Link: https://www.theguardian.com/world/2026/oct/17/who-hacked-frances-supermarket-fridges

A good article which covers a lot of aspects, including what happened technically, which software flaws were exploited, that the problem affected refrigerators which did not have updated firmware. It also mentions the EU cyber resiliency act, which has the specific goal to avoid such events.

Making industrial systems secure will be many years of work, since many are decades old and software and protocols were not designed with security in mind. This also affects consumer "smart home" systems and things like "smart TVs", which are often not designed to have needed updates.

Worth mentioning that the effects of systematic attacks could be far worse - they can take out electricity, energy, and water infrastructure, payment systems, and bring things like chemical plants into an catastrophically unsafe state. The thriller "Blackout - Tomorrow will be too late" by Marc Elsberg describes such a (fictional) scenario with hacks targeting smart meters and industrial control systems for power plants, and it is in parts more realistic than one would wish. IIRC there have been such hacks targeting the oil company Saudi Aramco.

Here is a detail that the Guardian article does not mention:

https://cyberplace.social/@GossiTheDog/117429502412235079

So, it looks like the account was "admin" and the default password was the current date.

Assuming this is true - No, with that level of security you really don't need a nation state attacker to take all your infrastructure out. With the knowledge that there is a search engine called "Shodan" which lists internet-connected systems of a specific type, any teenager can do this.

Given this, these comments from the Guardian article:

Gérôme Billois, a partner in the cybersecurity and technology company Wavestone, said the hack had the hallmarks of political sabotage.

“The two most feasible scenarios are either it was a group of youngsters or activists who wanted to blow up a few freezers to prove what they could do, or it was a destabilising attack, what we call sabotage, by internal or external state actors,” he said.

“As for the attack’s signature, the most likely scenario is still a destabilisation attack – one designed to convey the message to populations that they are not safe, to convey the impression that the government is falling apart, and ultimately to instil fear.

are likely due to either total incompetence, or plain disthonest to deflect blame for lacking even most basic security measures.

(But I need to disclaim that I did not check that this reported default password setting is true. If it is, a lot of people should be fired.)

Also not cool: Who is the idiot that thought an insecure remote connection to fridges from 100 supermarkets was a great idea?

I mean my homies on !selfhosted@lemmy.world are asking daily how to set up a secure remote connection for their stuff and the answer is almost always "avoid if you can"

Fridges being hackable in the first place is beyond a joke. I think it's a ploy for the manufacturers to gather data from people downloading apps and making accounts, thus is for the benefit of the business and not the consumer.

Why on earth would one need to remotely change the temperature in a supermarket fridge anyway? In the 8 hours the store is closed, there is no reason one would need this, and their underpaid employees could just be sent if for some off the wall reason they needed to.

It's not the stores fault necessarily that they have internet fridges, because those are probably the only ones on market. Industry is forcing us into total surveillance.

I wanted to argue "for monitoring reasons so that someone notices when the temperatures are rising and something might be defect". But then again you could just have a local sensor that reports to a server without the need for a remote connection TO the fridge...

Why the fuck does a fridge need to be connected to the internet?

Help me with that: I'm self hosting lots of stuff and half the point of it is, that I can use it from anywhere. With reasonable encryption and mTLS where possible, that seems pretty straight forward and manageable.

If you know what you are doing, there is nothing wrong with it. But the first question you should ask yourself before talking about methods is "Do I need to use this functionality remotely?" If the answer is yes, then know your shit and keep your software up to date. In this case the company misanswered the question and they kept their software insecure.

So it can receive security updates. We don't want it to get hacked, no?

Do you even have to ask?

@HaraldvonBlauzahn This is what #IOT will bring to everyone!!

Yep. The "s" in "IoT" stands for "security"!

@elvith @bedwyr the fridge itself has a lot of sensors and being able to read and aggregate the data they produce may lead to intervene before something breaks. But having them publicly available on the Internet is a very, very, very stupid thing.

@001 @HaraldvonBlauzahn those are industrial fridges, I don't think that there is any kind of app.

@HaraldvonBlauzahn the password was not the current date, but was based on it.

https://wikileaks.org/vault7/

... where possible, ...

So these fridges where possibly one of those exceptions and look where that ended up. :-(

mTLS is an excellent choice since it stops an attacker at a much lower level, but its not the only one if your service wont allow it. Tried and true VPNs like wireguard , IPSEC or openVPN should be put in front of any WebGUI, HTTP(S)-API, telnet or other high risk services if you cant do mTLS.

These are not your average home fridges with a "smart screen". It's possibly a million euro industrial systems that are keeping thousands of euros worth of product safe (multiplied by the number of stores).

It needs monitoring, alerting and the possibility to be updated, preferably by a trained professional.

Can this be done simply and securely? 100% and its not even that hard... they fucked up.

The scale of the attack doesnt seem like it was meant to cause problem with food suppily. While it was somewhat far reaching, it was still that one storechain. I think it was either test to gauge the response, some gray hacker exposing pretty horrible level of security in a way that cant be ignored or some random asshole causing problems because they can. Only benefit i can think of for state level actor would be to use this as distraction to something else.

With security level that shitty, it could easily have been just some random asshole causing problems for no reason at all. Doesnt take state level hacker to break into system where username is admin and password is just date of current day..

Good thing the storechain didnt get any money from insurance. maybe they and others will learn their lesson from amount of money lost. Imagine if every store has this shitty security and someone coordinated an attack on everywhere at the same time. What bad level of security does is it widens who is able to break into there. (state level actors would be able to break into almost anywhere that is civilian level security, i think. Some random mid tier hacker might not)

@HaraldvonBlauzahn And clearly it was missing here. 😉