Yet another Hacker News

Supermarket freezers across Europe hit by second suspected cyber-attack

58 points fergie 1 hour ago 58 comments

fergie 1 hour ago | parent

Hackers remotely override settings on thousands of freezers, fridges and chiller cabinets, pushing them from as low as -27C to well over 50C. Intermarché, Coopérative U, Carrefour, Leclerc and Monoprix chains among those affected.

sylware 1 hour ago | parent

monoprix is french, and it seems it was limited to sweeden and belgium.

Hoax?

lrasinen 1 hour ago | parent

That sounds like the October event which was focused in France. The current one is all over Europe, from Ireland to Finland.

bestouff 36 minutes ago | parent

All of GP's names are French

maeln 37 minutes ago | parent

They are all french brands. I think he is referring to the previous hack that happen last month. Looks like a AI-generated comment tbf.

Jmstdy95 1 hour ago | parent

that's insane, they just got hit recently right?

testfrequency 1 hour ago | parent

“Hit by second”

pluc 1 hour ago | parent

https://news.ycombinator.com/item?id=50335602

https://news.ycombinator.com/item?id=50335252

vintagedave 29 minutes ago | parent

Also https://news.ycombinator.com/item?id=50335324 - my submission, I linked here since this is the better thread.

thatsabadlook 57 minutes ago | parent

Can't tell if it will be some asshole hacker group, Russia, the us, or what. But for the love of God please stop connecting everything to the Internet and also ai...

mirekrusin 47 minutes ago | parent

...or ai lab bench maxxing.

frankharv 46 minutes ago | parent

I have no problem with monitoring temps over internet.

Who ever thought it was OK to control freezers over the internet should be hung.

thatsabadlook 32 minutes ago | parent

Analytics are very different from controls. People who model them the same tend to suffer. A lot of academics and project managers don't understand this unfortunately.

graemep 31 minutes ago | parent

That implies you also ensure that they monitoring system is isolated from the control system. No one can be bothered to do that, and no one wants to spend the money on an extra microcontroller (a tiny fraction of the cost of each unit, but it comes straight out of your margin because no one pays extra for security).

coldpie 16 minutes ago | parent

> Who ever thought it was OK to control freezers over the internet should be hung.

I've got really bad news for you about how many critical systems are connected to the Internet.

weatherlite 39 minutes ago | parent

Isn't it a reasonable assumption that an LLM was involved in helping prepare this attack? §

thatsabadlook 33 minutes ago | parent

No I was just saying generally, the number of security risks do to AI is ridiculous

monkeydust 33 minutes ago | parent

Many would be thinking that, including me. Nefarious agents powered by LLMs operating 24x7 with a singular goal of finding attack vectors.

thatsabadlook 25 minutes ago | parent

Highly doubtful. More than likely someone is picking targets here. Going for food supply is a war crime. So it could be an extremely hostile nation state. Or some really psychopathic disgruntled person/group. If there's no ransom it strongly leans toward a nation state in my opinion. A lot of turmoil between Europe and Russia+the us lately. That's my guess.

puszczyk 45 minutes ago | parent

I wonder if the companies affected this time missed the news about the French attack a few weeks back?

INTPenis 31 minutes ago | parent

No joke, yes they did. The markets hit here in Sweden are all in rural communities with very low number of tech workers. They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.

Caloric3002Swed 22 minutes ago | parent

>The markets hit here in Sweden are all in rural communities with very low number of tech workers.

Hej! You are wrong, here in the middle of Stockholm got hit.

https://www.mitti.se/nyheter/icabutikens-frysar-hackades--fi...

ICA Baronen on Odengatan is one of several stores in Sweden that have suffered a major hacker attack. On Monday, their freezers were cancelled at 50 degrees.

This is in Stockholm - https://maps.app.goo.gl/BwbDST4dPVkjcdgA8

So no lack of IT workers/tech workers... Nor is it very rural.

>They likely order their system from a supplier, that should have alerted them and helped them, but apparently did nothing.

The first thing to do when you get access to these as a hacker? You disable the alarms...!

