This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time. Or to take the freezers offline if an update isn't available.
I now read some interviews with local chains in Sweden and Finland, and they were still just investigating what to do at this point.
>Or to take the freezers offline if an update isn't available.
Why the heck would this be necessary? We have VPNs holy crap, the entire genesis of the technology was to solve this fucking problem. If it's not literally intended for the general random public to be able to randomly visit and use themselves, it shouldn't be exposed on the public internet it should be (heavily restricted) LAN-only with remote access done via VPN. While it's even better if every single last thing is well secured at the client-level too, it goes a long way with ancient (or new, but with ancient-equivalent software design expenditure/decisions) kit to protect it at the network level.
Creating a false binary of "take it offline!" when businesses have very good reasons for networking many classes of industrial hardware seems self-defeating vs "just get the cheap bare minimum basic network protection done". I mean shit, even if somehow they've gotten suckered into freezers which demand access to a non-self-hostable manufacturer server (hey EU! here's something useful to regulate! if nothing else order manufacturers to have WireGuard end points for connection) they could at least have the firewall allow !RFC1918 solely and exclusively to that address on those ports.
However, we're talking about companies that put unprotected systems on the public network and did nothing about it even after getting three weeks advance warning.
Seems like the biggest chain in Sweden, ICA, had a VPN. They were affected but only the franchise takers that were (for whatever reason) outside their internal network.
They deserve to get burned and should get a hefty fine as well. I'm fed up with businesses completely ignoring all basic security and then blaming culprits for hacking them.
I don't care whether it's the Russians, Chinese, Norks or script kiddies. This should never have happened, especially since a similar incident happened in France three weeks ago so they got ample time to prepare themselves. They just don't care.
What I read from the last wave is that supermarket changes how cold freezers will run depending on how much customers they expect that will open and close the doors. Just having the freezers adapt based on the temperature of every single moment cost too much electricity or can result in unsafe temperatures.
Completely speculating as I don't know the situation in Europe, but some possible reasons are:
- Remote alerting for the store manager/head office to quickly respond to a refrigerator failure after hours, providing options for saving valuable stock (e.g. move stock to another refrigerator).
- Maintaining an audit trail for cold chain management (e.g. regulator says you must keep an audit trail proving that a frozen fish has been kept below 30oC since it was processed on a ship all the way up to point of sale in a supermarket).
- Refrigerator manufacturer says a condition of warranty is that the refrigerator must provide remote telemetry proving some warranty condition has been met (e.g. regular cleaning cycle operated).
Note: all these speculated reasons are unidirectional data flows. So even if a valid reason exists for Internet connectivity, why can't it be limited to unidirectional data flows?
Also so the temperature can be controlled to make use of cheaper electricity — if you know it's going to be windy from 02:00 to 04:00, then still until 06:00, you can run the freezers a bit extra while the electricity is super cheap.
On top of the monitoring mentioned by others, it's also to create a centralized log of actual temperatures. This then lets you show inspectors that you are keeping up with refrigeration requirements.
Monitoring doesn't need write access. RS-422 is simple and reliable. It uses separate receive and transmit pairs and you don't need to connect both. The freezer can continually transmit its telemetry over unidirectional RS-422 and a separate system can forward it over the Internet.
Hackers can still tamper with the telemetry and create false reports of problems, but actually changing the thermostat settings would require local access, so there's opportunity for somebody to verify the problem really exists.
Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.
The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.
I worked in IT for a major retail chain in the US. I was on the team in charge of store systems. We knew what devices were connected to the network, and if we had a vulberable device like this, we would have sent an urgent message to store managers to disconnect themm immediatly, and we would have followed up with scans over several days to ensure it happened. There is no excuse. (If we really needed the devices connected, we would have put them on a firewalled VLAN, which we could have pushed out in hours and had across the nation within days at most.). Granted, ideally we would have already had them VLANed.
I do work in the retail refrigeration world nowadays and "just updating the software" is much easier said than done. I'm usually touching grocery stores with 20+ year old hardware from the dawn of centralized control and monitoring. It's not s trivial thing to rip out the controllers and install new ones.
In the case of France, the vulnerability was announced in August, 2025.
I believe gigantic fines are appropriate. They need to be of a size where the entire management team has significant financial issues for many years to come, even after having sold their houses, big cars, etc.
Nothing will improve until there are personal consequences.
Back in 1995 this was so improbable it was one of the purported negative effects of the "Good Times" virus which was a parody of the virus warning e-mails that were being forwarded around at the time. Computers still can't give you Dutch elm disease, fortunately.
> It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty.
There was an interview with an angry store manager, he's mad at the attackers, but I didn't hear the media ask him why they didn't improve security after the French attacks. Only now do they appear to want to start a review of their monitoring system.
