Hackers have forced the temperature of many French supermarket fridges up to 50C overnight, in an “unprecedented” cyber-attack affecting several hundred stores across the country, with fires and food losses reported.

The Paris prosecutor’s office said on Monday ⁠the large-scale attack was “affecting connected refrigerators ⁠in several ​major food retailers across France”. Reported damage included “food losses and fires”, it added.

The prime minister, Sébastien Lecornu, instructed France’s national cybersecurity agency ANSSI to investigate, ⁠a person in his office said.

France “was coordinating with its European counterparts, as other countries may also be affected”, while also investigating whether any other French ⁠firms were at risk, they said.

all 21 comments

sorted by: hot top controversial new old
[–] 17 points 3 weeks ago

Username was admin, password automatically changed to the current date. Not so much a hack as bad cybersecurity. They were warned not expose the management interface to the internet. Vendor did a bad job, left the key under the mat.

  • source
  • [–] 16 points 3 weeks ago (10 children)

    Why are refrigerators Internet connected?

  • source
  • hideshow 10 child comments
  • [–] 11 points 3 weeks ago (8 children)

    Remote monitoring for equipment health. A data logger for maintenance is reasonable.

    Why they would have anything other than local control over temperature is the questionable part.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 9 points 3 weeks ago* (7 children)

    Well, the temperature control and the remote monitored variables probably aren't air-gapped. So if you gain access to the remote monitoring, you're already in the system, from where you can attack the rest of the system. Ofcourse you could design the system so that there's no link between the monitored stuff and the rest, but then you'd need extra components so there's a financial driver not to do this if you build this kind of equipment.

    Edit: this is all assuming that the system isn't by design remote controllable, and my guess would be that it probably is. It allows equipment builders/suppliers to help their customers with "remote troubleshooting".

  • source
  • parent
  • hideshow 7 child comments
  • [–] 6 points 3 weeks ago (5 children)

    They should copy some ideas from the manufacturing industry. If you want to change settings, you need to be physically on site. If you just want to monitor the system, you need to use the company-provided laptop and a VPN.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 6 points 3 weeks ago (3 children)

    I work in manufacturing, and the trend there is that most machine suppliers will deliver a machine with it's own PLC where the programming is walled off. They then offer you subscription based support, where they can connect remote through vpn or with a router/5G connection. You need tech-savvy managers to understand the huge risk this carries. Fortunately, lots of people are waking up in Europe due to the NIS2 directive.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 3 weeks ago (2 children)

    Ok, so the fancy new systems are even worse than I expected. I have some experience with the older ones though.

    Either those systems were never designed with the Internet in mind, or the people who installed them knew what they were doing and disabled all the unnecessary connections and features. Either way, the systems I've seen are probably pretty tricky to hack. I you want to change anything, you would need to be physically in the same network as the automation system itself.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 3 weeks ago (1 child)

    That's pretty much my experience too. I also just read that the Danfoss hack involved the username admin and for the password the date of today. A company like Danfoss should really know better, even if it was never meant to be connected to the internet.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 3 weeks ago*

    When I was a manufacturing engineer back in 2016 I ended up on a conference call between maintenance, myself, and the manufacturing engineer that programmed the equipment 2 timezones over. I walked maintenance through the physical set up while on my couch at home, but couldnt find the position reset button in the program on my laptop for a servo drive so I called up the guy who programmed the machine to ask if he could remote in and click the button, also from home.

  • source
  • parent
  • [–] 6 points 3 weeks ago

    The article said the defrost cycle was trigged which is what heated the fidges to 50C (I was a bit confused at first as to how they could make them heat up past room temp).

    I can imagine use cases for remotely controlling the settings in all the fridges across your hundreds of stores, but I suspect there might be a bit more hesitancy to buy the remotely controlled fridges now.

  • source
  • parent
  • [–] 13 points 3 weeks ago

    We need more smart devices…

  • source
  • [–] 4 points 3 weeks ago (1 child)

    What I want to know is what kind of refrigerator can even achieve 50c?

  • source
  • hideshow 1 child comment
  • [–] 8 points 3 weeks ago

    They often have pretty powerful heaters for defrosting, even your household fridge has a heating coil tucked inside somewhere: Ice takes a lot of energy to melt quickly, and refrigerators are very well insulated so once they're heating up there's nowhere else for the heat to go. Refrigeration (using phase change) is paradoxically much more energy efficient than electric resistance heat (which is what is usually used for defrosters, because of cost minimization) so it's not uncommon for the defrost heater to be significantly more powerful than the whole refrigeration side, because the defrost heater is only intended for very occasional use to literally de-frost the coils before turning off again. In this case, it sounds like the de-frost heater was used repeatedly or indefinitely and the cooling shut off.

  • source
  • parent
  • [–] 3 points 3 weeks ago

    I guess the rest of the world is now questioning their decision to buy "smart" devices. It seems to me that businesses before tech were way less expensive to run and manage than post-tech capitalism with all of it's tricks, shenanigans and chicanery. The money they think they saved by replacing people with tech sounds like it wasn't worth it.

  • source
  • [–] 2 points 3 weeks ago

    Bruh useless cyberattack that does no good for anybody. Not a political hack, remotely funny, or affect good change economically

  • source
  • [–] 1 point 3 weeks ago

    I read some freezers went way past that and heated up to 80°C.

    That seems enough to actually cook most of the stuff.

  • source
  • [–] 1 point 3 weeks ago

    It seems like shooting themselves in the foot if the hackers don't have anywhere to buy food from

  • source
  • [–] 1 point 3 weeks ago (1 child)

    Stunt totally backfires when it turns all the milk into cheese.

  • source
  • hideshow 1 child comment
  • 8 comments in c/world view that post
    [–] 8 points 3 weeks ago (4 children)

    Actually read the whole article and was disapointed (but not surprised) that there was zero explaination for why anyone thought a “remote defrost” capability was a good idea.

    🎯 1
  • source
  • hideshow 4 child comments
  • [–] 5 points 3 weeks ago (3 children)

    Paying a crew of people vs paying a smaller crew of people to service a lot of freezers.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 3 weeks ago (2 children)

    You still need people on site to empty the freezers before they are defrosted, so it’s not like you wouldn’t have someone on site available to turn a dial or flip a switch (even at the direction of a remote expert).

    In the article the manufacturer did blame out of date firmware, and the customer's failing to keep firmware up to date. So sounds like the classic circular logic of “why does my toaster need internet access?” “So it can get security updates.” “Why does it need security updates?” “Because it has internet access.”

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 3 weeks ago (1 child)

    As someone that worked at a store stocking shelves when I was fresh out of high school, I wouldn’t trust those folks to adjust freezer settings.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 3 weeks ago

    This is what you get for buying an internet connected "smart" freezer. Yeah, the internet is so smart. Ha.

  • source
  • [–] 1 point 3 weeks ago

    Police say negotiations with perpetrators slowly thawing.

  • source
  • [–] 1 point 3 weeks ago

    I pray the admonishers never get caught.

  • source