Hackers activate automatic defrosting in supermarket fridges across Europe

If you believe some of the emerging comments out there - try "Danfoss CVE" - you'll see that some of the suspects are 15-20 year old controllers like the Danfoss SM800 (EOS 2021) and SC355 (EOS 2016).

Why don't they just--- no margin. But there were CVEs-- no margin.

The laptop class doesn't always grok that the shift-work labor class has nothing in terms of luxuries like security reviews and gear replaced on cycles and other basics taken for granted.

But I'd setup Tailscale and-- would you, the grocery store manager running on 3% margin, really? What if you're part of a chain and it's centrally controlled elsewhere, like all the other decade-old tech you use but have to call and wait for a dispatched tech to handle?

Secure-by-default laws will eventually help, but there's always going to be groaning infrastructure particularly in commodity industries, and we still haven't onboarded most of the disaffected men to the Internet that will commit innumerable more hacks and disruptions.

Was just talking to a lab tech at a hospital.

It seems that some of the newer lab machines require internet access because you can't run lab tests unless you have a paid subscription to use the machine. No credits on the subscription, no tests.

I mention this b/c a lot of commenters here are saying "but why would you ever hook up a freezer to the internet??"

I find that type of comment fascinating as many of the people on HN worked for firms that built the technology required to use internet based subscription models.

Not sure if it's related but there was a vuln published in August for the freezers in the article

https://www.claroty.com/team82/research/freeze-the-controlle...

maybe groups have been looking for targets to use it on?

> Connecting your case controller to the internet offers further opportunities to generate savings. If you can diagnose issues and control the case remotely, service engineers needn’t be called out to simple situations like starting a defrost. And being able to compare performance and efficiency across an entire estate of stores makes it easy to spot patterns and make incremental efficiency gains. (https://www.danfoss.com/en/service-and-support/articles/dcs/...)

I wonder if the incremental efficiency gains from this outweigh the damages. That doesn't even sound like a bad idea, unless of course nobody stops to think "but what if someone hacks this".

This is pretty interesting as the Danfoss vulnerability was suspected to be related to a similar situation that occurred across US military bases in late August 2026.

https://signalandsilence.substack.com/p/i-think-someone-hack...

Could this be the same group? Or someone inspired by reading that article? Or just entirely unrelated?

I worked in the field of control systems for supermarkets back in 2008.

These systems are internet connected and remotely controllable because the managers need to be able to see shifts in usage over time and take action to save electricity and provide better food storage. One example might be that due to shifting customer patterns and products, you might want a certain refrigerator case to be kept colder with a narrower temperature range. Another example is for Demand Response: when a brownout may occur, the utility companies want people to lower their load, which, in the case of supermarkets, means turning off lights, increasing the thermostat on the AC, turning off dehumidifiers, etc.

One notable story from that time: this was during the 2008 economic crash, and the company went from hiring to laying off within a week. A group of technicians were working on a refrigerator compressor system and were told by security to stop what they were doing and immediately exit the building. They tried to explain that they were running a special test and needed to shut things down before leaving, but the security guys weren't having it and made them leave right away. The test ended up running overnight, and the managers came in the next morning to over $100,000 worth of damage to the refrigeration equipment.

Confusing title, both the original and the one here on HN.

Three french supermarket chains had their refrigeration systems hacked.

Separately, a super market chain serving Belgium and the Netherlands shut down a large chunk of their IT systems due to a "cybersecurity incident", primarily affecting distribution centers and grocery delivery services. But the supermarkets are currently open, and do not have refrigeration issues.

Suspicious timing and these incident could well be related, but that has not been reported so far.

It could well be one ransomware attack on Ahold Delhaize, and an unrelated attack on a refrigeration supplier. Note that a similar refrigeration attack happened happened to a number of US military installations a few weeks ago.

Looks like that specific vulnerability was found this summer, disclosed in coordination with the vendor and at least some models were patched [0] (unclear if all models were), but from early reports:

- they either didn't warn their customers this was a critical security patch, - many of these fridges/freezers were directly accessible on the internet with their own 3G/4F SIM cards without further protection!

Crazy stuff

[0] https://www.claroty.com/team82/research/freeze-the-controlle...

Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers Amir Zaltzman / August 9th, 2026

https://claroty.com/team82/research/freeze-the-controller-de...

