Yet another Hacker News

Supermarket freezers in Belgium and Sweden hit by suspected cyber-attack

65 points xqcgrek2 1 hour ago 61 comments

noja 1 hour ago | parent

Will the insurance pay out on this? It would be negligent to have this exposed to the internet - was it?

kleiba2 1 hour ago | parent

Especially given the recent precedence of hacked freezers.

mariopt 55 minutes ago | parent

That's an interesting angle, that would explain why some bothered to hack fridges and waste food.

pluc 1 hour ago | parent

Ireland too: https://news.ycombinator.com/item?id=50335252

ocd 1 hour ago | parent

I've fantasized a long time about a clearer separation of technology from life, since it's been depicted in some ways I appreciated in fiction. But at this point, I'd just take a set of laws around what types of items should ever have any sort of networking.

forlorn 1 hour ago | parent

I believe it's industrial protocols used to connect such devises to a SCADA system. It this case it's the SCADA system that has to be disconnected from any general purpose networks.

Proziam 1 hour ago | parent

The freezer itself doesn't need to connect to a SCADA. You can network power and temperature monitors, but those monitors don't need the ability to shut off the freezer.

These freezers are manually stocked and cleaned. If they need to be powered down it's a simple matter of a hardware switch that you flip when the unit is empty.

wronglebowski 1 hour ago | parent

It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?

ElProlactin 1 hour ago | parent

What makes you think Europe is uniquely vulnerable?

DC-3 1 hour ago | parent

In fairness they probably don't tend to use internet connected freezers in Africa.

afroboy 1 hour ago | parent

I live in Africa, still amazed by the idea of connected freezers haha. Didn't know it exists out there.

cyanydeez 1 hour ago | parent

The problem is the ironic "home grown" or "internal" security. These external attacks come after decades of fertilizing far right white politicians whose sole purpose is to dither any directed anger.

Brexit was the first to burst and despite their support of Ukraine, can at any moment capitulate to the ghost of nationalism and delusional escapism that is "white power". Americas on the verge of sinking further into the same. With those two entirely preoccupied, of course europe is next and already has the same underlying current.

traceroute66 1 hour ago | parent

> It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?

I'm quite sure your average American company is just as willing to plug random shit into the internet.

Hell, there are probably hundreds of reports out there of American companies failing to secure their AWS S3 buckets, so you don't even have to plug anything into the internet.

ElProlactin 1 hour ago | parent

Your average American company is running on China.

2000UltraDeluxe 1 hour ago | parent

It would take people listening to professionals and getting rid of several decades worth of bad habits amongst users. Same as most other places really.

kzrdude 1 hour ago | parent

It happened in France on 12 October: https://www.bbc.com/news/articles/crq5nzxv9q4yo

ilkkao 1 hour ago | parent

This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time. Or to take the freezers offline if an update isn't available.

I now read some interviews with local chains in Sweden and Finland, and they were still just investigating what to do at this point.

pumba_noob 1 hour ago | parent

Why do supermarket freezers need to be on the internet in the first place? A freezer has one job right.. keep things cold :/

sevenzero 1 hour ago | parent

Likely so that stores can be monitored remotely. A lot of supermarkets have a centralized orchestration somewhere, especially big chains.

oblio 1 hour ago | parent

For commercial uses some kind of global monitoring is not super crazy. Regular retail freezers being on the internet, that's the crazy talk.

xattt 1 hour ago | parent

If they want to get their pubic-facing remote monitoring jollies, why not implement ro access?

oblio 7 minutes ago | parent

> pubic-facing remote monitoring jollies

Those freezers seem to be having lots of fun :-)

fifilura 1 hour ago | parent

But why can they control the temperature then?

If I put a Zigbee thermometer in the freezer they can hack it all they want, but I am pretty sure they will not be able to set the temperature to 50C.

hahn-kev 56 minutes ago | parent

Read access, sure. But being able to turn them off?

mrob 55 minutes ago | parent

Monitoring doesn't need write access. RS-422 is simple and reliable. It uses separate receive and transmit pairs and you don't need to connect both. The freezer can continually transmit its telemetry over unidirectional RS-422 and a separate system can forward it over the Internet.

Hackers can still tamper with the telemetry and create false reports of problems, but actually changing the thermostat settings would require local access, so there's opportunity for somebody to verify the problem really exists.

dhx 59 minutes ago | parent

Completely speculating as I don't know the situation in Europe, but some possible reasons are:

- Remote alerting for the store manager/head office to quickly respond to a refrigerator failure after hours, providing options for saving valuable stock (e.g. move stock to another refrigerator).

