Yet another Hacker News

Hackers activate automatic defrosting accross European supermarket fridges

77 points Zeekaas 1 hour ago 69 comments

fzeindl 1 hour ago | parent

Great. We already waste a ton of food, let’s destroy even more.

0123456789ABCDE 48 minutes ago | parent

these are the visible effects of a hybrid war, not the pranks of script kids

renyicircle 43 minutes ago | parent

It's probably a small drop compared to the overall amounts of wasted food. I guess the hope is that it will teach some people important lessons, like "your refrigerator shouldn't be connected to the Internet, and if it absolutely has to, take some time to consider security".

hk1337 1 hour ago | parent

“Suck it, Jin-Yang!”

kotaKat 1 hour ago | parent

... Feels like deja vu. Didn't the US military just have this happen at its military exchanges... a month or two ago?

Yes, yes they did. https://www.militarytimes.com/news/your-military/2026/08/28/...

"ALL freezers went into defrost mode – ALL frozen food has spoiled".

black6 56 minutes ago | parent

Yes, not exactly "unprecedented." The news of Commissaries having their freezers hacked should have been a kick in the rump for everyone else with infrastructure needlessly connected to the Internet.

RugnirViking 18 minutes ago | parent

the sort of people doing this security posture definitely are not up to date on the latest security news...

It would take something truly monumental to make a local supermarket owner to even consider the potential for their fridges to be an attack vector.

ninefathom 38 minutes ago | parent

This was precisely my first thought upon reading. "Ah, yes - the attack that was PoC'ed against commissaries operated by the US armed forces a bit over a month ago."

chimneychanga 22 minutes ago | parent

Yeah I remember that, and it seems like the military was very hush-hush about the cause. Now I wonder if they were hacked too.

47282847 1 hour ago | parent

Fridge attack! We live sci-fi indeed! %-)

gessha 1 hour ago | parent

“Got another blackout in Santo Domingo. Netrunners are at it again, poking holes in the power grid!”

0123456789ABCDE 57 minutes ago | parent

that's happened in Ukraine, a few times already — search for sandworm

andy greenberg wrote a book on this -> https://app.thestorygraph.com/books/a2d3f71e-e9aa-4947-8aa0-...

robthebrew 1 hour ago | parent

TomsHardware hit? I'm getting spinning beachballs on this link

pjmlp 18 minutes ago | parent

All Future sites are junk now, and I imagine even with subscription they aren't much better.

alexdrdr 1 hour ago | parent

Only going to get worse as hackers get increasing access to more advanced AI models and compute

Open weight models catch up quickly, so it is only a matter of time before Fable level models are in the hands of bad players

Key issue will be that banks and key infrastructure *may* get their security patched in time. But there’s going to be so many vulnerable companies like in this case

notyourwork 54 minutes ago | parent

And hopefully regulation following it.

jayGlow 20 minutes ago | parent

What regulations would help with this? companies that actually host the models themselves can be regulated but open models can e abliterated or otherwise modified to stop them from refusing tasks. I'd be very wary of any regulations that prevent people from hosting or making their own models and weights.

ex-aws-dude 1 hour ago | parent

Why is that even internet enabled?

If you want to defrost it presumably someone already needs to be physically present to unload the fridge?

0123456789ABCDE 55 minutes ago | parent

someone, or something, needs to monitor the fridges remotely, which means networked thing with all the cute little details of the IOT tacked to it

edit: these are unlikely to be directly connected to the internet, but rather part of an internal network that got popped, likely a while a go too

polytely 51 minutes ago | parent

Yeah I feel like cheap enough AI will make having internet connected appliances such a huge liability that most devices will have to go back to as dumb as possible

Kevin_Flynn 50 minutes ago | parent

My guess, its a service contractor type situation, like getting a smart meter. You can opt out, you just wont have power.

They had a contract with a fridge company, and the service agreement required remote monitoring such that, the service company would be able to detect and troubleshoot remotely, and schedule calls.

The problem with situations like these is that your network security falls to the lowest common denominator, which in this case, is a group of HVAC technicians.

The conversation was something like this:

HVAC company: "Oh yeah, our software does this, and that, and we monitor everything, and thats why our contract is less, we dont waste time and we use sophisticated technology. And of course its 100% secure because expert boffins wrote it."

Grocer w/ 2% margins: "Sounds great."

To be clear, I'm not throwing shade on HVAC technicians. I'm only saying, they aren't network security specialists, thats all.

wongarsu 32 minutes ago | parent

Somebody wrote the software that is the interface between the fridge and the internet. And while it would be nice if HVAC technicians would remember to only make this software accessible via VPN, it is in fact possible to write software that is reachable from the internet while still being secure

Given that we agree that HVAC technicians can't be relied on for network security, this is 100% on the fridge company for having insecure software. If it's a bad password or an unchanged default password that's still on the fridge company for not enforcing something better

Kevin_Flynn 25 minutes ago | parent

Of course its "possible" for it to be secure, but the people involved are not experts.

