YHK - yet another hacker news clone

French supermarkets suffer fridge shutdown after 'unprecedented' cyberattack

146 points thinkcontext 2 hours ago 141 comments

mneil 2 hours ago | parent

This is terrible. But, at the same time, why now? This seems like something you'd want to hold onto for use later as a nation state. And there's no money to be made here since you can't really ransom it. Was this just a petty attack to scare the public?

On the bright side I'm sure the manufacturer and others will have an increased security posture going forward.

psychoslave 1 hour ago | parent

Script kiddies are on LLM steroids now. I’m so glad I kept my home "smart" stuffs fully disconnected from any network. No, I can’t control my home temperature from the other side of the world when in vacation, and so can’t the rest of the world until they physically enter it.

bambax 1 hour ago | parent

I think that's exactly what happened. A kid found out (via an LLM or otherwise) that fridges' temperature were remotely controlled, probably with lax security (or no security at all) and decided to play with it.

It's not immediately obvious to me why fridges in supermarkets need remote control; a supermarket is a place where there are always people, it's not a base on Mars. And even if a remote is needed, it should probably not go further than the manager's office.

Shank 1 hour ago | parent

> It's not immediately obvious to me why fridges in supermarkets need remote control

I don’t know to what degree control is needed, but remote supervision of cold holding temperatures is good to make sure food doesn’t spoil. Most places that don’t have networked fridges have staff manually logging the cold holding temperatures to make sure things are working.

Again, though, I don’t know about making changes though.

bambax 1 hour ago | parent

In this case it's not like the devices were turned off, they were put on "defrost" which means heating up to 50°C (122°F). Why would you need the ability to remotely set all your fridges to defrost??

amluto 1 hour ago | parent

One possibility is that it’s maybe useful for the fleet operator to be able to remotely update firmware and the attacker used that.

The other, more likely, answer is that there’s a diagnostic mode that allows raw control of the system and no one bothered to require physical presence to enable service mode.

With remote firmware update capability, at attacker could easily brick the entire fleet. With just service access it could be possible but would be more complex.

bmilleare 1 hour ago | parent

I remember having to do this every few hours 25 years ago when working at a store part-time as a student.

Having networked telemetry seems like a good idea, just not sure why they would need remote control too - that seems far more dangerous than necessary.

queenkjuul 1 hour ago | parent

15 years ago a retail chain i worked for had all their HVAC thermostats centrally managed by corporate. This isn't new and it is stupid but how else do you ensure shareholders keep every possible cent of profit (in the short term of course)

newsclues 1 hour ago | parent

Who benefits from chaos? There is a war raging in Europe, maybe start there

ungreased0675 1 hour ago | parent

Exactly. This is fifth generation warfare.

newsclues 1 hour ago | parent

Unrestricted warfare is a book more people read to be aware of

dist-epoch 1 hour ago | parent

You assume there must be some nation state behind it.

But it could be just for the lulz.

Remember the hackers behind the seven proxies, AntiSec, which hacked the NATO library website, and went to prison for it.

https://en.wikipedia.org/wiki/Operation_AntiSec

queenkjuul 1 hour ago | parent

Manufacturer abdicated saying those models are no longer supported and so not receive security updates.

Wonderful world we live in where refrigerators and cars also become e-waste because a manufacturer gets tired of patching them

esseph 42 minutes ago | parent

> Wonderful world we live in where refrigerators and cars also become e-waste because a manufacturer gets tired of patching them

We're in a "post-patching world" in that the number of 0days coming out is so rapid, I'm not sure it would even matter.

The physical architecture itself is the problem. There needs to be better controls (physical and software) to access those systems. Airgap possibily.

pvaldes 1 hour ago | parent

> why now?

Probably to inflict pain on the life of the voters so they can blame the government and manipulate the 2027 French presidential election in April. Maybe just a test.

Same as the high velocity train being sabotaged again just in the Spain national day. Hybrid war.

input_sh 39 minutes ago | parent

Come election day, do you really think many people's deciding factor would be a supermarket refrigerator incident from half a year ago? Especially considering that around the same time something far more... shall I say politically meaningful was happening at the same time, such as students protesting the lack of school funding?

pvaldes 7 minutes ago | parent

[delayed]

AnimalMuppet 1 hour ago | parent

> On the bright side I'm sure the manufacturer and others will have an increased security posture going forward.