No, and I get that, but working in the industry, he can't have been in the dark about the events in France. If he doesn't deal with the monitoring of the fridges himself, he should be equally upset that the chain has failed to act.
I've fantasized a long time about a clearer separation of technology from life, since it's been depicted in some ways I appreciated in fiction. But at this point, I'd just take a set of laws around what types of items should ever have any sort of networking.
I believe it's industrial protocols used to connect such devises to a SCADA system. It this case it's the SCADA system that has to be disconnected from any general purpose networks.
The freezer itself doesn't need to connect to a SCADA. You can network power and temperature monitors, but those monitors don't need the ability to shut off the freezer.
These freezers are manually stocked and cleaned. If they need to be powered down it's a simple matter of a hardware switch that you flip when the unit is empty.
Brainstorming here; monitoring, logging, etc. The fact the store managers were called out of bed when there was an issue indicates it works. If a cooler broke down overnight or its temperature was too high for X amount of time, they have to discard the products. Without monitoring they likely wouldn't know until customers got sick.
I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.
given they turned off the refrigerators (instead of something evil like turning them down for just long enough to allow bacterial growth and then turning them back up) customers would probably have noticed their ice cream being liquid, the frozen meat not being frozen, etc
>I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.
People won't steelman because the answer to "why are the fridges slapdashedly networked?" is too often "because people of my ideological bent and demographics if not literally me previously demanded paper trails, audit-ability and regulatory compliance that was impossible for a low margin industry to pull off any other way."
You want them back to use very fast after they have certain amount of icing. So you want powerful heating elements there and those are cheap anyway. Fridge or freezer not in use doesn't make money in a store.
i know some of us are thinking "if you consistently fail to ensure your ability to make high-severity security patches reach critical internet-exposed systems on time you lose your ability to operate the business and probably get jail time"
but what about the deranged (and very prediction market–brained) version of this idea: the government develops ransomware, in a manner functionally similar to towing cars or confiscating illegal items, and uses it against companies in proportion to their revenue and obviously puts the money towards improving the ransomware
"the r in rsi stands for…"
i'm not sure it's something i want to see, but i don't know if it's impossible for it to actually come to pass or merely unlikely
(of course, cross-government versions of this are much more likely to come about but not as ransomware)
It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?
It would take people listening to professionals and getting rid of several decades worth of bad habits amongst users. Same as most other places really.
> It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?
I'm quite sure your average American company is just as willing to plug random shit into the internet.
Hell, there are probably hundreds of reports out there of American companies failing to secure their AWS S3 buckets, so you don't even have to plug anything into the internet.
The problem is the ironic "home grown" or "internal" security. These external attacks come after decades of fertilizing far right white politicians whose sole purpose is to dither any directed anger.
Brexit was the first to burst and despite their support of Ukraine, can at any moment capitulate to the ghost of nationalism and delusional escapism that is "white power". Americas on the verge of sinking further into the same. With those two entirely preoccupied, of course europe is next and already has the same underlying current.
This first happened in France over three weeks ago. It's unforgivable that many chains have failed to update their software in time. Or to take the freezers offline if an update isn't available.
I now read some interviews with local chains in Sweden and Finland, and they were still just investigating what to do at this point.
>Or to take the freezers offline if an update isn't available.
Why the heck would this be necessary? We have VPNs holy crap, the entire genesis of the technology was to solve this fucking problem. If it's not literally intended for the general random public to be able to randomly visit and use themselves, it shouldn't be exposed on the public internet it should be (heavily restricted) LAN-only with remote access done via VPN. While it's even better if every single last thing is well secured at the client-level too, it goes a long way with ancient (or new, but with ancient-equivalent software design expenditure/decisions) kit to protect it at the network level.
Creating a false binary of "take it offline!" when businesses have very good reasons for networking many classes of industrial hardware seems self-defeating vs "just get the cheap bare minimum basic network protection done". I mean shit, even if somehow they've gotten suckered into freezers which demand access to a non-self-hostable manufacturer server (hey EU! here's something useful to regulate! if nothing else order manufacturers to have WireGuard end points for connection) they could at least have the firewall allow !RFC1918 solely and exclusively to that address on those ports.
Yes, VPNs would be the correct solution.
However, we're talking about companies that put unprotected systems on the public network and did nothing about it even after getting three weeks advance warning.
Seems like the biggest chain in Sweden, ICA, had a VPN. They were affected but only the franchise takers that were (for whatever reason) outside their internal network.
They deserve to get burned and should get a hefty fine as well. I'm fed up with businesses completely ignoring all basic security and then blaming culprits for hacking them.