The grocer likely has the least expertise. The HVAC company has more, but as evidenced by the article, not enough.

Now obviously, these companies have internal "information systems experts" but again, how does the banana guy interview a CIO ? Grocery store CIO might have gotten the job because he made the banana guy comfortable by talking about sports.

Each party was confident in a successful outcome, until the 15 year old kid across the globe pulled the rug.

The processes that created this situation were inadequate, because glad handing and name dropping cost less than formal systems validation.

Of course, the other way to view all of this is ... they just completed formal systems validation, found 1 bug, and paid whatever the food spoilage cost was for it, because no matter how much preperation one does on a project, at some point the power switch gets flipped, and its wait and see.

In a group project, noone is ever sure if Poindexter over there in the corner is quiet because he's quiet, or is quiet because he knows the code is crap and his boss ordered him to ship it anyway.

We're likely dealing with at least 4 companies here, if not more:

contracted programmers <-> fridge equipment maker <-> HVAC sales/service group <-> grocer

3 of the 4 companies could have all said to themselves "Project ships on Monday, no matter what" because who carries the risks for any flaws ? The grocer(s).

Delphiza 15 minutes ago | parent

IoT platforms provided all the required functionality. Device provisioning (it is not easy to do identity on 'things'). MQTT for service-assisted communication where devices don't need to accept incoming connections. Over-the-air software updates. Over-the-air kernel security updates.

The 'fridge company' and other product manufacturers decided to skip all that and run everything on a raspberry pi with apache, or an ESP32 soldered onto the control board, and call it finished. There are millions of these devices out there.

Kevin_Flynn 5 minutes ago | parent

I just read the article again. It mentions "Danfoss" HVAC controls.

I happen to have a Danfoss HVAC controller here, and its controllable via Modbus.

Modbus systems are multi-drop serial, and the hack likely came in from the server side of one of the companies involved, and the HVAC controllers were all sent defrost commands. Thats my guess anyway.

m000 6 minutes ago | parent

> Grocer w/ 2% margins

You have clearly never stepped foot inside an Albert Heijn store.

Kevin_Flynn 2 minutes ago | parent

> You have clearly never stepped foot inside an Albert Heijn store.

I have not. I travel in the ALDI circle.

2.1% net profit is what AI says the US grocery industry averages, so individual product margins would be higher.

quickthrowman 22 minutes ago | parent

Have you ever been to a grocery store?

These aren’t consumer refrigerators, it’s a collection of large cold rooms and cases with a bunch of refrigerant tubing and multiple condensers, evaporators, and sensors. It’s a bit more complex than a single home refrigerator.

lemoncookiechip 52 minutes ago | parent

Why is this even connected to the internet. If you want to monitor it remotely, you can set that independently from the actual controls.

StableAlkyne 50 minutes ago | parent

There is so much needless connection to the internet nowadays; this is the end result of a decade of shoving IoT into everything.

Beyond some corporate manager seeing a dashboard that will cause them to say "oh neat" in a meeting once, there is zero reason to put a refrigerator's cooling system online. Or frankly any network for that matter. Is there really such a massive productivity increase from being able to remotely change the temperature when a human has to physically visit the machine to restock every day anyway?

Delphiza 37 minutes ago | parent

There are a bunch of good reasons to connect a commercial refrigeration unit to the Internet (via IoT). Notification when failover to the secondary cooling system happens, notification of when ambient temperature is too high, optimisation of energy consumption (especially after hours).

Doing it insecurely by, for example, having a device with a web server on the fridge is problematic. Not being able to deploy firmware updates. Having too much of the control loop exposed (as opposed to monitoring only), can lead to issues.

Service-oriented industries with costly assets will look to Internet connectivity for competitiveness and efficiency. It needs to be done better.

renyicircle 19 minutes ago | parent

I didn't expect to spend so much time today thinking about fridges. I have so many questions. If it's all so connected and monitored and notifies of issues, couldn't it notify anyone that the settings are weird, like continuous 50 degree Celsius defrosting? How much access did the hackers have, apart from temperature controls? Could nobody intervene quickly before the damage was done? Was there a way to "unplug" the fridges or they would just keep frying, so they had to get people across all the stores doing manual resets?

quickthrowman 24 minutes ago | parent

> there is zero reason to put a refrigerator's cooling system online.