Wow, are you an optimist. The manufacturer has stated that they're past the period of security updates. And others... meaning the supermarkets? They outsource that. The people they outsource it to? Maybe they'll start paying attention to security.

codedokode 22 minutes ago | parent

> On the bright side I'm sure the manufacturer

I initially misread it as "On the bright side, I'm the manufacturer..." (and earn a nice profit).

abosley 1 hour ago | parent

Same (an outage) happened to the US military commissary system https://www.stripes.com/theaters/us/2026-09-01/army-cid-inve...

linuxguy2 49 minutes ago | parent

I was hoping there would be more discussion about the overlap of these two events.

vkou 44 minutes ago | parent

The overlap between those two events is that digital security sucks ass and that attacks are much easier to mount in an era of agents.

drummojg 41 minutes ago | parent

I can see advantages to collating data for both organizations, but to it just raises the question, once again, of why simple appliances are connected to the Internet.

vkou 23 minutes ago | parent

1. There's nothing simple about a commercial HVAC install, especially across a national chain.

2. Because they think (rightly or wrongly) that the benefits of monitoring and ease of maintenance and their contractor having direct access to the data outweigh the risks.

3. They think it outweighs the risk because IOT has been socially normalized, creating the wide perception that no, it's not that bad.

They almost certainly have insurance for this kind of event, and their insurer will almost certainly think real hard about the pros/cons of this, and will adjust rates accordingly. The grocer is free to take those rates into account when deciding on whether their next store will have an IOT HVAC.

red_admiral 23 minutes ago | parent

That, and why there's not a company VPN in between.

vkou 19 minutes ago | parent

Because a main user of this is the third-party HVAC contractor, and there's a operational cost to getting him set up on the grocer's VPN. (He has thousands of clients, that's in aggregate a lot of customers that would need to give him VPN access. He will do whatever the client asks of him, but he will bill accordingly.)

swarfield 1 hour ago | parent

Why the fuck are those fridges even networked!?

dfxm12 1 hour ago | parent

To monitor when something like this happens...

ceejayoz 1 hour ago | parent

Centralized maintenance and monitoring?

christophilus 1 hour ago | parent

It seems like the sort of thing you’d do in-store and firewalled from the internet.

layer8 1 hour ago | parent

You’d have to pay competent local staff for that.

asdff 1 hour ago | parent

How do you think grocery stores worked pre internet?

ceejayoz 43 minutes ago | parent

Lots of things worked pre-internet that now rely on internet in ways that would be rather chaotic and messy to undo.

pixl97 8 minutes ago | parent

You're going to have to convince VC and PE to give up the massive profits they're raking in.

lenerdenator 1 hour ago | parent

"That, like, costs money, man. The accounting department said there was a 1-in-100 year chance of this happening if we didn't shell out, so we didn't." - the CEO, probably.

esikich 1 hour ago | parent

The article didn't say they weren't.

pavel_lishin 1 hour ago | parent

Monitoring makes sense, but it feels like it makes no sense at all to allow that kind of remote maintenance without staff on-site to OK and verify it - who could then do the maintenance themselves.

Otherwise, this sort of spoilage could easily happen by accident as well.

esikich 1 hour ago | parent

Supermarkets don't staff HVAC/fridge repairmen. There are separate companies they pay to do this.

queenkjuul 1 hour ago | parent

Right: and someone from that company can come out and do maintenance when the monitoring indicates it's necessary

vkou 40 minutes ago | parent

When, say, your internet craps out, would you rather your ISP try to resolve the problem, or schedule to send a tech out to your home before they start working on fixing the issue?

Groceries see HVAC in the same way. If they can get their issue addressed or diagnosed by their HVAC contractor without him having to schedule and physically travel to their site, they'd prefer him to solve/start solving the problem immediately. Time is money and the faster the tech can diagnose the problem, the faster he can get on fixing it.

And yes, the prevalence of these systems means that many HVAC techs have the ability to turn off their customers' air conditioners/fridges. They don't use it maliciously, because that would be actual suicide for their business.