I don't care whether it's the Russians, Chinese, Norks or script kiddies. This should never have happened, especially since a similar incident happened in France three weeks ago so they got ample time to prepare themselves. They just don't care.
Why do supermarket freezers need to be on the internet in the first place? A freezer has one job right.. keep things cold :/
What I read from the last wave is that supermarket changes how cold freezers will run depending on how much customers they expect that will open and close the doors. Just having the freezers adapt based on the temperature of every single moment cost too much electricity or can result in unsafe temperatures.
Completely speculating as I don't know the situation in Europe, but some possible reasons are:
- Remote alerting for the store manager/head office to quickly respond to a refrigerator failure after hours, providing options for saving valuable stock (e.g. move stock to another refrigerator).
- Maintaining an audit trail for cold chain management (e.g. regulator says you must keep an audit trail proving that a frozen fish has been kept below 30oC since it was processed on a ship all the way up to point of sale in a supermarket).
- Refrigerator manufacturer says a condition of warranty is that the refrigerator must provide remote telemetry proving some warranty condition has been met (e.g. regular cleaning cycle operated).
Note: all these speculated reasons are unidirectional data flows. So even if a valid reason exists for Internet connectivity, why can't it be limited to unidirectional data flows?
Also so the temperature can be controlled to make use of cheaper electricity — if you know it's going to be windy from 02:00 to 04:00, then still until 06:00, you can run the freezers a bit extra while the electricity is super cheap.
Those might be reasons for them to be connected to a network. They are not reasons to connect them to the internet
On top of the monitoring mentioned by others, it's also to create a centralized log of actual temperatures. This then lets you show inspectors that you are keeping up with refrigeration requirements.
Creating a centralized log is monitoring. It doesn't need write access to the defrost setting.
For commercial uses some kind of global monitoring is not super crazy. Regular retail freezers being on the internet, that's the crazy talk.
Monitoring doesn't need write access. RS-422 is simple and reliable. It uses separate receive and transmit pairs and you don't need to connect both. The freezer can continually transmit its telemetry over unidirectional RS-422 and a separate system can forward it over the Internet.
Hackers can still tamper with the telemetry and create false reports of problems, but actually changing the thermostat settings would require local access, so there's opportunity for somebody to verify the problem really exists.
But why can they control the temperature then?
If I put a Zigbee thermometer in the freezer they can hack it all they want, but I am pretty sure they will not be able to set the temperature to 50C.
If they want to get their pubic-facing remote monitoring jollies, why not implement ro access?
> pubic-facing remote monitoring jollies
Those freezers seem to be having lots of fun :-)
Read access, sure. But being able to turn them off?
Likely so that stores can be monitored remotely. A lot of supermarkets have a centralized orchestration somewhere, especially big chains.
Has anyone determined if these were separate from the attacks on US military PX refrigeration that happened well before that?
Imagine they where internet exposed due to simplicity. It will take longer than three weeks to set this up. Not for you but imagine you are a store owner with 0 IT knowledge.
The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.
I worked in IT for a major retail chain in the US. I was on the team in charge of store systems. We knew what devices were connected to the network, and if we had a vulberable device like this, we would have sent an urgent message to store managers to disconnect themm immediatly, and we would have followed up with scans over several days to ensure it happened. There is no excuse. (If we really needed the devices connected, we would have put them on a firewalled VLAN, which we could have pushed out in hours and had across the nation within days at most.). Granted, ideally we would have already had them VLANed.
It is incompetence to not have this capabilty.
Sounds like they might have to pay experts to do it.
The question is whether this is attack has cost them more than that would have.
I do work in the retail refrigeration world nowadays and "just updating the software" is much easier said than done. I'm usually touching grocery stores with 20+ year old hardware from the dawn of centralized control and monitoring. It's not s trivial thing to rip out the controllers and install new ones.
Yeah was about to say, if your a major chain this is on you
In the case of France, the vulnerability was announced in August, 2025.
I believe gigantic fines are appropriate. They need to be of a size where the entire management team has significant financial issues for many years to come, even after having sold their houses, big cars, etc.
Nothing will improve until there are personal consequences.
Back in 1995 this was so improbable it was one of the purported negative effects of the "Good Times" virus which was a parody of the virus warning e-mails that were being forwarded around at the time. Computers still can't give you Dutch elm disease, fortunately.
> It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty.
https://people.cs.rutgers.edu/~watrous/goodtimes-spoof.html
There was an interview with an angry store manager, he's mad at the attackers, but I didn't hear the media ask him why they didn't improve security after the French attacks. Only now do they appear to want to start a review of their monitoring system.
https://www.svt.se/nyheter/lokalt/skane/icas-kylar-och-frysa...