There are plenty of good reasons to do that. It’s not a consumer refrigerator, it’s a collection of evaporators and condensers and sensors that are controlled by an automation system. Remote monitoring can alert operators to problems so they can be fixed before the food spoils.

Authentication is hard.

pjmlp 20 minutes ago | parent

Added to it that those devices are powered by firmware written in C and C++, with various levels of quality control if any, and no field updates.

Lyngbakr 19 minutes ago | parent

I always feel like such a buzzkill and Luddite when talking about IoT. My sister-in-law excitedly told me how her air fryer can be controlled remotely via an app. I think she also expected me — a techie — to be excited, but all I could see was unnecessary risk and usage data being slurped up by a corporation. I'm sure there are lots of good applications of IoT; however, I don't think this is one of them.

MisterMunchkin 44 minutes ago | parent

Interesting. The government has been suggesting war with Russia is coming. This would be a great initial move. Take out the European food supply network, then hit things like the grid and the internet.

It's funny because red storm rising is an old book at this point, but it's pretty accurately shown exactly how conflict with Russia plays out. Even down to Russia realising it is about to run out of diesel... causing it to invade Europe while it still can.

4gotunameagain 38 minutes ago | parent

Russia cannot invade Europe, that is nonsense peddled by the EU establishment to support their idiotic military Keynesianism as part of a plan to reboot EU manufacturing.

They are struggling to take a couple of villages in Ukraine, why would they invade the EU.

rwyinuse 27 minutes ago | parent

Large scale invasion is not likely, but they could try some limited operation to test NATO's unity. Most likely location would be somewhere in the Baltics.

fennecfoxy 8 minutes ago | parent

Lmao they literally assassinate people with nerve agents on British soil as is and get told they're naughty boys and not to do it again please.

I think an actual invasion would initiate a very serious and deadly response, but their constant pranks will continue to go unpunished (unfortunately).

wongarsu 26 minutes ago | parent

To be fair, that they are struggling to take over a couple of villages in Ukraine is in large parts due to the intensified arms and ammunition production of the entire EU (and in the past that of the US). And that's only enough for a standstill

brookst 16 minutes ago | parent

Standstill with Ukraine looks bad, and authoritarian regimes can survive almost anything except looking bad.

Responding to a NATO “attack” from Estonia, Putin can pivot to a bigger enemy where of course Russia has to employ universal conscription / nuclear weapons / whatever. The country must unite against this unprovoked western attack, etc, etc.

flohofwoe 16 minutes ago | parent

Ukraine did a spectacular job to stop the full-scale invasion in the initial hours, days and weeks when there wasn't much international help yet though (and I guess from that moment on the war didn't go quite according to plan from the Russian PoV).

scns 8 minutes ago | parent

Ukraine took out a Yandex data center, which made the pro Trump bot traffic drop.

https://www.bbc.com/news/articles/cw0k0g57mk3zo

flohofwoe 26 minutes ago | parent

Never underestimate the stupidity and irrationality of autocratic governments. Putin also decided to invade Ukraine after all even though he should have known better.

goobatrooba 21 minutes ago | parent

Not Europe but a few Baltic states are feasible. No one says they can hold it, but Putin has his own reasons so we should not think we can conclude on future Russian actions based on what we consider reasonable - e.g. no one predicted that a war on Ukraine was likely as it seemed to be completely irrational and self-defeating.

If nothing else, war has been many times convenient to keep regimes in power (see Bush post 9/11 for an obvious example). Putin might want to strengthen his case. See absurd discussions / push for a "Republic of Narva" as an example cause belli.

reincoder 8 minutes ago | parent

I have read some Asian country's (who are friendly with Russians) government foreign affairs required readings that is like 2 year old by now. Those materials say Russia is being cornered. They had no other option to but to invade Ukraine. But with sanctions they are more cornered and are desparate. They thought China would ally would them but China's selective neutrality is making them desparate. Those documents say that Russia never actually deployed their main regiments and only worked with mercenaries and allied country armies.

No body knows how much petro product Russia is producing or who is buying them. Those diplomatic documents suggest treating simultaneously as a black box and a cornered animal. The financial sanctions actually was a double edged sword considering UK essentially blocked all foreign transactions even for international infrastructure investments Russia made to foreign countries and at the same time from a global perspective UK was not seen as a reliable financial partner. So, Russia is desparate, EU is desparate but they are not allowed to sit in a table to negotiate... Because US will not allow that. If a war happens across EU every party invovled will see this is to be positive thing because for the last decade economies has slowed down and political views has become extremely polarizing. A war at a massive scale brings everyone together for their country and economy jumpstarts.

mvdwoord 36 minutes ago | parent

An apt time to revisit this gem...

https://www.imdb.com/title/tt4192998/

renyicircle 33 minutes ago | parent

> Connecting your case controller to the internet offers further opportunities to generate savings. If you can diagnose issues and control the case remotely, service engineers needn’t be called out to simple situations like starting a defrost. And being able to compare performance and efficiency across an entire estate of stores makes it easy to spot patterns and make incremental efficiency gains. (https://www.danfoss.com/en/service-and-support/articles/dcs/...)