Interestingly, a major Dutch supermarket was also hit by a yet-undescribed cyberattack, prompting them to basically shut down every IT system. So not a hack of a control system, sounds more like an ordinary ransomware attack... but still tantalizing that two EU countries have their food supplies targeted the same day... the day of a big NATO "russia we dont mess around" conference, too.

Depressing to know that these CVEs were known since August.. and not one manufacturer forced an update to their always online devices.. and the regular customer will foot the bill for the incompetency.

Meanwhile Samsung doesn't even need hackers - a firmware update on consumer devices is enough: https://www.tomshardware.com/service-providers/samsungs-disa...

This article theorizing US Army freezers were hacked to defrost, from late August this year - only about six weeks ago! - is prescient. It was posted here on HN.

https://signalandsilence.substack.com/p/i-think-someone-hack...

>Carrefour (CARR.PA), opens new tab said 80 of its supermarkets had been hit but that the vast majority of its 6,000 stores had not been affected.

It would be useful to know the scale, as it sounds very similar to an attack on US Military Commisary's a month ago: https://news.ycombinator.com/item?id=49508506

Usually i'd feel like this was a large-scale operation but there's no denying that AI tools can copy/parrot/clone this type of work near instantaneously, so who knows.

TIL what „data diodes“ are after discussing this incident with a friend and quickly brainstorming a cheap way of airgapping a system with unidirectional comms. We figured two arduinos and optocouplers should do it, turns out if you productize this and get everything certified you can charge up to 20k for it. Crazy!

> Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.

I feel like this is kind of holding the supermarket hostage and saying, “Sure your freezer is working fine, but if you refuse to buy new freezers from us prepare to get hacked.”

Sure you can argue that the supermarket should have just taken the old freezers offline. But you can also argue that the manufacturer could have supplied software updates but didn’t in order to force sales of newer models.

Aug 28, 2026 https://signalandsilence.substack.com/p/i-think-someone-hack... I Think The Military Commissary’s Freezers Were Hacked

https://news.ycombinator.com/item?id=49508506

Doesn't look like this needed a rampant AI, pardon, elite superintelligence:

https://cyberplace.social/@GossiTheDog/117429502412235079

These vandals are what creates a low-trust society, where everybody needlessly suffers.

I remember working on my car when I lived in an apartment. I'd take my tools out into the parking lot, and get to work. If I needed to use the potty, or get a snack, or whatever, I had to pack up the tools and take them inside. Then out again. It really stinks.

I currently live in a high trust neighborhood where I don't need to be present with anything outside.

It's so much better.

My first idea was "who the hell needs connected fridges".

Then I remembered that both my AC and floor heating are connected.

A hacker could easily turn on both AC and floor heating and cause me a few euros of damages in my electricity bill.

In the U.S. the following brands are affected (systems were proactively taken offline):

* Food Lion, 1100 stores

* Stop & Shop, 400 stores

* GIANT/MARTIN, ~190 stores

* Hannaford, ~160 stores

Websites are down at the very least. May affect ability to place online orders for pickup and delivery. Mobile apps are down. “In-app coupon” redemption is likely down.

US brand physical stores are open and selling to customers.

1 data point of Yep. I went to my local Monoprix to grab a few things during lunch break. For some reason they seemed to have suffered a fridge incident, good for me I didn't need anything from those aisles. I did wonder if it was just a recent problem or if a more sneaky malfunction had silently semi-spoiled some of the products I brought back days before, until it just blew over.

Only going to get worse as hackers get increasing access to more advanced AI models and compute

Open weight models catch up quickly, so it is only a matter of time before Fable level models are in the hands of bad players

Key issue will be that banks and key infrastructure *may* get their security patched in time. But there’s going to be so many vulnerable companies like in this case

Something different came to mind as I read this article - there has been recent chatter regarding impending Food security issues - it was even talked about by India's foreign minister recently:

https://www.thehindu.com/news/national/eam-jaishankar-warns-...

I wonder if this attack is some kind of early warning about capabilities of disruptive forces.

Same (an outage) happened to the US military commissary system https://www.stripes.com/theaters/us/2026-09-01/army-cid-inve...

how is it possible that fridges are exposed bare bones to Internet?

why not put them behind corporate VPN of some kind?

So tossing out an idea:

What if all manufacturers had to classify their product into internet connected i.e. smart or not. We mandate that manufacturer has to support updates for minimum 5 years or firmware source goes public. Have them put firmware source in escrow as well as have a way to update it.