- Maintaining an audit trail for cold chain management (e.g. regulator says you must keep an audit trail proving that a frozen fish has been kept below -30oC since it was processed on a ship all the way up to point of sale in a supermarket).

- Refrigerator manufacturer says a condition of warranty is that the refrigerator must provide remote telemetry proving some warranty condition has been met (e.g. regular cleaning cycle operated).

Note: all these speculated reasons are unidirectional data flows. So even if a valid reason exists for Internet connectivity, why can't it be limited to unidirectional data flows?

Symbiote 54 minutes ago | parent

Also so the temperature can be controlled to make use of cheaper electricity — if you know it's going to be windy from 02:00 to 04:00, then still until 06:00, you can run the freezers a bit extra while the electricity is super cheap.

antisol 24 minutes ago | parent

Those might be reasons for them to be connected to a network. They are not reasons to connect them to the internet

rocqua 56 minutes ago | parent

On top of the monitoring mentioned by others, it's also to create a centralized log of actual temperatures. This then lets you show inspectors that you are keeping up with refrigeration requirements.

mrob 33 minutes ago | parent

Creating a centralized log is monitoring. It doesn't need write access to the defrost setting.

belorn 8 minutes ago | parent

What I read from the last wave is that supermarket changes how cold freezers will run depending on how much customers they expect that will open and close the doors. Just having the freezers adapt based on the temperature of every single moment cost too much electricity or can result in unsafe temperatures.

prepend 3 minutes ago | parent

I don’t know about supermarkets but for medical freezers it’s useful to be online for monitoring and calibration.

My org has lots of freezers that need to be at precise temperatures. Sometimes they drift so you have to check them a few times per day, log the check, and adjust as necessary. Doing this for a thousand freezers is tedious and error prone. Networking helps. “Cloud” lets it all be done remotely without getting IT very involved for vpns to be set up with specific vendors. It also helps with patching and auditing security so seems odd that these supermarket ones were out of date.

Aboutplants 1 hour ago | parent

Yeah was about to say, if your a major chain this is on you

tclancy 1 hour ago | parent

Has anyone determined if these were separate from the attacks on US military PX refrigeration that happened well before that?

holsta 1 hour ago | parent

In the case of France, the vulnerability was announced in August, 2025.

I believe gigantic fines are appropriate. They need to be of a size where the entire management team has significant financial issues for many years to come, even after having sold their houses, big cars, etc.

Nothing will improve until there are personal consequences.

xoa 56 minutes ago | parent

>Or to take the freezers offline if an update isn't available.

Why the heck would this be necessary? We have VPNs holy crap, the entire genesis of the technology was to solve this fucking problem. If it's not literally intended for the general random public to be able to randomly visit and use themselves, it shouldn't be exposed on the public internet it should be (heavily restricted) LAN-only with remote access done via VPN. While it's even better if every single last thing is well secured at the client-level too, it goes a long way with ancient (or new, but with ancient-equivalent software design expenditure/decisions) kit to protect it at the network level.

Creating a false binary of "take it offline!" when businesses have very good reasons for networking many classes of industrial hardware seems self-defeating vs "just get the cheap bare minimum basic network protection done". I mean shit, even if somehow they've gotten suckered into freezers which demand access to a non-self-hostable manufacturer server (hey EU! here's something useful to regulate! if nothing else order manufacturers to have WireGuard end points for connection) they could at least have the firewall allow !RFC1918 solely and exclusively to that address on those ports.

lrasinen 47 minutes ago | parent

Yes, VPNs would be the correct solution.

However, we're talking about companies that put unprotected systems on the public network and did nothing about it even after getting three weeks advance warning.

fifilura 15 minutes ago | parent

Seems like the biggest chain in Sweden, ICA, had a VPN. They were affected but only the franchise takers that were (for whatever reason) outside their internal network.

vlachen 45 minutes ago | parent

I do work in the retail refrigeration world nowadays and "just updating the software" is much easier said than done. I'm usually touching grocery stores with 20+ year old hardware from the dawn of centralized control and monitoring. It's not s trivial thing to rip out the controllers and install new ones.

Caloric3002Swed 39 minutes ago | parent

Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

nkrisc 30 minutes ago | parent

Sounds like they might have to pay experts to do it.

