I think it's important to see if this could happen on a larger scale. What if it wasn't only French supermarkets but also important supply chain chokepoints of food worldwide? What would happen to food prices?
There is probably enough variety in refrigeration technology that this scenario is unrealistic. There are many tens to hundreds of manufacturers worldwide.
> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".
I worry that this kind of thing is going to be a recurrent problem. A lot of people have pretty strong intuitions, or even an explicit moral position, that they should never have to upgrade a physical machine that's working fine. Is there a threshold of vulnerability that will overcome that, or are we just going to see a lot more hacking of random infrastructure from now onwards?
This is literally everything that's wrong with the modern tech industry in a nutshell:
> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".
They sell fricken refrigerators for God's sake. Maybe I can understand planned obsolescence for a cell phone, but a fridge? And especially to grocery stores that operate on razor thin margins to begin with, the idea that they'll just dump their old working refrigerators because the manufacturer refused security updates is a guaranteed recipe for stuff like this.
I have to question why this control system was even in place.
I could see remote monitoring (of temps) and logging on the system (cycle time etc) but does one really need to control the defrost cycle? It's probably just a web interface on a single controller that used to be accessed by HVAC techs only.
> > "legacy" products which "no longer receive software or security updates".
Because it's the EU I have to wonder if they will finally mandate that software go into escrow and be released if support stops.
Grocery stores do not use standalone refrigerators, I’m not sure why I have to keep repeating this fact when every single person has been in a grocery store and seen refrigerated cases that have a dozen or more doors.
They use cold cases and have rooftop or outdoor condensing units and evaporators inside of the cold cases/freezers/etc. There’s refrigerant piping running all over the place and there’s a bunch of sensors and relays that are automated to manage the refrigeration system.
My assumption is the Danfoss control system they’re using is EOL, it’s the grocer’s responsibility to upgrade their automation equipment if it’s unsupported.
This is terrible. But, at the same time, why now? This seems like something you'd want to hold onto for use later as a nation state. And there's no money to be made here since you can't really ransom it. Was this just a petty attack to scare the public?
On the bright side I'm sure the manufacturer and others will have an increased security posture going forward.
Probably to inflict pain on the life of the voters so they can blame the government and manipulate the 2027 French presidential election in April. Maybe just a test.
> On the bright side I'm sure the manufacturer and others will have an increased security posture going forward.
Wow, are you an optimist. The manufacturer has stated that they're past the period of security updates. And others... meaning the supermarkets? They outsource that. The people they outsource it to? Maybe they'll start paying attention to security.
Script kiddies are on LLM steroids now. I’m so glad I kept my home "smart" stuffs fully disconnected from any network. No, I can’t control my home temperature from the other side of the world when in vacation, and so can’t the rest of the world until they physically enter it.
I think that's exactly what happened. A kid found out (via an LLM or otherwise) that fridges' temperature were remotely controlled, probably with lax security (or no security at all) and decided to play with it.
It's not immediately obvious to me why fridges in supermarkets need remote control; a supermarket is a place where there are always people, it's not a base on Mars. And even if a remote is needed, it should probably not go further than the manager's office.
> It's not immediately obvious to me why fridges in supermarkets need remote control
I don’t know to what degree control is needed, but remote supervision of cold holding temperatures is good to make sure food doesn’t spoil. Most places that don’t have networked fridges have staff manually logging the cold holding temperatures to make sure things are working.
Again, though, I don’t know about making changes though.
In this case it's not like the devices were turned off, they were put on "defrost" which means heating up to 50°C (122°F). Why would you need the ability to remotely set all your fridges to defrost??
One possibility is that it’s maybe useful for the fleet operator to be able to remotely update firmware and the attacker used that.
The other, more likely, answer is that there’s a diagnostic mode that allows raw control of the system and no one bothered to require physical presence to enable service mode.
With remote firmware update capability, at attacker could easily brick the entire fleet. With just service access it could be possible but would be more complex.
I remember having to do this every few hours 25 years ago when working at a store part-time as a student.
Having networked telemetry seems like a good idea, just not sure why they would need remote control too - that seems far more dangerous than necessary.
15 years ago a retail chain i worked for had all their HVAC thermostats centrally managed by corporate. This isn't new and it is stupid but how else do you ensure shareholders keep every possible cent of profit (in the short term of course)
I don't disagree, but having remote monitoring capabilities on a professional fridge is most likely not a hipster feature. Even mid-size supermarkets have dozens of them, with different temperature settings; they can fail, customers can block the doors, etc. You do want to receive an alert when something is wrong.
