Top
Best
New

Posted by Zeekaas 13 hours ago

Hackers activate automatic defrosting in supermarket fridges across Europe(www.tomshardware.com)
https://www.reuters.com/business/retail-consumer/french-supe..., https://www.bbc.com/news/articles/crq5nzxv9q4yo, https://www.lemonde.fr/en/france/article/2026/10/12/french-s...

Related:

https://www.claroty.com/team82/research/freeze-the-controlle...

I think the military commissary's freezers were hacked - https://news.ycombinator.com/item?id=49508506 - Aug 2026 (239 comments)

436 points | 648 commentspage 7
fennecfoxy 12 hours ago|
I wonder if AI would have helped in this situation.

For example [request to defrost n fridges in y locations]->[agent cannot find any emails or business communications about this and last defrost report was only a short time ago, contacts z personnel]->defrost task moved to manual confirmation by a human.

I know many will roll their eyes and "tchh" at it but look at number of AI related topics on HN front page and think to yourself if you're tired of this tech not being used for real applications or not. This would be a real application.

"But it could be tricked" well...regular requests can apparently already be hacked, so...

BenjiWiebe 1 hour ago||
But it's so inefficient to run AI everywhere all the time for everything.
platevoltage 6 hours ago||
In all likelihood, AI enabled this to happen in the first place.
throw-the-towel 9 hours ago||
How in the name of fuck was a fridge even designed to be able to heat itself to 50 degrees C?
alwa 9 hours ago||
Fridges tend to have built-in defrost cycles these days. Without that, ice builds up around the coils that ordinarily cool the compartment (and by extension the ambient moisture in the air, encouraging it to condense). And you'd have to thaw it yourself from time to time.
NetMageSCW 6 hours ago||
50C seems a bit overkill for a defrost cycle.
mrob 2 hours ago|||
Hot and fast defrost doesn't heat the food as much.
dn3500 9 hours ago|||
It's probably just running the heat pump in the other direction. 50° sounds about right for the hot side. I expect that the hotter the better, because it will melt the frost without warming the food. And if a bad guy hacks in to the freezer, he can probably override any kind of temperature control and just tell the compressor to run full out.
zacharycohn 9 hours ago|||
Every refrigerator has a defrost cycle - which is just a heater. It normally only runs for a few minutes at a time, but if you change some bits around, it could run for a lot longer and a lot hotter.
gizajob 9 hours ago||
I thought that. Now looking for the heat setting on my fridge. I guess it’s in case you need to antifridge sometimes.
SpicyLemonZest 9 hours ago||
> Danfoss told AFP in a statement that most of the affected equipment was "legacy" products which "no longer receive software or security updates".

I worry that this kind of thing is going to be a recurrent problem. A lot of people have pretty strong intuitions, or even an explicit moral position, that they should never have to upgrade a physical machine that's working fine. Is there a threshold of vulnerability that will overcome that, or are we just going to see a lot more hacking of random infrastructure from now onwards?

robinsonb5 8 hours ago||
I'd hope what we'll actually see is people finally demanding that appliances with no need of an internet connection don't get connected to the internet!
asdff 6 hours ago|||
Even if you are keeping updated buying your new fridge every 2 years like the manufacturer wants, that still doesn't guarantee you are out of the woods from this issue. By definition, security patches are retroactive, after it has been made obvious that there has been a security incident.
dopa42365 8 hours ago|||
Would such a thing even be covered by insurance? Or is it negligence for using a product after it might turn into an unstable bomb at any time?

On the other hand, wild that it doesn't revert to some sort of offline backup mode after warranty ends. Or that anyone bought it in the first place (that can't be standard in the industry, right?).

umeshunni 8 hours ago|||
I would expect a refrigerator to work 20+ years. What does a legacy product even mean this situation?
SpicyLemonZest 8 hours ago||
The article makes it sound like these were intentionally networked refrigerator control units, not the actual refrigerators. But I’m not an expert, so I can’t rule out that it’s not possible to run a commercial refrigerator without one of these.
alphawhisky 8 hours ago||
I mean, you could also argue that the lack of reliance on physical controls caused the incident in part. For example, a City's public works department may have remote access/control for some of their equipment, but they also have a kill switch that removes all connectivity and reverts the system to a default setting. They also have checks in place like "if the unit heater will be overamped, turn it off." This seems like it was caused by a lack of security considerations when making these devices "online". Old tech can work very well for a long time as long as it is modernized correctly.
kotaKat 13 hours ago||
... Feels like deja vu. Didn't the US military just have this happen at its military exchanges... a month or two ago?

Yes, yes they did. https://www.militarytimes.com/news/your-military/2026/08/28/...

