these an OT/SCADA are usually just open to the internet due to the simplicity of use.

raverbashing 1 hour ago | parent

Hence why you need an alarm for alarm disablement

(I mean, you need also a bunch of other things but yes)

teekert 1 hour ago | parent

But then the supplier is responsible, why would you ever put a fridge online if you are are tech noob. Someone told these people to put these fridges online, they didn't put an Ethernet cable in the back by themselves for the fun of it.

esseph 45 minutes ago | parent

> why would you ever put a fridge online if you are are tech noob

I have some unfortunate news for you.

There's a lot of scary shit online.

sorenjan 1 hour ago | parent

Some of them (Coop) got new equipment after what happened in France and where gonna upgrade them in two days.

Caloric3002Swed 1 hour ago | parent

Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT of course but they usually do POS and desktops/servers.

The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

Autious 1 hour ago | parent

ICA is franchised, so stores are owned and run by operators. The central company offers some services, but a lot of the decisions comes down to the individual stores.

tgv 1 hour ago | parent

The bizarre thing is it is the second time for Delhaize, although the incident of two weeks ago was related to the pricing system.

Hamuko 1 hour ago | parent

After the PHP vulnerability, we got some clients asking if our SaaS product used PHP (it didn't). It's possible that they just contacted their vendor, who assured them that everything was fine.

SecretDreams 1 hour ago | parent

Two things:

1) I hope they learn some hard lessons about security and what should be exposed to the internet vs LAN.

2) These are some evil ass people doing this shit.

Caloric3002Swed 1 hour ago | parent

1) "They" have no idea what exposed to open internet vs LAN vs VPN even mean. They have no idea what these terms mean, they just want the easy access. Same reason why open RDP to 3389 used to be so common. Vendors install these so the store owner and them have easy access to alarms and controls. So they vendor installs it for easy access, shows the store owner, store owner trusts vendor, but vendor has done the bare minimum. Because the vendor wants it easy too.

A VPN per store would be too complex for the vendor so they just expose these to the open.

Same story as with all the hacked OT/SCADA systems in the past. Like those hacks where some SCADA system is open as a website with pump controls.

Imagine they where internet exposed due to simplicity. Imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

2) Yes, obvious it is Russia doing this. Very handy to be able to disrupt food supply and they are also checking our response and time to restore.

_kblcuk_ 1 hour ago | parent

> obvious it is Russia

I love how we're back to good ol' times that there is only one "evil empire", and it's completely impossible that anyone else from dozen of others possible bad actors is involved

/sarcasm

MadameMinty 1 hour ago | parent

1. Both empires are evil. 2. Russia still did that one.

vlyan 44 minutes ago | parent

>Yes, obvious it is Russia doing this

how is that possible? we're all dead from the plague.

liveoneggs 1 hour ago | parent

Why isn't the brand of cooler or cooler-controller being named?

Was it a password break or an open admin console or SNMP or what?

flexie 1 hour ago | parent

In the attack on French supermarkets a few weeks ago, hackers pirated controllers mostly supplied by the Danish company Danfoss.

usrnm 1 hour ago | parent

Multiple sources confirm that it's the same Danfoss problem this time, for example, https://www.hln.be/binnenland/centrum-voor-cybersecurity-bev... (in Dutch)

mrweasel 1 hour ago | parent

In France I believe that the password on the monitoring software, or the controllers, was updated daily. The date was somehow used as the new password, or as an input to the password sequence. So rolling the passwords didn't do anything when the attackers are aware of the "algorithm".

liveoneggs 1 hour ago | parent

Sounds like other retail systems where lock screen passwords are the store number or similar conventions

cryptonym 1 hour ago | parent

https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/

The real issue is geniuses in food stores connecting to the open internet systems with 100K+ EUR of products exposed.

Remember, the 'S' in 'IoT' stands for Security.

thrance 1 hour ago | parent

Why the previous attack wasn't a strong enough signal to make every European retailer unplug their freezers from the internet is a mystery to me.

esseph 42 minutes ago | parent

Probably a central company that manages maintenance and preventative maintenance and uses them for monitoring and control. Taking them offline would probably cause more failures, and much higher costs in tech labor, tech travel, etc.

grey-area 23 minutes ago | parent

Would it though? I suspect the answer of these stores would be different after these attacks.

plaguuuuuu 1 hour ago | parent

Not officially at war (or even cyberwar) but... are we at war?

What sort of electronic shitfight is about to go down between major powers?

MadameMinty 1 hour ago | parent

Yes. "Hybrid war" is still war.

esseph 44 minutes ago | parent

> Not officially at war (or even cyberwar) but... are we at war?

Have been for a few years now.

c16 1 hour ago | parent

How did every supermarket chain around the world not jump at this and investigate?

vconnor 1 hour ago | parent

Their cybersecurity departments (next to fresh produce) are all over this.