Honestly I like smart appliances. For example, I have a home assistant integration that will sound an alarm if a stove burner is on but no person is detected in the room, and a handful of other similar safety-related conditions.
But they don't need to be cloud-connected through some big corp's cloud. I want them local and firewalled, ideally.
Fridges tend to have built-in defrost cycles these days. Without that, ice builds up around the coils that ordinarily cool the compartment (and by extension the ambient moisture in the air, encouraging it to condense). And you'd have to thaw it yourself from time to time.
Every refrigerator has a defrost cycle - which is just a heater. It normally only runs for a few minutes at a time, but if you change some bits around, it could run for a lot longer and a lot hotter.
It's probably just running the heat pump in the other direction. 50° sounds about right for the hot side. I expect that the hotter the better, because it will melt the frost without warming the food. And if a bad guy hacks in to the freezer, he can probably override any kind of temperature control and just tell the compressor to run full out.
Because they need remote monitoring. I have experience with HVAC so I'm guessing these are similar: typically outsourced to a third party, typically a VM running on a dedicated server, accessible by Citrix or something similar. Supermarkets don't internally staff fridge repairmen.
Monitoring makes sense, but it feels like it makes no sense at all to allow that kind of remote maintenance without staff on-site to OK and verify it - who could then do the maintenance themselves.
Otherwise, this sort of spoilage could easily happen by accident as well.
"That, like, costs money, man. The accounting department said there was a 1-in-100 year chance of this happening if we didn't shell out, so we didn't." - the CEO, probably.
They aren’t fridges, it’s a grocery store. You have obviously been in one, there are cases with a dozen doors that all open to the same cold case.
There is a ton of refrigerant piping, multiple condensing units, multiple evaporators, relays, and sensors connected to a controller that automates the refrigeration system. Not standalone refrigerators.
I shouldn’t need to list the benefits of remotely monitoring a system that can cause tens or hundreds of thousands of dollars if it fails.
Same (an outage) happened to the US military commissary system https://www.stripes.com/theaters/us/2026-09-01/army-cid-inve...
I was hoping there would be more discussion about the overlap of these two events.
What genius decided to connect a fridge to the Internet? Make him pay the losses.
By the way similar thing might happen to geniuses buying Internet-connected cars.
https://www.lemonde.fr/en/france/article/2026/10/12/french-s...
People never learn:
https://programmerhumor.io/networking-memes/the-ultimate-fir...
Claude had munchies....
"claude, make better use of eletricity costs. stop services not required for the task. make no mistakes"
I think it's important to see if this could happen on a larger scale. What if it wasn't only French supermarkets but also important supply chain chokepoints of food worldwide? What would happen to food prices?
>What if it wasn't only French supermarkets but also important supply chain chokepoints
The largest supermarket chain in the Netherlands has currently halted most of its distribution centers due to an ongoing "cybersecurity incident": https://nltimes.nl/2026/10/12/empty-shelves-likely-albert-he...
There is probably enough variety in refrigeration technology that this scenario is unrealistic. There are many tens to hundreds of manufacturers worldwide.
Similar issue affected a US military base very recently. Multiple manufacturers doesn't help if they source the same components.
By the way, Soviet refrigerators are immune to this type of attacks.
[dupe] https://news.ycombinator.com/item?id=50055304
Maybe the agent swarm passed its “warmth” eval.
> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".
I worry that this kind of thing is going to be a recurrent problem. A lot of people have pretty strong intuitions, or even an explicit moral position, that they should never have to upgrade a physical machine that's working fine. Is there a threshold of vulnerability that will overcome that, or are we just going to see a lot more hacking of random infrastructure from now onwards?
This is literally everything that's wrong with the modern tech industry in a nutshell:
> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".
They sell fricken refrigerators for God's sake. Maybe I can understand planned obsolescence for a cell phone, but a fridge? And especially to grocery stores that operate on razor thin margins to begin with, the idea that they'll just dump their old working refrigerators because the manufacturer refused security updates is a guaranteed recipe for stuff like this.
It is a way to move the responsibility to the "users".
But the hack has already been disclosed and it's the responsability of the manufacturer to ensure that the fridge keep ever up to date or offline.
As with the USA Defense hack, it could have been prevented.
The hack: https://blog.claroty.com/team82/research/freeze-the-controll...
I have to question why this control system was even in place.