If a manufacturer wants to reduce their liability then they have to release something to make it semi publicly supportable. With AI agents these days patching the firmware might one day be trivial.

Put some penalities with teeth behind this and maybe manufacturers will think twice before making everything smart.

Watch Dogs was ahead of its time. How long before one of these hacker groups claim the DedSec name as their own?

So, those fridges are in the supermarkets, right? Where people work, who have to empty a fridge before it can be remotely defrosted. Why can't those people just press a defrost button? What is the point of doing defrosting remotely when you cannot do it without the onsite support?

There was an article recently about a similar hack on fridges in American military bases I believe.

hacked or backdoored? [1]

> The four-page security note, a copy of which was reviewed by Reuters, said that undocumented cellular radios had been discovered “in certain foreign-manufactured power inverters and BMS,” referring to battery management systems.

[1] https://www.reuters.com/legal/government/us-warns-hidden-rad...

On the one hand, this might be an escalation of a war below the threshold of "Europe orders general mobilisation". On the other hand, it seems that you just have to sneeze in the general direction of anything 'cyber' to cause an incident, shame on us if we can't get very basic security in order.

Claude had munchies....

Supermarkets in the Netherlands were also hit. Seems like a Russian linked attack.

Is this the same thing that hit the military bases in the US?

These are fridges in supermarkets, not home fridges. I think a supermarket capable of administering many fridges can put their big boy pants on and handle the potential downsides of controllability.

> cyberattack, which has hit Danfoss-made refrigeration controls

Danfoss AK-SM 720 or 850? Pull the ethernet cord, now.

The latter can be flashed with the new 800A series firmware which is safer, but I still would not put it on the public internet under any circumstances.

Just when you think the golden age of hackers is over... Wasted food is bad, of course, but this is the kind of genius that military academies can never teach.

Second order thought, this is going to create a nightmare of new AI regulations and if your company has European customers, prepare yourself.

I think it's important to see if this could happen on a larger scale. What if it wasn't only French supermarkets but also important supply chain chokepoints of food worldwide? What would happen to food prices?

It's super bad when even Appie is not safe from those Russians, etc.

People never learn:

https://programmerhumor.io/networking-memes/the-ultimate-fir...

The same happened to a major Dutch supermarket chain.

Seems a coordinated attack, perhaps not coincidentally on the day the US supreme NATO commander gave a speech about the defence against (hybrid) attacks.

Maybe the agent swarm passed its “warmth” eval.

It really, really irks me that in one of the articles about this, it mentions the manufacturer pointing to "outdated firmware", and even comments here demeaning the store for not "securing" their __refrigerators__. Read that twice, and think how many times this silliness could apply to far too many objects in our lives.

Very few things should be networked, or at the very least, not with any sort of control. I can't even blame the average person anymore for not being as aware about technology, unless there's some sort of aggression or dismissive responses when they're informed of the risks or potential risks. Software developers at this point may very well end up being as despised as lawyers or bankers, for not broadly enough condemning this sort of technological creep, but for being that guy smugly saying something about firmware updates ... on a refrigerator.

…and that’s a good thing, as this non critical incident will raise awareness for safety in more critical domains like power plants, medical devices… oh who am I kidding.

Eventually a digital act of terrorism or war will be enacted that will kill thousands or more.

Wait until they discover they’re all filled with butane as a refrigerant.

“Got another blackout in Santo Domingo. Netrunners are at it again, poking holes in the power grid!”

Fridge attack! We live sci-fi indeed! %-)

Maybe, just maybe, fridges shouldn't be online. Cue immediate responses of: but don't you understand, management can now monitor it 24/7 and adjust in real time. To which I have about the same response:

Maybe they shouldn't.

I wonder if AI would have helped in this situation.

For example [request to defrost n fridges in y locations]->[agent cannot find any emails or business communications about this and last defrost report was only a short time ago, contacts z personnel]->defrost task moved to manual confirmation by a human.

I know many will roll their eyes and "tchh" at it but look at number of AI related topics on HN front page and think to yourself if you're tired of this tech not being used for real applications or not. This would be a real application.

"But it could be tricked" well...regular requests can apparently already be hacked, so...

> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

I worry that this kind of thing is going to be a recurrent problem. A lot of people have pretty strong intuitions, or even an explicit moral position, that they should never have to upgrade a physical machine that's working fine. Is there a threshold of vulnerability that will overcome that, or are we just going to see a lot more hacking of random infrastructure from now onwards?