Snark aside, supermarkets are not in the tech business. The extent of their involvement is ringing their IT vendor to complain about it.

auggierose 1 hour ago | parent

Depends. Lidl wants to be a tech company.

https://en.wikipedia.org/wiki/Schwarz_Digits

Sharlin 1 hour ago | parent

Probably most of them had exactly zero inhouse expertise in cybersec and just pretended there’s nothing to worry about because having to worry would be inconvenient. Maybe some of them made a call to their cold chain supplier and were told that there’s nothing to worry about.

rickdeckard 1 hour ago | parent

I wonder how many people working in any given supermarket chain actually know that their fridges are connected to a network at all.

Sharlin 1 hour ago | parent

Not many, probably, but their cold chain people definitely would have known. Instrumented and remote monitored cold chains are standard these days because keeping stuff refridgerated end to end is a pretty big deal.

sillyfluke 59 minutes ago | parent

I wouldn't be surprised if its their own agencies hacking these systems preemptively in order to force the issue and increase robustness against a larger multi-pronged attack.

ritzaco 55 minutes ago | parent

have you seen how big enterprises operate? It would generally take much longer from a decision to do something to any action happening, budget approvals etc.

And for anything infosec, unfortunately people who know a lot about infosec have a habit of 'crying wolf' and talking about infosec as some kind of absolute rule that everything has to bow down to with no willingness to balance against other business risks, so probably leadership is used to ignoring the people who knew that this was a big deal and were calling for action.

throwaway894345 16 minutes ago | parent

I’m still trying to figure out why these freezers are connected to the Internet in the first place…

wjnc 1 hour ago | parent

The magic question is: why isn’t this fixed yet? And then the specifics, the nitty grift of why not. Thousands of industrial fridges. They presumably all need new hardware, or at least tenporarily all need a RPi with additional software on the network cable, or it could even worse… are they on regular company wifi? Don’t these companies have VLANs? It’s astonishing that this is what brings billion dollar companies in a key supply chain down.

This little gimmick cost Ahold in the Netherlands an estimated 300 M€ a few weeks back. Enough money for any firm to set the engineers to work? Where they waiting it out? Having read some more… another part of Ahold (the Belgian part) was hit and has (only now…) taken all fridges down from the internet. What is IT risk doing in a firm like that? Internet of Shit is a decade old. I am not amazed non tech sectors are perhaps a bit slower in IT risk management. I am amazed that an ongoing attack situation can still cause trouble 4 months after publication and months after board level headline grabbing numbers are widely publicized.

Me and my crew (yet to form ;) will visit any fridge for a measly 100 K€ a pop to take them offline. Book early, because once the script kiddies hit, we are on the road.

jaapz 1 hour ago | parent

Was the Albert Heijn outage due to the fridge issues as well?

wickedsight 1 hour ago | parent

People (and media) seem to regularly link the two, but there was never any confirmation and the issues that AH showed had nothing to do with store fridges. They took down a system responsible for stocking stores, fridges, registers, etc were still functional.

wjnc 1 hour ago | parent

You are right. That was never made public. They were hit on exactly the same day as the French hack of fridges and took what look like a forward looking step of taking a lot of infrastructure down.

That does lead to harder things to think about. Multiple different attacks on EU supermarktes? Resilience? And then the questions I point to above: how hard is it for non tech firms to fix an emerging IT risk situation.

ricardobayes 5 minutes ago | parent

The way some of these publicly listed companies work now they would "rather have" a cyber incident and claim the damages on insurance than hire engineers, because that looks worse on a quarterly report to have salaried workers.

lifestyleguru 1 hour ago | parent

Admin interface available on the internet without 2fa and automatic password change once a week? Anyone gaining sufficient experience and seniority in the industry becomes instantly unemployable, so it is what it is.

Y_Y 1 hour ago | parent

> Admin interface available on the internet

This is the bad part. Frequent password resets suck.

sorenjan 1 hour ago | parent

The neat thing about Danfoss' frequent password resets is that it's always the current date, so it's easy to remember.

https://en.wikipedia.org/wiki/2026_French_supermarket_refrig...

bedstefar 1 hour ago | parent

I'm extrapolating a bit here based on Reddit hearsay, but I think this may have to do with rural stores having essentially consumer-grade internet routers connected to the mobile broadband network.

Much of the coverage in Swedish media drives the point that only 4G-uplinked stores have been hit so far. I think that's unfortunate, because really it wouldn't have differed if these stores were connected by 5G.

I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router. In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN, so my guess is that these control systems were simply findable on Shodan.