"ALL freezers went into defrost mode – ALL frozen food has spoiled".

bastard_op 10 hours ago||
I realized upon reading too this was the same Danfoss fridges that got hit for .mil bases in the US. There's probably a shodan signature to find them on the internet because HVAC people don't know about network security, and someone has a trivial exploit to access them due to shitty ancient embedded controller security in them.
ninefathom 13 hours ago|||
This was precisely my first thought upon reading. "Ah, yes - the attack that was PoC'ed against commissaries operated by the US armed forces a bit over a month ago."
arprocter 12 hours ago|||
https://news.ycombinator.com/item?id=49508506
dang 5 hours ago||
Thanks! Macroexpanded:

I think the military commissary's freezers were hacked - https://news.ycombinator.com/item?id=49508506 - Aug 2026 (239 comments)

chimneychanga 13 hours ago|||
Yeah I remember that, and it seems like the military was very hush-hush about the cause. Now I wonder if they were hacked too.
black6 13 hours ago||
Yes, not exactly "unprecedented." The news of Commissaries having their freezers hacked should have been a kick in the rump for everyone else with infrastructure needlessly connected to the Internet.
RugnirViking 12 hours ago||
the sort of people doing this security posture definitely are not up to date on the latest security news...

It would take something truly monumental to make a local supermarket owner even consider the potential for their fridges to be an attack vector.

kotaKat 11 hours ago||
[dead]
porkbellyeee 4 hours ago||
Wait until they discover they’re all filled with butane as a refrigerant.
csvm 8 hours ago||
Here's a fix:

if(temp > 5) return;

stackghost 9 hours ago||
Please, let this be the stone that starts the avalanche of consumers rejecting smart apppliances.

My fucking fume hood on my stove has Bluetooth, because Samsung just can’t help themselves apparently.

astrobe_ 9 hours ago||
I don't disagree, but having remote monitoring capabilities on a professional fridge is most likely not a hipster feature. Even mid-size supermarkets have dozens of them, with different temperature settings; they can fail, customers can block the doors, etc. You do want to receive an alert when something is wrong.
codedokode 9 hours ago||
Those devices should be connected to air-gapped local network and not to manufacturer.
pixl97 8 hours ago||
You don't seem to understand what these systems do at all. Air gapped takes about 80% of the usefulness away.
sdcfgy 9 hours ago|||
Why the fuck does a fume hood need that?!?!?!?!
palmotea 9 hours ago|||
> Why the fuck does a fume hood need that?!?!?!?!

Why, so you can turn it on from your smartphone when you're out of town, of course!

djeastm 9 hours ago|||
"Oh, Honey, I think we forgot to turn the stove off!"

"Well, I can't help you there, but I can turn off the fume hood from my phone!"

"..."

url00 9 hours ago|||
But it's Bluetooth so short range only? So it's not even good for that?
stackghost 9 hours ago|||
Exactly!
red_admiral 8 hours ago|||
These are industrial fridges, the ones almost the size of a shipping container that you find in major supermarkets. But I agree with you that 'smart' home IoT is a shitshow.
asdff 9 hours ago|||
What compelled you to buy a stove hood with a cpu and blutooth radio?
stackghost 9 hours ago||
It was there when we moved in.
asdff 9 hours ago||
Would have been a red flag for me on the apartment tour haha. I once leased a place like this. Paid app needed to receive packaged mail. Never again.
brown9-2 9 hours ago|||
Why would this time be any different than the last hundred times?
qurren 9 hours ago||
Honestly I like smart appliances. For example, I have a home assistant integration that will sound an alarm if a stove burner is on but no person is detected in the room, and a handful of other similar safety-related conditions.

But they don't need to be cloud-connected through some big corp's cloud. I want them local and firewalled, ideally.

EliRivers 9 hours ago|||
sound an alarm if a stove burner is on but no person is detected in the room

Can you turn that off or do you just have to put up with the noise?

qurren 8 hours ago||
It's a situation that shouldn't happen in the first place; house rule is someone should be around if the stove is on.

Of course we can control it, it's all wired up via Home Assistant.

irishcoffee 9 hours ago|||
I prefer the freedom of putting a pot of water on to boil and walking off to take a leak, personally. That would drive me absolutely insane.
qurren 8 hours ago||
1. We prefer to be safe, and shut the burner off while going to take a leak. It helps that we have a several thousand watt induction stove that boils pots of water in a few minutes, so there is no real need to parallelize boiling water with bathroom breaks.

We specifically want to prevent scenarios like: you take a leak, the leak turns into a shitting session or a phone call, you forgot you left the burner on.

2. Most of the time my wife and I make food together so if one person needs to take a leak the other one is around anyway.

3. For long slow cooking, we have plenty of comfy seating in the kitchen/dining area where we can get work done while being in sight of pots.

4. We have 2 pets we'd need to locate in an emergency, and so we tend to put electrical and fire safety higher than most people.

robthebrew 13 hours ago||
TomsHardware hit? I'm getting spinning beachballs on this link
pjmlp 12 hours ago|
[flagged]
lightedman 9 hours ago|
Of all the things to put on a network, this ranks as one of the dumbest, ever. You don't need control of the unit done over a network, just the data on whether it is working or not. Anything else is simply asking for someone else to come along and break your stuff.

To boot, refrigeration has been wholly automatic for decades. It literally runs itself. It doesn't need any network connectivity other than to say "I work" and "I'm broken" and that's it. Allowing control commands to be sent over the network is, yet again, just asking for trouble.

More comments...