I could see remote monitoring (of temps) and logging on the system (cycle time etc) but does one really need to control the defrost cycle? It's probably just a web interface on a single controller that used to be accessed by HVAC techs only.
> > "legacy" products which "no longer receive software or security updates".
Because it's the EU I have to wonder if they will finally mandate that software go into escrow and be released if support stops.
Grocery stores do not use standalone refrigerators, I’m not sure why I have to keep repeating this fact when every single person has been in a grocery store and seen refrigerated cases that have a dozen or more doors.
They use cold cases and have rooftop or outdoor condensing units and evaporators inside of the cold cases/freezers/etc. There’s refrigerant piping running all over the place and there’s a bunch of sensors and relays that are automated to manage the refrigeration system.
My assumption is the Danfoss control system they’re using is EOL, it’s the grocer’s responsibility to upgrade their automation equipment if it’s unsupported.
I assume you’re talking about a system like this:
https://www.danfoss.com/en/industries/food-and-beverage/dcs/...
“God news shareholders! We have decided that we didn’t make enough sales this quarter so we have EOLed a whole range of products!”
This is terrible. But, at the same time, why now? This seems like something you'd want to hold onto for use later as a nation state. And there's no money to be made here since you can't really ransom it. Was this just a petty attack to scare the public?
On the bright side I'm sure the manufacturer and others will have an increased security posture going forward.
> why now?
Probably to inflict pain on the life of the voters so they can blame the government and manipulate the 2027 French presidential election in April. Maybe just a test.
Manufacturer abdicated saying those models are no longer supported and so not receive security updates.
Wonderful world we live in where refrigerators and cars also become e-waste because a manufacturer gets tired of patching them
Who benefits from chaos? There is a war raging in Europe, maybe start there
Exactly. This is fifth generation warfare.
Unrestricted warfare is a book more people read to be aware of
> On the bright side I'm sure the manufacturer and others will have an increased security posture going forward.
Wow, are you an optimist. The manufacturer has stated that they're past the period of security updates. And others... meaning the supermarkets? They outsource that. The people they outsource it to? Maybe they'll start paying attention to security.
Script kiddies are on LLM steroids now. I’m so glad I kept my home "smart" stuffs fully disconnected from any network. No, I can’t control my home temperature from the other side of the world when in vacation, and so can’t the rest of the world until they physically enter it.
I think that's exactly what happened. A kid found out (via an LLM or otherwise) that fridges' temperature were remotely controlled, probably with lax security (or no security at all) and decided to play with it.
It's not immediately obvious to me why fridges in supermarkets need remote control; a supermarket is a place where there are always people, it's not a base on Mars. And even if a remote is needed, it should probably not go further than the manager's office.
> It's not immediately obvious to me why fridges in supermarkets need remote control
I don’t know to what degree control is needed, but remote supervision of cold holding temperatures is good to make sure food doesn’t spoil. Most places that don’t have networked fridges have staff manually logging the cold holding temperatures to make sure things are working.
Again, though, I don’t know about making changes though.
In this case it's not like the devices were turned off, they were put on "defrost" which means heating up to 50°C (122°F). Why would you need the ability to remotely set all your fridges to defrost??
One possibility is that it’s maybe useful for the fleet operator to be able to remotely update firmware and the attacker used that.
The other, more likely, answer is that there’s a diagnostic mode that allows raw control of the system and no one bothered to require physical presence to enable service mode.
With remote firmware update capability, at attacker could easily brick the entire fleet. With just service access it could be possible but would be more complex.
I remember having to do this every few hours 25 years ago when working at a store part-time as a student.
Having networked telemetry seems like a good idea, just not sure why they would need remote control too - that seems far more dangerous than necessary.
15 years ago a retail chain i worked for had all their HVAC thermostats centrally managed by corporate. This isn't new and it is stupid but how else do you ensure shareholders keep every possible cent of profit (in the short term of course)
You assume there must be some nation state behind it.
But it could be just for the lulz.
Remember the hackers behind the seven proxies, AntiSec, which hacked the NATO library website, and went to prison for it.
https://en.wikipedia.org/wiki/Operation_AntiSec
Please, let this be the stone that starts the avalanche of consumers rejecting smart apppliances.
My fucking fume hood on my stove has Bluetooth, because Samsung just can’t help themselves apparently.
I don't disagree, but having remote monitoring capabilities on a professional fridge is most likely not a hipster feature. Even mid-size supermarkets have dozens of them, with different temperature settings; they can fail, customers can block the doors, etc. You do want to receive an alert when something is wrong.