This also explains why this wasn't discovered after the recent French breach. Supposedly all the stores with "proper" uplinks were in compliance, and no one had thought of a way in for those non-compliant stores, because they "weren't even connected, so how would an attacker get in?"

yellow_lead 52 minutes ago | parent

> I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router.

Why would there be accidental port mappings on their router though? I could maybe see owners setting it up so they could monitor from home, but even that is a bit of a stretch for rural supermarket owners

bedstefar 50 minutes ago | parent

> Why would there be accidental port mappings on their router though?

That's the point of NAT-PMP / UPnP, it just works (for game servers, torrent clients, industrial control systems etc.)

xorcist 19 minutes ago | parent

Many of these smaller stores (and probably some of the larger ones too) rent or lease refrigeration equipment from one of a handful big providers. These are large and expensive systems, and there is costly paperwork involved together with logistics suppliers to show that the cold chain is satisfactory.

These refrigeration providers work with local contractors and HVAC companies to set things up. Their installation techs do what they think is required to remotely operate these systems. If you bring up the question keeping these systems offline or at least on airgapped networks you will most likely get a shrug as reply.

This is not a technology problem. This is problem of responsibility. One can hope things will improve when litigation starts happening, but it doesn't look good considering these people had literally months of notice since the well-publicized attacks on the American fridges, then the French fridges, and now these.

techpression 1 hour ago | parent

My fridge beeps loudly when something is wrong, and it has no connectivity to any network. Exactly how a fridge is supposed to be, why are we reinventing fridges…

torlok 30 minutes ago | parent

You're not managing thousands of fridges across a country.

zerozerotwo 57 minutes ago | parent

Considering how Europe has embraced huawei and I saw a lot of their gear in consumer use when I was there, I’d be interested in seeing the Ben diagram of huawei gear and impacted stores

usrnm 50 minutes ago | parent

Europeans are totally capable of fucking up themselves. In this particular case, it was Danfoss, which is a Danish company

cuttysnark 36 minutes ago | parent

Venn’s first name was John, not Ben. :)

https://en.wikipedia.org/wiki/Venn_diagram

AlecSchueler 27 minutes ago | parent

If there's evidence of Chinese involvement via backdoors then it would be great to see it, but until then this reads as "red scare" adjacent.

torh 55 minutes ago | parent

"Fool me once, shame on you, fool me twice, shame on me." But it should have been, like Bush said: "Fool me once, shame on — shame on you. Fool me — you can't get fooled again."

parsatomosu 50 minutes ago | parent

imagine that happens to a nuclear reactor

elashri 20 minutes ago | parent

I wonder if any of EU reactors is connected to the open Internet with a weekly password reset policy, where you can use the control rods from the convenient of your home.

Sol- 19 minutes ago | parent

What's the incentive here? Just some tech anarchism? I would have figured that they at least demand bitcoin to reverse it or something. I know, people will blame the Russians, but seems not super productive for them to do such mundane sabotage on such non-critical systems.

black_puppydog 15 minutes ago | parent

On the contrary, sabotaging things that impact everyday life and give a generalized feeling of decline throughout society is water on the mills of Russia's allies in Europe, notably the nationalist and populist parties.

krunck 12 minutes ago | parent

But what's the incentive?

linuxftw 10 minutes ago | parent

"Every bad thing that happens is the Russians" sounds very similar to "Every bad thing that happens is the Israelis." It's unhinged, Candice Ownens level nonsense.

p-e-w 10 minutes ago | parent

So instead of doing this during a potential future war when it could be a strategic advantage, Russia is doing piecemeal attacks right now to show Europe where the weaknesses are and give them time to upgrade their defenses?

jdthedisciple 13 minutes ago | parent

Wild guess: vegan activists (terrorists), given it mostly affects meat and dairy.

krunck 11 minutes ago | parent

And tofu.

clarionbell 10 minutes ago | parent

It's very simple. Anything that hurts the enemy is good. That includes the civilian population. Actions like this increase general discontent, produce negative economic impact and divert attention from other areas.

And the required investment is minimal.

WarmWash 8 minutes ago | parent

When you are 16, the incentive is just to feel power.

Not saying we know anything about who did it, but senseless vandalism is usually a hallmark of kids.

esseph 7 minutes ago | parent

[delayed]

1970-01-01 15 minutes ago | parent

This is actually good news. Accountability is everything when it comes to food supply. Forcing people to witness spoiled food is the slap people need to feel else they will never take action. The prolific insecure code that is keeping you from eating today will always be fixed.

the__alchemist 10 minutes ago | parent

Holy fuck don't connect your freezer to the internet. And if you do, have it be read-only, not change settings. Did we learn nothing from Battlestar Galactica?

p-e-w 8 minutes ago | parent

There are massive financial incentives for centralizing control and management. They’re not doing that because they think it’s a cool gadget.