---

Source: A close friend of mine runs an HVAC business (~8 employees) doing residential and commercial installs, repairs, and maintenance.

blitzar 50 minutes ago | parent

> remote maintenance without staff on-site to OK and verify it - who could then do the maintenance themselves

These are minimum wage workers - they don't have bean bags in the nap room, employee massages and stock options.

swarfield 1 hour ago | parent

Makes sense but monitoring doesn't mean you have to have remote control of power.

ceejayoz 1 hour ago | parent

"Utility has alerted us to an upcoming brown-out in a region impacting 40 stores. Cool everything down a few extra degrees in preparation."

mrob 31 minutes ago | parent

A phone call from the HVAC company and physical thermostat dial (in a locked cabinet to prevent incompetent/malicious employees tampering with it) seems a safer solution.

pixl97 4 minutes ago | parent

And when it happens at 3 in the morning? And when those people are in a meeting 10 miles down the road?

Take away the security aspect and centralized management is just so much easier and reliable. Humans suck at doing things they were supposed to.

asdff 1 hour ago | parent

That might justify a temperature probe in a dumb fridge. This smells of a salesman being here not an engineer though.

codedokode 42 minutes ago | parent

And centralized food destruction.

faidit 1 hour ago | parent

None of the supermarkets were managed by Commander Adama, apparently.

ivewonyoung 1 hour ago | parent

So you can get a notification when the milk expires.

esikich 1 hour ago | parent

Because they need remote monitoring. I have experience with HVAC so I'm guessing these are similar: typically outsourced to a third party, typically a VM running on a dedicated server, accessible by Citrix or something similar. Supermarkets don't internally staff fridge repairmen.

asdff 1 hour ago | parent

They could just use connected temperature probes though. no need to connect the power supply of the damn compressor to the internet.

pixl97 10 minutes ago | parent

A lot of these devices are temperature controllable as the product in them may require different temperatures. They can have temperature ranges from refrigeration to freezing.

Also adjust power usage depending on time of day and such.

adverbly 43 minutes ago | parent

You don't need to network the fridge though... You just need a networked sensor...

esikich 4 minutes ago | parent

That's assuming you just need to maintain a static temperature, which probably isn't the case.

quickthrowman 1 hour ago | parent

They aren’t fridges, it’s a grocery store. You have obviously been in one, there are cases with a dozen doors that all open to the same cold case.

There is a ton of refrigerant piping, multiple condensing units, multiple evaporators, relays, and sensors connected to a controller that automates the refrigeration system. Not standalone refrigerators.

I shouldn’t need to list the benefits of remotely monitoring a system that can cause tens or hundreds of thousands of dollars if it fails.

forgetfreeman 30 minutes ago | parent

Given the perfectly workable alternative of not having remote monitoring and simply having the store manager contact a repair tech on the exceedingly rare occasion that there is an issue, yeah I think actually you do need to justify the added complexity and expense of making this kind of mundane equipment internet accessible.

SoftTalker 20 minutes ago | parent

From my experience in a restaurant, those large commercial rooftop refrigeration/freezer units need attention several times a year. It's rare that your home fridge would have trouble that often but commercial units are more complicated and in a harsher environment. And supermarket installations are probably even more complicated.

bigbadfeline 1 hour ago | parent

Wait until people living north of Chicago learn that their thermostats are remotely controlled, when it's -20F outside.

neilellis 1 hour ago | parent

Claude had munchies....

asdffdasy 45 minutes ago | parent

"claude, make better use of eletricity costs. stop services not required for the task. make no mistakes"

stackghost 1 hour ago | parent

Please, let this be the stone that starts the avalanche of consumers rejecting smart apppliances.

My fucking fume hood on my stove has Bluetooth, because Samsung just can’t help themselves apparently.

brown9-2 1 hour ago | parent

Why would this time be any different than the last hundred times?

qurren 1 hour ago | parent

Honestly I like smart appliances. For example, I have a home assistant integration that will sound an alarm if a stove burner is on but no person is detected in the room, and a handful of other similar safety-related conditions.

But they don't need to be cloud-connected through some big corp's cloud. I want them local and firewalled, ideally.

EliRivers 1 hour ago | parent

sound an alarm if a stove burner is on but no person is detected in the room

Can you turn that off or do you just have to put up with the noise?

qurren 30 minutes ago | parent

It's a situation that shouldn't happen in the first place; house rule is someone should be around if the stove is on.