The store managers don't manage the IT security of the chain though.
No, and I get that, but working in the industry, he can't have been in the dark about the events in France. If he doesn't deal with the monitoring of the fridges himself, he should be equally upset that the chain has failed to act.
Similar thing in Estonia: https://news.err.ee/1610183296/hackers-raised-freezer-temper...
I've fantasized a long time about a clearer separation of technology from life, since it's been depicted in some ways I appreciated in fiction. But at this point, I'd just take a set of laws around what types of items should ever have any sort of networking.
I believe it's industrial protocols used to connect such devises to a SCADA system. It this case it's the SCADA system that has to be disconnected from any general purpose networks.
The freezer itself doesn't need to connect to a SCADA. You can network power and temperature monitors, but those monitors don't need the ability to shut off the freezer.
These freezers are manually stocked and cleaned. If they need to be powered down it's a simple matter of a hardware switch that you flip when the unit is empty.
Ireland too: https://news.ycombinator.com/item?id=50335252
Maybe we should stop connecting things to the Internet that don't need to be?
I don't understand why these things aren't on their own (V)LAN. Why they are open to internet?!
Brainstorming here; monitoring, logging, etc. The fact the store managers were called out of bed when there was an issue indicates it works. If a cooler broke down overnight or its temperature was too high for X amount of time, they have to discard the products. Without monitoring they likely wouldn't know until customers got sick.
I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.
given they turned off the refrigerators (instead of something evil like turning them down for just long enough to allow bacterial growth and then turning them back up) customers would probably have noticed their ice cream being liquid, the frozen meat not being frozen, etc
>I wish commenters (in general) would do a bit more "steelmanning" before asking questions about why something is (in this case) connected to the internet.
People won't steelman because the answer to "why are the fridges slapdashedly networked?" is too often "because people of my ideological bent and demographics if not literally me previously demanded paper trails, audit-ability and regulatory compliance that was impossible for a low margin industry to pull off any other way."
Will the insurance pay out on this? It would be negligent to have this exposed to the internet - was it?
Especially given the recent precedence of hacked freezers.
That's an interesting angle, that would explain why some bothered to hack fridges and waste food.
Why can a fridge go to 50ºC ?!
You want them back to use very fast after they have certain amount of icing. So you want powerful heating elements there and those are cheap anyway. Fridge or freezer not in use doesn't make money in a store.
It happened in France on 12 October: https://www.bbc.com/news/articles/crq5nzxv9q4yo
i know some of us are thinking "if you consistently fail to ensure your ability to make high-severity security patches reach critical internet-exposed systems on time you lose your ability to operate the business and probably get jail time"
but what about the deranged (and very prediction market–brained) version of this idea: the government develops ransomware, in a manner functionally similar to towing cars or confiscating illegal items, and uses it against companies in proportion to their revenue and obviously puts the money towards improving the ransomware
"the r in rsi stands for…"
i'm not sure it's something i want to see, but i don't know if it's impossible for it to actually come to pass or merely unlikely
(of course, cross-government versions of this are much more likely to come about but not as ransomware)
This is exactly the kind of thing we've all been warning about ...
(... in hacker forums)
Why the fuck does a freezer need access to the Internet in the first place?
It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?
It would take people listening to professionals and getting rid of several decades worth of bad habits amongst users. Same as most other places really.
What makes you think Europe is uniquely vulnerable?
In fairness they probably don't tend to use internet connected freezers in Africa.
I live in Africa, still amazed by the idea of connected freezers haha. Didn't know it exists out there.
> It truly feels like Europe is just collectively shrugging at their lack of preparedness and aggression they face. What’s it going to take for them to take their own security seriously?
I'm quite sure your average American company is just as willing to plug random shit into the internet.
Hell, there are probably hundreds of reports out there of American companies failing to secure their AWS S3 buckets, so you don't even have to plug anything into the internet.
Your average American company is running on China.
The problem is the ironic "home grown" or "internal" security. These external attacks come after decades of fertilizing far right white politicians whose sole purpose is to dither any directed anger.
Brexit was the first to burst and despite their support of Ukraine, can at any moment capitulate to the ghost of nationalism and delusional escapism that is "white power". Americas on the verge of sinking further into the same. With those two entirely preoccupied, of course europe is next and already has the same underlying current.
... Who the fuck is putting this shit on a network that's not closed circuit?
Vendors install these so the store owner and them have easy access to alarms and controls.
A VPN per store would be too complex for the vendor so they just expose these to the open.
Same story as with all the hacked OT/SCADA systems in the past.
Two things worth keeping in mind:
1. Connecting them was probably considered best practice when they were installed in 2005 2. Their support contract required them to stay connected