Those devices should be connected to air-gapped local network and not to manufacturer.
Why the fuck does a fume hood need that?!?!?!?!
> Why the fuck does a fume hood need that?!?!?!?!
Why, so you can turn it on from your smartphone when you're out of town, of course!
"Oh, Honey, I think we forgot to turn the stove off!"
"Well, I can't help you there, but I can turn off the fume hood from my phone!"
"..."
But it's Bluetooth so short range only? So it's not even good for that?
Exactly!
What compelled you to buy a stove hood with a cpu and blutooth radio?
It was there when we moved in.
Would have been a red flag for me on the apartment tour haha. I once leased a place like this. Paid app needed to receive packaged mail. Never again.
Why would this time be any different than the last hundred times?
Honestly I like smart appliances. For example, I have a home assistant integration that will sound an alarm if a stove burner is on but no person is detected in the room, and a handful of other similar safety-related conditions.
But they don't need to be cloud-connected through some big corp's cloud. I want them local and firewalled, ideally.
sound an alarm if a stove burner is on but no person is detected in the room
Can you turn that off or do you just have to put up with the noise?
I prefer the freedom of putting a pot of water on to boil and walking off to take a leak, personally. That would drive me absolutely insane.
How in the name of fuck was a fridge even designed to be able to heat itself to 50 degrees C?
Fridges tend to have built-in defrost cycles these days. Without that, ice builds up around the coils that ordinarily cool the compartment (and by extension the ambient moisture in the air, encouraging it to condense). And you'd have to thaw it yourself from time to time.
Every refrigerator has a defrost cycle - which is just a heater. It normally only runs for a few minutes at a time, but if you change some bits around, it could run for a lot longer and a lot hotter.
It's probably just running the heat pump in the other direction. 50° sounds about right for the hot side. I expect that the hotter the better, because it will melt the frost without warming the food. And if a bad guy hacks in to the freezer, he can probably override any kind of temperature control and just tell the compressor to run full out.
I thought that. Now looking for the heat setting on my fridge. I guess it’s in case you need to antifridge sometimes.
Why the fuck are those fridges even networked!?
Because they need remote monitoring. I have experience with HVAC so I'm guessing these are similar: typically outsourced to a third party, typically a VM running on a dedicated server, accessible by Citrix or something similar. Supermarkets don't internally staff fridge repairmen.
They could just use connected temperature probes though. no need to connect the power supply of the damn compressor to the internet.
None of the supermarkets were managed by Commander Adama, apparently.
Centralized maintenance and monitoring?
Monitoring makes sense, but it feels like it makes no sense at all to allow that kind of remote maintenance without staff on-site to OK and verify it - who could then do the maintenance themselves.
Otherwise, this sort of spoilage could easily happen by accident as well.
> remote maintenance without staff on-site to OK and verify it - who could then do the maintenance themselves
These are minimum wage workers - they don't have bean bags in the nap room, employee massages and stock options.
Supermarkets don't staff HVAC/fridge repairmen. There are separate companies they pay to do this.
Right: and someone from that company can come out and do maintenance when the monitoring indicates it's necessary
It seems like the sort of thing you’d do in-store and firewalled from the internet.
You’d have to pay competent local staff for that.
How do you think grocery stores worked pre internet?
The article didn't say they weren't.
"That, like, costs money, man. The accounting department said there was a 1-in-100 year chance of this happening if we didn't shell out, so we didn't." - the CEO, probably.
That might justify a temperature probe in a dumb fridge. This smells of a salesman being here not an engineer though.
Makes sense but monitoring doesn't mean you have to have remote control of power.
"Utility has alerted us to an upcoming brown-out in a region impacting 40 stores. Cool everything down a few extra degrees in preparation."
To monitor when something like this happens...
Wait until people living north of Chicago learn that their thermostats are remotely controlled, when it's -20F outside.
They aren’t fridges, it’s a grocery store. You have obviously been in one, there are cases with a dozen doors that all open to the same cold case.
There is a ton of refrigerant piping, multiple condensing units, multiple evaporators, relays, and sensors connected to a controller that automates the refrigeration system. Not standalone refrigerators.
I shouldn’t need to list the benefits of remotely monitoring a system that can cause tens or hundreds of thousands of dollars if it fails.
So you can get a notification when the milk expires.
Instead of climate change, let's call it "cyber change"...the rise of hacks of all kinds facilitated by AI
These incidents will bring back the appeal for dumb appliances, hopefully.