Of course we can control it, it's all wired up via Home Assistant.

irishcoffee 1 hour ago | parent

I prefer the freedom of putting a pot of water on to boil and walking off to take a leak, personally. That would drive me absolutely insane.

qurren 26 minutes ago | parent

1. We prefer to be safe, and shut the burner off while going to take a leak. It helps that we have a several thousand watt induction stove that boils pots of water in a few minutes, so there is no real need to parallelize boiling water with bathroom breaks.

We specifically want to prevent scenarios like: you take a leak, the leak turns into a shitting session or a phone call, you forgot you left the burner on.

2. Most of the time my wife and I make food together so if one person needs to take a leak the other one is around anyway.

3. For long slow cooking, we have plenty of comfy seating in the kitchen/dining area where we can get work done while being in sight of pots.

4. We have 2 pets we'd need to locate in an emergency, and so we tend to put electrical and fire safety higher than most people.

asdff 1 hour ago | parent

What compelled you to buy a stove hood with a cpu and blutooth radio?

stackghost 1 hour ago | parent

It was there when we moved in.

asdff 1 hour ago | parent

Would have been a red flag for me on the apartment tour haha. I once leased a place like this. Paid app needed to receive packaged mail. Never again.

sdcfgy 1 hour ago | parent

Why the fuck does a fume hood need that?!?!?!?!

stackghost 1 hour ago | parent

Exactly!

palmotea 1 hour ago | parent

> Why the fuck does a fume hood need that?!?!?!?!

Why, so you can turn it on from your smartphone when you're out of town, of course!

djeastm 48 minutes ago | parent

"Oh, Honey, I think we forgot to turn the stove off!"

"Well, I can't help you there, but I can turn off the fume hood from my phone!"

"..."

url00 48 minutes ago | parent

But it's Bluetooth so short range only? So it's not even good for that?

astrobe_ 1 hour ago | parent

I don't disagree, but having remote monitoring capabilities on a professional fridge is most likely not a hipster feature. Even mid-size supermarkets have dozens of them, with different temperature settings; they can fail, customers can block the doors, etc. You do want to receive an alert when something is wrong.

codedokode 45 minutes ago | parent

Those devices should be connected to air-gapped local network and not to manufacturer.

red_admiral 20 minutes ago | parent

These are industrial fridges, the ones almost the size of a shipping container that you find in major supermarkets. But I agree with you that 'smart' home IoT is a shitshow.

jsrozner 1 hour ago | parent

Instead of climate change, let's call it "cyber change"...the rise of hacks of all kinds facilitated by AI

hn_throwaway_99 1 hour ago | parent

This is literally everything that's wrong with the modern tech industry in a nutshell:

> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

They sell fricken refrigerators for God's sake. Maybe I can understand planned obsolescence for a cell phone, but a fridge? And especially to grocery stores that operate on razor thin margins to begin with, the idea that they'll just dump their old working refrigerators because the manufacturer refused security updates is a guaranteed recipe for stuff like this.

quickthrowman 1 hour ago | parent

Grocery stores do not use standalone refrigerators, I’m not sure why I have to keep repeating this fact when every single person has been in a grocery store and seen refrigerated cases that have a dozen or more doors.

They use cold cases and have rooftop or outdoor condensing units and evaporators inside of the cold cases/freezers/etc. There’s refrigerant piping running all over the place and there’s a bunch of sensors and relays that are automated to manage the refrigeration system.

My assumption is the Danfoss control system they’re using is EOL, it’s the grocer’s responsibility to upgrade their automation equipment if it’s unsupported.

jt2190 1 hour ago | parent

I assume you’re talking about a system like this:

https://www.danfoss.com/en/industries/food-and-beverage/dcs/...

lowbloodsugar 47 minutes ago | parent

“God news shareholders! We have decided that we didn’t make enough sales this quarter so we have EOLed a whole range of products!”

quickthrowman 36 minutes ago | parent

I understand you’re being sarcastic, but yes, eventually technology gets better so a manufacturer refreshes their product line. This is extremely common in many industries.

lowbloodsugar 20 minutes ago | parent

"French supermarkets hacked because this is common in many industries". Maybe it should not be common? Maybe selling internet connected industrial plant means those things must be supported forever?

mrob 44 minutes ago | parent

That doesn't excuse them being controllable over the Internet. I can understand that remote monitoring is important, but it's in a supermarket. There's always going to be somebody on site who can control things locally. The telemetry can be transmitted via data diode, automatically re-transmitting on schedule so there's no need for any remote control.

quickthrowman 33 minutes ago | parent

> There's always going to be somebody on site who can control things locally.

