When the Freezer Becomes an Oven: Europe’s Supermarket Refrigeration Attacks
For the second time in about three weeks, attackers have remotely taken over refrigeration controllers in European supermarkets and turned fridges and freezers into warming cabinets. The first wave hit France and nearby countries on the night of 11–12 October. The second wave came overnight into Monday 2 November and reached somewhere between seven and ten European countries. In both waves the hardware involved was mostly made by Danfoss, the Danish company whose controllers run refrigeration in a large share of Europe’s grocery stores.
Large commercial supermarket refrigeration systems are connected to network management units (like Danfoss StoreView or AK-SM controllers) to monitor and control temperatures, automate defrost cycles, and manage food safety alarms remotely.
Nobody had broken into the stores themselves. The attackers reached small web-managed controllers that had been left reachable from the public internet, and they changed a few settings.
Wave one: France, 11–12 October
On the night of 11 October, refrigeration controllers in hundreds of French supermarkets were switched into defrost mode while the cabinets were still full. Defrost mode is normally a short, scheduled cycle that melts ice off the evaporator coils. Left running for hours, it heats the cabinet. Alarms reportedly did not go off, and few staff were in the stores overnight.
By morning, many cabinets had reached around 50 °C (122 °F), and one store in Normandy reported 80 °C. Estimates of the number of stores range started from about 150 and later was increased up to 700. Affected chains included Intermarché, Netto, Carrefour, Coopérative U, Monoprix and E.Leclerc. Food losses were estimated in the tens of millions of euros. Reports also placed affected sites in Belgium, the Netherlands, Spain, Portugal, Poland and Germany.
France’s national cyber agency ANSSI, through its response team CERT-FR, published an alert on 12 October and updated it on 13 and 16 October. The alert names four product families: Danfoss AK-SM series, Danfoss AK-SC series, Copeland XWEB and Dixell XWEB. Prime Minister Sébastien Lecornu told ANSSI to investigate and to coordinate with other European countries.
Wave two: Europe, 2 November
The second wave followed the same pattern on a wider scale. Overnight into Monday 2 November, supermarket fridges and freezers were again pushed into defrost mode, with temperatures reported at about 50 °C. Belgium, Luxembourg, the Netherlands, Sweden, Finland, Estonia, Ireland and Italy were affected, along with reported incidents in Greece. Reported victims included Coop and ICA in Sweden, Ahold Delhaize stores in Belgium, the Netherlands and Luxembourg, and Spar and Carrefour in Belgium. Small independent shops were also hit, including a butcher near Athens.
An ICA spokesperson said all of its affected stores were connected to an outside refrigeration control system supplied by Danfoss. EU agriculture commissioner Christophe Hansen called it “a deliberate attempt to disrupt our food supply chain.” A European Commission spokesperson said the incidents “are not isolated” but would not say who was behind them.
The equipment: two retired models and one current one
Reporting points to three Danfoss products:
| Model | Status | Why it was exposed |
|---|---|---|
| AK-SC355 | End of life (reportedly 2016) | No security updates. Danfoss has advised replacing it. |
| AK-SM800 | End of life (reportedly May 2021) | No security updates. Danfoss has advised replacing it. |
| AK-SM 800A | Current product | Units still running firmware older than R4.3.1, released in 2025 |
After the first wave, Danfoss confirmed that AK-SM800 and AK-SC355 systems were involved. The company described most of the affected equipment as “legacy” products that no longer get software or security updates, and said it had long urged customers to update firmware and move to current-generation systems.
The AK-SM 800A is a more uncomfortable case because it is still sold and supported. Its weaknesses are already public. In 2025 Danfoss published advisory DSA-2025-08-01, and CISA published ICS advisory ICSA-25-140-03 on an authentication flaw in AK-SM 800A system managers. In August 2026, Claroty’s Team82 described three vulnerabilities in detail:
CVE-2025-41450: an authentication bypass through a hidden “code of the day” mechanism (CVSS 8.2)CVE-2025-41451: an OS command injection in the alarm e-mail settings, giving remote code execution after login (CVSS 7.6)CVE-2025-41452: an Nginx configuration injection that can cause denial of service (CVSS 5.4)
For more details of those vulnerabilities, read those documents:
- Team 82: Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers
- Censys: Frostbitten in France: A Danfoss StoreView Internet Exposure Report
Firmware R4.3.1 fixes these. According to the reporting, the AK-SM 800A units that were hit were the ones never updated to it. Claroty counted 2,765 AK-SM 800A devices exposed to the internet in a Censys scan, and other estimates put the number of reachable Danfoss controllers higher.