... Feels like deja vu. Didn't the US military just have this happen at its military exchanges... a month or two ago?

Yes, yes they did. https://www.militarytimes.com/news/your-military/2026/08/28/...

"ALL freezers went into defrost mode – ALL frozen food has spoiled".

How in the name of fuck was a fridge even designed to be able to heat itself to 50 degrees C?

Here's a fix:

if(temp > 5) return;

Please, let this be the stone that starts the avalanche of consumers rejecting smart apppliances.

My fucking fume hood on my stove has Bluetooth, because Samsung just can’t help themselves apparently.

TomsHardware hit? I'm getting spinning beachballs on this link

Of all the things to put on a network, this ranks as one of the dumbest, ever. You don't need control of the unit done over a network, just the data on whether it is working or not. Anything else is simply asking for someone else to come along and break your stuff.

To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.

I feel no pity for them at all. If they're too stupid to secure their fridges (which seem to be accessible over the internet) than that's their deserved pain.

Interesting. The government has been suggesting war with Russia is coming. This would be a great initial move. Take out the European food supply network, then hit things like the grid and the internet.

It's funny because red storm rising is an old book at this point, but it's pretty accurately shown exactly how conflict with Russia plays out. Even down to Russia realising it is about to run out of diesel... causing it to invade Europe while it still can.

What genius decided to connect a fridge to the Internet? Make him pay the losses.

By the way similar thing might happen to geniuses buying Internet-connected cars.

Good. I’m not happy that this happened. That’s a large financial loss. I don’t like thinking about all the good, edible food thrown away instead of nourishing people. But the infosec thing that keeps me up at night is the utter lack of SCADA security. “Relax! This dam won’t collapse as long as no one guesses our public IP address!”

Lots of industrial controls haven’t been updated since they were deployed in the 90’s. “And why should they be? If it ain’t broken…” Well, because they’re freaking broken!

So I’m glad that this happened in a tangible, public way people can easily understand without it involving something much more drastic. If your family asks about this, explain that you’re glad no one blew up a gas pipeline… yet.

[dead]

from https://blog.claroty.com/team82/research/freeze-the-controll... :

> Our research uncovered a hidden "code-of-the-day" authentication mechanism that could be abused to bypass normal authentication

> Our analysis began by examining the internet exposure of these devices, where we identified thousands of publicly accessible management interfaces

> (shell injection vulnerability in management interface)

This is how we used to vibe-code before we had LLMs.

[dead]

Great. We already waste a ton of food, let’s destroy even more.

Remind me again why I should buy an internet-connected refrigerator?

This is terrible. But, at the same time, why now? This seems like something you'd want to hold onto for use later as a nation state. And there's no money to be made here since you can't really ransom it. Was this just a petty attack to scare the public?

On the bright side I'm sure the manufacturer and others will have an increased security posture going forward.

This is literally everything that's wrong with the modern tech industry in a nutshell:

> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

They sell fricken refrigerators for God's sake. Maybe I can understand planned obsolescence for a cell phone, but a fridge? And especially to grocery stores that operate on razor thin margins to begin with, the idea that they'll just dump their old working refrigerators because the manufacturer refused security updates is a guaranteed recipe for stuff like this.

Another good example why writing secure software matters in the age of connected devices.

Why is that even internet enabled?

If you want to defrost it presumably someone already needs to be physically present to unload the fridge?

Why is this even connected to the internet. If you want to monitor it remotely, you can set that independently from the actual controls.

> The software allows retailers to manage their cold units remotely.

Will they never learn?

[dead]

Why the fuck are those fridges even networked!?

[flagged]

[flagged]

[flagged]

[flagged]

[flagged]

There is so much needless connection to the internet nowadays; this is the end result of a decade of shoving IoT into everything.

Beyond some corporate manager seeing a dashboard that will cause them to say "oh neat" in a meeting once, there is zero reason to put a refrigerator's cooling system online. Or frankly any network for that matter. Is there really such a massive productivity increase from being able to remotely change the temperature when a human has to physically visit the machine to restock every day anyway?

Gilfoyle again?

These incidents will bring back the appeal for dumb appliances, hopefully.

Instead of climate change, let's call it "cyber change"...the rise of hacks of all kinds facilitated by AI