No, there is not always someone onsite with the experience and knowledge to monitor and change the system. Grocery stores do not have staff refrigeration techs onsite, they contract that out.

mrob 26 minutes ago | parent

There's always going to be a manager with access to keys. They get the HVAC tech on the phone and set the controls as instructed. They're still vulnerable to somebody scamming them into setting the controls wrong, but they at least have a chance of recognizing who they're talking to, and recognizing obviously crazy instructions (e.g. "turn the thermostat up to 50 degrees"). And even if they don't, the attack is a lot harder to scale with a human in the loop.

bob1029 41 minutes ago | parent

I'm with you on the remote monitoring but why do we need remote control?

Dispatch an HVAC tech if an alarm comes up. Physical access should be the only way to shut down a system like this.

quickthrowman 30 minutes ago | parent

> Physical access should be the only way to shut down a system like this.

Your opinion does not change the fact that virtually every automation system can be access remotely. It can be done safely with proper access controls.

sergdigon 38 minutes ago | parent

No need to make assumption here, the article says it clearly:

> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates". It said its AK-SM800 and AK-SC355 fridge regulator systems were notably affected, with a version of the former using "outdated firmware". It added that it had long advised supermarkets to update from those models.

That being said I am curious what is typically the amount of time for software support offered on a newly released equipment and how common it is for super market to use obsolete software (especially for the part which carry some security risk like something with remote control). Also what about the insurance? Will they (fully) cover the financial loss? I don't know what is in their insurance contract and I am not a lawyer but it seems to me that using obsolete software make the supermarket responsible to some extent

MC995 8 minutes ago | parent

> how common it is for super market to use obsolete software (especially for the part which carry some security risk like something with remote control).

It's a near guarantee. I've been in dozens of power plants where the engineering workstations or operator interface terminals are running Windows XP or Windows 7. More than zero of which were not properly air-gapped. If those sites (with sizable CapEx budgets) delay upgrading for various reasons I would expect grocery store chains to keep whatever they have running until it's broken to the point of not being fixable without a complete overhaul.

zer00eyz 1 hour ago | parent

I have to question why this control system was even in place.

I could see remote monitoring (of temps) and logging on the system (cycle time etc) but does one really need to control the defrost cycle? It's probably just a web interface on a single controller that used to be accessed by HVAC techs only.

> > "legacy" products which "no longer receive software or security updates".

Because it's the EU I have to wonder if they will finally mandate that software go into escrow and be released if support stops.

isodev 40 minutes ago | parent

> Because it's the EU I have to wonder if they will finally mandate that software go into escrow and be released if support stops.

Hopefully it will extend to consumer tech like iPhones and other “waste as soon as {corp} is done with it”

_ache_ 56 minutes ago | parent

It is a way to move the responsibility to the "users".

But the hack has already been disclosed and it's the responsability of the manufacturer to ensure that the fridge keep ever up to date or offline.

As with the USA Defense hack, it could have been prevented.

The hack: https://blog.claroty.com/team82/research/freeze-the-controll...

hn_throwaway_99 40 minutes ago | parent

Ugh, this is even worse. The vuln was just disclosed a couple months ago, and so it was literally just a matter of time if not all systems were patched.

I can't for the life of me understand why these systems aren't air gapped, or at the very least network access is restricted to a small number of IPs or hardware keys.

matthiasl 5 minutes ago | parent

Danfoss are quoted as naming two systems, AK-SM800 and AK-SC355.

AK-SM800 looks like a current product. Danfoss have a PDF dated 2026.06 about it: https://assets.danfoss.com/documents/latest/590332/BC3376298.... This mentions "All new Electronics platform supporting new Operating System (based on Linux)", and specifically advises against connecting it to the internet.. Reading between the lines, especially section 10.5, it sounds like there was a major security revamp in 'release 4.0'. The article mentions "outdated firmware", so perhaps that refers to things before 4.0.

AK-SC355 looks like a product from 2010 (that's the date in the PDF metadata, plus the examples in the manual mention 2009). https://3.imimg.com/data3/ID/LC/MY-3170595/danfoss-system-ma...