The question is whether this is attack has cost them more than that would have.

limagnolia 15 minutes ago | parent

I worked in IT for a major retail chain in the US. I was on the team in charge of store systems. We knew what devices were connected to the network, and if we had a vulberable device like this, we would have sent an urgent message to store managers to disconnect themm immediatly, and we would have followed up with scans over several days to ensure it happened. There is no excuse. (If we really needed the devices connected, we would have put them on a firewalled VLAN, which we could have pushed out in hours and had across the nation within days at most.). Granted, ideally we would have already had them VLANed.

It is incompetence to not have this capabilty.

hn_submit 29 minutes ago | parent

They deserve to get burned and should get a hefty fine as well. I'm fed up with businesses completely ignoring all basic security and then blaming culprits for hacking them.

I don't care whether it's the Russians, Chinese, Norks or script kiddies. This should never have happened, especially since a similar incident happened in France three weeks ago so they got ample time to prepare themselves. They just don't care.

HexnMarcusWolfe 1 hour ago | parent

... Who the fuck is putting this shit on a network that's not closed circuit?

jonasl 50 minutes ago | parent

Two things worth keeping in mind:

1. Connecting them was probably considered best practice when they were installed in 2005 2. Their support contract required them to stay connected

Caloric3002Swed 35 minutes ago | parent

Vendors install these so the store owner and them have easy access to alarms and controls.

A VPN per store would be too complex for the vendor so they just expose these to the open.

Same story as with all the hacked OT/SCADA systems in the past.

mrweasel 1 hour ago | parent

There was an interview with an angry store manager, he's mad at the attackers, but I didn't hear the media ask him why they didn't improve security after the French attacks. Only now do they appear to want to start a review of their monitoring system.

https://www.svt.se/nyheter/lokalt/skane/icas-kylar-och-frysa...

Cthulhu_ 57 minutes ago | parent

The store managers don't manage the IT security of the chain though.

mrweasel 28 minutes ago | parent

No, and I get that, but working in the industry, he can't have been in the dark about the events in France. If he doesn't deal with the monitoring of the fridges himself, he should be equally upset that the chain has failed to act.

andy_ppp 1 hour ago | parent

Maybe we should stop connecting things to the Internet that don't need to be?

baal80spam 1 hour ago | parent

I don't understand why these things aren't on their own (V)LAN. Why they are open to internet?!

Cthulhu_ 55 minutes ago | parent

Brainstorming here; monitoring, logging, etc. The fact the store managers were called out of bed when there was an issue indicates it works. If a cooler broke down overnight or its temperature was too high for X amount of time, they have to discard the products. Without monitoring they likely wouldn't know until customers got sick.

I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.

tensegrist 50 minutes ago | parent

given they turned off the refrigerators (instead of something evil like turning them down for just long enough to allow bacterial growth and then turning them back up) customers would probably have noticed their ice cream being liquid, the frozen meat not being frozen, etc

cucumber3732842 36 minutes ago | parent

>I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.

People won't steelman because the answer to "why are the fridges slapdashedly networked?" is too often "because people of my ideological bent and demographics if not literally me previously demanded paper trails, audit-ability and regulatory compliance that was impossible for a low margin industry to pull off any other way."

hackingonempty 58 minutes ago | parent

Back in 1995 this was so improbable it was one of the purported negative effects of the "Good Times" virus which was a parody of the virus warning e-mails that were being forwarded around at the time. Computers still can't give you Dutch elm disease, fortunately.

> It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty.

https://people.cs.rutgers.edu/~watrous/goodtimes-spoof.html

marttt 56 minutes ago | parent

amelius 54 minutes ago | parent

This is exactly the kind of thing we've all been warning about ...

(... in hacker forums)

tensegrist 53 minutes ago | parent

i know some of us are thinking "if you consistently fail to ensure your ability to make high-severity security patches reach critical internet-exposed systems on time you lose your ability to operate the business and probably get jail time"

but what about the deranged (and very prediction market–brained) version of this idea: the government develops ransomware, in a manner functionally similar to towing cars or confiscating illegal items, and uses it against companies in proportion to their revenue and obviously puts the money towards improving the ransomware

"the r in rsi stands for…"

i'm not sure it's something i want to see, but i don't know if it's impossible for it to actually come to pass or merely unlikely

(of course, cross-government versions of this are much more likely to come about but not as ransomware)

spenjovewkwhalo 20 minutes ago | parent

Why can a fridge go to 50ºC ?!

Ekaros 19 minutes ago | parent

You want them back to use very fast after they have certain amount of icing. So you want powerful heating elements there and those are cheap anyway. Fridge or freezer not in use doesn't make money in a store.

elorant 12 minutes ago | parent

Why the fuck does a freezer need access to the Internet in the first place?