Hackers activate automatic defrosting in supermarket fridges across Europe

Original Article ↗ Hacker News Discussion ↗

Hackers have remotely triggered the defrost cycle on internet-connected commercial refrigeration systems across European supermarket chains, spoiling food and disrupting operations, with similar incidents recently reported at U.S. military bases. Commenters link the attack to long‑known vulnerabilities in Danfoss controllers, insecure industrial IoT practices, and legacy devices that no longer receive security updates but remain exposed on the public internet. The incident is cited as a warning about the systemic risk of connecting critical infrastructure to the network without strong isolation, defaults, and liability, even as retailers rely on remote monitoring to optimize energy use and maintenance costs.

Technical cause and scope

  • Attack targeted Danfoss refrigeration controllers (AK‑SM/AK‑SC series), many of them “legacy” models no longer receiving security updates.
  • Prior research (Claroty link) found: thousands of controllers directly exposed on the public internet, a “code-of-the-day” backdoor-style auth mechanism, and command injection in the web interface.
  • Vulnerable units could be remotely switched into extended defrost cycles, heating cases to ~50°C and spoiling food.
  • Some commenters suspect overlap with a similar August incident at US military commissaries; whether it’s the same vuln or group is unclear.

Why are supermarket fridges online?

  • Pro‑connectivity arguments:
    • Remote monitoring of temperatures and failures across thousands of cases.
    • Energy optimization (load shifting, demand response, tuning defrost cycles).
    • Remote diagnostics to avoid rolling trucks and to support thin grocery margins.
  • Counter‑arguments:
    • Monitoring could be one‑way (read‑only sensors, data diodes) without remote control.
    • Many operational tasks still require a human on site; remote write access adds large risk for modest savings.
    • Supermarkets functioned for decades without internet‑addressable control systems.

Security failures and incentives

  • Core criticisms:
    • Controllers listening on 0.0.0.0, often with cellular modems and no VPN or strong auth.
    • Old, unpatched firmware still deployed because hardware is expensive and “if it works, don’t touch it”.
    • Installers and HVAC vendors frequently lack infosec expertise; customers accept “secure enough” sales pitches.
  • Some argue the real failure is architectural: actuators should never be directly internet‑reachable; network segmentation and strict control envelopes are missing.
  • Insurance and razor‑thin margins push operators to defer upgrades until after a costly incident.

Geopolitics and attribution

  • Several participants see this as “hybrid” or fifth‑generation warfare, likely Russian‑linked chaos rather than strategic destruction; others think it could just be “for the lulz” by non‑state actors.
  • Impact is seen as more psychological and trust‑eroding than materially crippling, but worrying as a proof of concept.

Policy, regulation, and future risks

  • Calls for:
    • Stronger liability for OEMs (EU Cyber Resilience Act cited).
    • Mandated long‑term security support or source‑escrow for critical products.
    • Treating insecure SCADA/IIoT as a national‑security issue.
  • Broader anxiety about “smart everything”: connected cars, medical devices, EV chargers, lab machines with subscription locks, and the role of AI in both exploiting and defending such systems.