I haven't worked with supermarket control systems, so I only know what I've read in the PDFs, but it looks like this is not about throwing out entire fridges to update the control system. If you have the newer AK-SM800, it looks like the suggested action is to update firmware and follow instructions about keeping it well away from internet access. If you have the older AK-SC355, then keeping it away from the internet is even more important. Or, update to AK-SC355.

Aarostotle 1 hour ago | parent

Maybe the agent swarm passed its “warmth” eval.

throw-the-towel 1 hour ago | parent

How in the name of fuck was a fridge even designed to be able to heat itself to 50 degrees C?

gizajob 1 hour ago | parent

I thought that. Now looking for the heat setting on my fridge. I guess it’s in case you need to antifridge sometimes.

dn3500 1 hour ago | parent

It's probably just running the heat pump in the other direction. 50° sounds about right for the hot side. I expect that the hotter the better, because it will melt the frost without warming the food. And if a bad guy hacks in to the freezer, he can probably override any kind of temperature control and just tell the compressor to run full out.

zacharycohn 1 hour ago | parent

Every refrigerator has a defrost cycle - which is just a heater. It normally only runs for a few minutes at a time, but if you change some bits around, it could run for a lot longer and a lot hotter.

alwa 1 hour ago | parent

Fridges tend to have built-in defrost cycles these days. Without that, ice builds up around the coils that ordinarily cool the compartment (and by extension the ambient moisture in the air, encouraging it to condense). And you'd have to thaw it yourself from time to time.

0x4e 1 hour ago | parent

I think it's important to see if this could happen on a larger scale. What if it wasn't only French supermarkets but also important supply chain chokepoints of food worldwide? What would happen to food prices?

stickfigure 1 hour ago | parent

There is probably enough variety in refrigeration technology that this scenario is unrealistic. There are many tens to hundreds of manufacturers worldwide.

pipsterwo 50 minutes ago | parent

Similar issue affected a US military base very recently. Multiple manufacturers doesn't help if they source the same components.

codedokode 47 minutes ago | parent

By the way, Soviet refrigerators are immune to this type of attacks.

vincnetas 34 minutes ago | parent

because they are empty?

codedokode 29 minutes ago | parent

Obviously, because they cannot be controlled over Internet. Also, some consumer Soviet refrigerators are still operating, they were made pretty reliable because one could not easily replace one.

timjver 47 minutes ago | parent

>What if it wasn't only French supermarkets but also important supply chain chokepoints

The largest supermarket chain in the Netherlands has currently halted most of its distribution centers due to an ongoing "cybersecurity incident": https://nltimes.nl/2026/10/12/empty-shelves-likely-albert-he...

srik 1 hour ago | parent

These incidents will bring back the appeal for dumb appliances, hopefully.

forgetfreeman 15 minutes ago | parent

There's a marketing issue here that would need to be addressed first, namely the phrase "dumb appliance". That's a marketing slur that was intentionally propagated by manufacturers and it's bullshit. Few things seem more obviously stupid than the added complexity, expense, and security concerns associated with "smart appliances" especially given none of the features touted are critical to the appliance performing it's stated function.

SpicyLemonZest 53 minutes ago | parent

> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

I worry that this kind of thing is going to be a recurrent problem. A lot of people have pretty strong intuitions, or even an explicit moral position, that they should never have to upgrade a physical machine that's working fine. Is there a threshold of vulnerability that will overcome that, or are we just going to see a lot more hacking of random infrastructure from now onwards?

robinsonb5 41 minutes ago | parent

I'd hope what we'll actually see is people finally demanding that appliances with no need of an internet connection don't get connected to the internet!

alphawhisky 38 minutes ago | parent

I mean, you could also argue that the lack of reliance on physical controls caused the incident in part. For example, a City's public works department may have remote access/control for some of their equipment, but they also have a kill switch that removes all connectivity and reverts the system to a default setting. They also have checks in place like "if the unit heater will be overamped, turn it off." This seems like it was caused by a lack of security considerations when making these devices "online". Old tech can work very well for a long time as long as it is modernized correctly.

dopa42365 23 minutes ago | parent

Would such a thing even be covered by insurance? Or is it negligence for using a product after it might turn into an unstable bomb at any time?