Now, the supplier should have set them up correctly over VPN, good passwords, Zero Trust etc but these an OT/SCADA are usually just open to the internet due to the simplicity of use.

raverbashing 5 minutes ago | parent

Hence why you need an alarm for alarm disablement

(I mean, you need also a bunch of other things but yes)

teekert 19 minutes ago | parent

But then the supplier is responsible, why would you ever put a fridge online if you are are tech noob. Someone told these people to put these fridges online, they didn't put an Ethernet cable in the back by themselves for the fun of it.

sorenjan 9 minutes ago | parent

Some of them (Coop) got new equipment after what happened in France and where gonna upgrade them in two days.

Caloric3002Swed 29 minutes ago | parent

Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT of course but they usually do POS and desktops/servers.

The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

Autious 18 minutes ago | parent

ICA is franchised, so stores are owned and run by operators. The central company offers some services, but a lot of the decisions comes down to the individual stores.

tgv 20 minutes ago | parent

The bizarre thing is it is the second time for Delhaize, although the incident of two weeks ago was related to the pricing system.

Hamuko 11 minutes ago | parent

After the PHP vulnerability, we got some clients asking if our SaaS product used PHP (it didn't). It's possible that they just contacted their vendor, who assured them that everything was fine.

SecretDreams 40 minutes ago | parent

Two things:

1) I hope they learn some hard lessons about security and what should be exposed to the internet vs LAN.

2) These are some evil ass people doing this shit.

Caloric3002Swed 32 minutes ago | parent

1) "They" have no idea what exposed to open internet vs LAN vs VPN even mean. They have no idea what these terms mean, they just want the easy access. Same reason why open RDP to 3389 used to be so common. Vendors install these so the store owner and them have easy access to alarms and controls. So they vendor installs it for easy access, shows the store owner, store owner trusts vendor, but vendor has done the bare minimum. Because the vendor wants it easy too.

A VPN per store would be too complex for the vendor so they just expose these to the open.

Same story as with all the hacked OT/SCADA systems in the past. Like those hacks where some SCADA system is open as a website with pump controls.

Imagine they where internet exposed due to simplicity. Imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

2) Yes, obvious it is Russia doing this. Very handy to be able to disrupt food supply and they are also checking our response and time to restore.

_kblcuk_ 28 minutes ago | parent

> obvious it is Russia

I love how we're back to good ol' times that there is only one "evil empire", and it's completely impossible that anyone else from dozen of others possible bad actors is involved

/sarcasm

MadameMinty 23 minutes ago | parent

1. Both empires are evil. 2. Russia still did that one.

liveoneggs 37 minutes ago | parent

Why isn't the brand of cooler or cooler-controller being named?

Was it a password break or an open admin console or SNMP or what?

flexie 34 minutes ago | parent

In the attack on French supermarkets a few weeks ago, hackers pirated controllers mostly supplied by the Danish company Danfoss.

usrnm 23 minutes ago | parent

Multiple sources confirm that it's the same Danfoss problem this time, for example, https://www.hln.be/binnenland/centrum-voor-cybersecurity-bev... (in Dutch)

mrweasel 26 minutes ago | parent

In France I believe that the password on the monitoring software, or the controllers, was updated daily. The date was somehow used as the new password, or as an input to the password sequence. So rolling the passwords didn't do anything when the attackers are aware of the "algorithm".

cryptonym 17 minutes ago | parent

https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/

The real issue is geniuses in food stores connecting to the open internet systems with 100K+ EUR of products exposed.

Remember, the 'S' in 'IoT' stands for Security.

thrance 37 minutes ago | parent

Why the previous attack wasn't a strong enough signal to make every European retailer unplug their freezers from the internet is a mystery to me.

plaguuuuuu 29 minutes ago | parent

Not officially at war (or even cyberwar) but... are we at war?

What sort of electronic shitfight is about to go down between major powers?

MadameMinty 22 minutes ago | parent

Yes. "Hybrid war" is still war.

c16 26 minutes ago | parent

How did every supermarket chain around the world not jump at this and investigate?

vconnor 17 minutes ago | parent

Their cybersecurity departments (next to fresh produce) are all over this.