I wonder if the incremental efficiency gains from this outweigh the damages. That doesn't even sound like a bad idea, unless of course nobody stops to think "but what if someone hacks this".

Simulacra 30 minutes ago | parent

And I would bet dollars to donuts that someone at that company would respond "who's going to hack a refrigerator? Heh"

pjmlp 26 minutes ago | parent

Thankfully these kind of attacks make pressure to finally have liability in software like in other industries.

Delphiza 23 minutes ago | parent

Good find.

The biggest issue is that many of these IoT devices are badly secured. I spent years trying to convince people to build more secure IoT systems, but they always preferred cheap and easy solutions.

master-lincoln 18 minutes ago | parent

I would have said let them be doomed. But due to late stage capitalism so much has been centralized that everybody is doomed in many cases...

bluGill 13 minutes ago | parent

Why are technicians (service engineers!) coming our for a simple defrost in the first place? The normal defrost cycle should be automated. For anything else you need someone to come out anyway because something is wrong - there is no point in starting a defrost cycle if the root cause is leaking refrigerant - fix the leak and refill the system both of which need to be done in person.

floatrock 8 minutes ago | parent

We all keep a shotgun next to the printer in case it makes an unexpected noise here because the average HN reader knows a fridge manufacturer knows nothing about infosec and the lowest-bid contractor they farm the connection does the minimum to check the boxes. So yeah, we've been rightfully complaining about why does my icemaker need an internet connection for years.

Lets combine some testy topics: will LLMs make this any better? On the one hand, if it's easy for fridge manufacturers to churn out code, will the slop create enough cracks in the icemaker to sail the titanic through? Or will the lower barrier to pretty good security agents get more security into the IoT field (assuming it's taken advantage of?) Or will it not matter because the store manager will just set the web portal password to 123456?

lornmorkse 32 minutes ago | parent

Wait until they figure out they’re all filled with butane as a refrigerant thanks to global warming.

poontangpoo 18 minutes ago | parent

well that will be explosive!

pjmlp 27 minutes ago | parent

Another good example why writing secure software matters in the age of connected devices.

flohofwoe 20 minutes ago | parent

Of course the bigger question is why a refrigerator is even a "connected device".

arwineap 16 minutes ago | parent

So they can monitor if something goes wrong, have a tech troubleshoot and deploy with the right parts.

Modern HVAC and fire control b systems for buildings are often connected now as well

flohofwoe 8 minutes ago | parent

Yes it was more of a rhetorical question, e.g. maybe we need to rethink that whole idea of plugging everything into the internet and instead go back to air-gapped "local area networks".

It also wouldn't be a big deal when a supermarket employee makes an old-fashioned phone call (gasp!) to the refrigerator service company when some red light starts blinking ;)

pjmlp 16 minutes ago | parent

Because it is cool! (pun intended)

For the same reason, we hardly have heating meters in Germany that aren't wireless connected to the maintenance company.

To save costs doing maintenance trips to check their state.

Jamesbeam 21 minutes ago | parent

Only three more Russian datacentres to go, and Belgians won’t be the only ones eating each other again this winter.

AndrewThrowaway 20 minutes ago | parent

My first idea was "who the hell needs connected fridges".

Then I remembered that both my AC and floor heating are connected.

A hacker could easily turn on both AC and floor heating and cause me a few euros of damages in my electricity bill.

driverdan 6 minutes ago | parent

who the hell needs connected AC and floor heating?

floatrock 5 minutes ago | parent

Or keep duty-cycling the units until the pumps burn out...

anilakar 10 minutes ago | parent

> cyberattack, which has hit Danfoss-made refrigeration controls

Danfoss AK-SM 720 or 850? Pull the ethernet cord, now.

The latter can be flashed with the new 800A series firmware which is safer, but I still would not put it on the public internet under any circumstances.

fennecfoxy 3 minutes ago | parent

I wonder if AI would have helped in this situation.

For example [request to defrost n fridges in y locations]->[agent cannot find any emails or business communications about this and last defrost report was only a short time ago, contacts z personnel]->defrost task moved to manual confirmation by a human.

I know many will roll their eyes and "tchh" at it but look at number of AI related topics on HN front page and think to yourself if you're tired of this tech not being used for real applications or not. This would be a real application.

"But it could be tricked" well...regular requests can apparently already be hacked, so...