On the other hand, wild that it doesn't revert to some sort of offline backup mode after warranty ends. Or that anyone bought it in the first place (that can't be standard in the industry, right?).

umeshunni 21 minutes ago | parent

I would expect a refrigerator to work 20+ years. What does a legacy product even mean this situation?

ChrisArchitect 49 minutes ago | parent

[dupe] https://news.ycombinator.com/item?id=50055304

codedokode 48 minutes ago | parent

What genius decided to connect a fridge to the Internet? Make him pay the losses.

By the way similar thing might happen to geniuses buying Internet-connected cars.

ronnier 39 minutes ago | parent

Offtopic: I only see "genius" used these days to describe an idiot. I guess this is how words change meaning over time. At some point in the future being called a "genius" will always be seen as pejorative.

codedokode 32 minutes ago | parent

There should be a name for this style of speech, using "good" to mean "bad".

saimiam 28 minutes ago | parent

Irony? Camp? “genius is a camp - so good that it’s bad”. “In the sentence ‘this is the sh1t’, ‘sh1t’ is camp - so bad that it is good”.

akoboldfrying 27 minutes ago | parent

Sarcasm

saimiam 31 minutes ago | parent

Genius take!

fusslo 28 minutes ago | parent

just like 'Nimrod' becoming an insult

crossroadsguy 17 minutes ago | parent

That's because calling an idiot an idiot plainly is apparently considered uncouth and attracts downvotes, flags and downvotes often mean oblivion. In fact you will find do-gooders chome in with "be civil" but you flip the word and it's all kosher. The thing is all of us do and say idiotic things. So that makes a bit tricky indeed.

> in the future being called a "genius" will always be seen as pejorative.

If you are not a genius and someone calls you a genius, well, for you the future is already here, genius! (Shit I didn't really mean that :P)

vincnetas 35 minutes ago | parent

people who like saving money decided to do this. For simple monitoring purposes. When you have thousands of fridges you want to know how their doing and you don't want to sent a person to inspect each one of them.

codedokode 33 minutes ago | parent

You could connect to an on-premise server. As a bonus, the manufacturer cannot disable them and extort money in this case.

fusslo 29 minutes ago | parent

If the only usecase is monitoring, then why make the fridges anything else but report-only?

No firmware updates. no admin configuration. no ssh backdoors. just a transmit-only system

luckydata 21 minutes ago | parent

because the report code might have bugs

AlotOfReading 16 minutes ago | parent

If it were transmit only, you could put it behind a data diode and buggy report code wouldn't matter. Even better, validating the code is a lot easier if it doesn't accept attacker input.

dietr1ch 32 minutes ago | parent

Monitoring requires one-way announcements, not bi-directional connections

moi2388 44 minutes ago | parent

The same happened to a major Dutch supermarket chain.

Seems a coordinated attack, perhaps not coincidentally on the day the US supreme NATO commander gave a speech about the defence against (hybrid) attacks.

jtchang 39 minutes ago | parent

So tossing out an idea:

What if all manufacturers had to classify their product into internet connected i.e. smart or not. We mandate that manufacturer has to support updates for minimum 5 years or firmware source goes public. Have them put firmware source in escrow as well as have a way to update it.

If a manufacturer wants to reduce their liability then they have to release something to make it semi publicly supportable. With AI agents these days patching the firmware might one day be trivial.

Put some penalities with teeth behind this and maybe manufacturers will think twice before making everything smart.

vincnetas 37 minutes ago | parent

You suggest that supermarket fridges should not be connected to network?

red_admiral 16 minutes ago | parent

On the one hand, this might be an escalation of a war below the threshold of "Europe orders general mobilisation". On the other hand, it seems that you just have to sneeze in the general direction of anything 'cyber' to cause an incident, shame on us if we can't get very basic security in order.

WalterBright 6 minutes ago | parent

These vandals are what creates a low-trust society, where everybody needlessly suffers.

I remember working on my car when I lived in an apartment. I'd take my tools out into the parking lot, and get to work. If I needed to use the potty, or get a snack, or whatever, I had to pack up the tools and take them inside. Then out again. It really stinks.

I currently live in a high trust neighborhood where I don't need to be present with anything outside.

It's so much better.

csvm 3 minutes ago | parent

Here's a fix:

if(temp > 5) return;