Snark aside, supermarkets are not in the tech business. The extent of their involvement is ringing their IT vendor to complain about it.

auggierose 7 minutes ago | parent

Depends. Lidl wants to be a tech company.

https://en.wikipedia.org/wiki/Schwarz_Digits

Sharlin 16 minutes ago | parent

Probably most of them had exactly zero inhouse expertise in cybersec and just pretended there’s nothing to worry about because having to worry would be inconvenient. Maybe some of them made a call to their cold chain supplier and were told that there’s nothing to worry about.

rickdeckard 11 minutes ago | parent

I wonder how many people working in any given supermarket chain actually know that their fridges are connected to a network at all.

Sharlin 5 minutes ago | parent

Not many, probably, but their cold chain people definitely would have known. Instrumented and remote monitored cold chains are standard these days because keeping stuff refridgerated end to end is a pretty big deal.

wjnc 25 minutes ago | parent

The magic question is: why isn’t this fixed yet? And then the specifics, the nitty grift of why not. Thousands of industrial fridges. They presumably all need new hardware, or at least tenporarily all need a RPi with additional software on the network cable, or it could even worse… are they on regular company wifi? Don’t these companies have VLANs? It’s astonishing that this is what brings billion dollar companies in a key supply chain down.

This little gimmick cost Ahold in the Netherlands an estimated 300 M€ a few weeks back. Enough money for any firm to set the engineers to work? Where they waiting it out? Having read some more… another part of Ahold (the Belgian part) was hit and has (only now…) taken all fridges down from the internet. What is IT risk doing in a firm like that? Internet of Shit is a decade old. I am not amazed non tech sectors are perhaps a bit slower in IT risk management. I am amazed that an ongoing attack situation can still cause trouble 4 months after publication and months after board level headline grabbing numbers are widely publicized.

Me and my crew (yet to form ;) will visit any fridge for a measly 100 K€ a pop to take them offline. Book early, because once the script kiddies hit, we are on the road.

jaapz 24 minutes ago | parent

Was the Albert Heijn outage due to the fridge issues as well?

wickedsight 19 minutes ago | parent

People (and media) seem to regularly link the two, but there was never any confirmation and the issues that AH showed had nothing to do with store fridges. They took down a system responsible for stocking stores, fridges, registers, etc were still functional.

wjnc 12 minutes ago | parent

You are right. That was never made public. They were hit on exactly the same day as the French hack of fridges and took what look like a forward looking step of taking a lot of infrastructure down.

That does lead to harder things to think about. Multiple different attacks on EU supermarktes? Resilience? And then the questions I point to above: how hard is it for non tech firms to fix an emerging IT risk situation.

lifestyleguru 25 minutes ago | parent

Admin interface available on the internet without 2fa and automatic password change once a week? Anyone gaining sufficient experience and seniority in the industry becomes instantly unemployable, so it is what it is.

Y_Y 22 minutes ago | parent

> Admin interface available on the internet

This is the bad part. Frequent password resets suck.

sorenjan 5 minutes ago | parent

The neat thing about Danfoss' frequent password resets is that it's always the current date, so it's easy to remember.

https://en.wikipedia.org/wiki/2026_French_supermarket_refrig...

bedstefar 4 minutes ago | parent

I'm extrapolating a bit here based on Reddit hearsay, but I think this may have to do with rural stores having essentially consumer-grade internet routers connected to the mobile broadband network.

Much of the coverage in Swedish media drives the point that only 4G-uplinked stores have been hit so far. I think that's unfortunate, because really it wouldn't have differed if these stores were connected by 5G.

I'm guessing here, but my money would be on freezer ICS systems being made available to the world by accident by way of NAT-PMP on a consumer router. In Scandinavia you can bypass CG-NAT on mobile connections by setting a particular APN, so my guess is that these control systems were simply findable on Shodan.

This also explains why this wasn't discovered after the recent French breach. Supposedly all the stores with "proper" uplinks were in compliance, and no one had thought of a way in for those non-compliant stores, because they "weren't even connected, so how would an attacker get in?"

techpression 2 minutes ago | parent

My fridge beeps loudly when something is wrong, and it has no connectivity to any network. Exactly how a fridge is supposed to be, why are we reinventing fridges…