Security researcher Kevin Beaumont described the login logic on some of these devices as a password that is simply the current date. Claroty’s analysis of the same “code of the day” logic treats it as a hidden bypass rather than a default password. Either way, the result is the same: anyone who finds the controller online can log in.
No zero-day needed
Experts agree on one point: this was not sophisticated hacking. Darktrace’s Nicole Carignan said attackers got in through internet-facing controllers, end-of-life firmware and default passwords, and that no zero-day was used. Richard Horne of the UK’s NCSC said the French fridges had been connected directly to the internet with default passwords. UK cyber minister Liz Lloyd called the French attack exploitation of known vulnerabilities.
So far nobody has claimed responsibility or been named. Investigators have not established a motive. Some researchers have pointed out that the attack is simple enough for opportunistic hackers, while others note that state actors have the capability too. Both waves struck overnight, used the same technique and spread across borders, which looks more like a coordinated campaign than random vandalism.
What operators should do now
The CERT-FR alert has the clearest practical guidance:
- Take the controllers off the internet. Remove any direct internet exposure and any device with a public IP address.
- Use only secure remote access. Service contractors should connect through a VPN or protected network. Filtering contractor IP addresses on a firewall is acceptable as an emergency measure only, not as a permanent fix.
- Patch and harden. On current Danfoss systems, update the firmware (R4.3.1 or later for the AK-SM 800A), set the security level to Strict, and make sure default passwords have been changed.
- Check the configuration, especially defrost schedules, before putting a unit back into service.
- Don’t rely on a factory reset. A reset end-of-life device is still vulnerable. CERT-FR warns that leaving an unpatched EOL controller on the internet will very likely lead to compromise again.
- Plan to replace the AK-SC355, the AK-SM800 and any other unsupported controllers.
Retailers should also make sure temperature alarms are monitored independently of the controller that might be compromised. In both waves, the alarms that should have woken someone up apparently stayed silent.
The bigger lesson
Refrigeration is part of the food supply chain, and in hospitals and blood banks it can be safety-critical. Yet these controllers are often installed and maintained by outside contractors, connected to the internet for remote service, and then left alone for ten years or more. As Professor Aikaterini Mitrokotsa of the University of St. Gallen told AP, a fridge does not look like a security risk, and that is exactly why attackers like it.
The patches and guidance for these devices were already available before the attacks. What was missing was an inventory of the devices, a plan to retire old ones, and the habit of treating a fridge controller as an internet-connected computer. A third wave is likely, and every store with an exposed controller is a candidate.
Sources
- CERT-FR (ANSSI): CERTFR-2026-ALE-012 – Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération
- Facilities Dive: Hack of Danfoss refrigeration controllers in Europe causes tens of millions in food losses (13 Oct 2026)
- Facilities Dive: European grocery stores hit with second refrigeration system hack (3 Nov 2026)
- PBS NewsHour / Associated Press: Here’s what to know about another cyberattack on European supermarket fridges (3 Nov 2026)
- Claroty Team82: Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers (9 Aug 2026)
- Danfoss: Security advisory DSA-2025-08-01
- CISA: ICS Advisory ICSA-25-140-03 (Danfoss AK-SM 800A)
- Wikipedia: 2026 French supermarket refrigerator hack (background and end-of-life dates)
- The Hacker News: New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe
- CNN: What to know about the cyberattack that targeted supermarket refrigeration systems in France
90 Comments
Tomi Engdahl says:
As AI exposes flaws in IT systems and geopolitics plays out on the cyber frontline, some experts say the events of recent weeks could soon be a common occurence
https://www.theguardian.com/news/ng-interactive/2026/nov/08/hot-fridges-a-fake-nuclear-alert-and-a-6bn-heist-are-we-in-the-foothills-of-a-hacking-epidemic?CMP=fb_gu&utm_medium=Social_img&utm_source=Facebook#Echobox=1794127366
Hot fridges, a fake nuclear alert and a $6bn heist: are we in the foothills of a hacking epidemic?
Dan Milmo and Aisha Down
As AI exposes flaws in IT systems and geopolitics plays out on the cyber frontline, some experts say the events of recent weeks could soon be a common occurrence
Alex Pearce was doing the morning rounds at his fruit and vegetable wholesale business in London on Monday last week when he noticed something odd.
The defrost light on refrigeration unit 2 was on, and the panel reading was 150C. Unit 4 was the same.
Tomi Engdahl says:
You hit on the exact reason why these headlines created a debate in the cybersecurity community.
Security professionals were largely unsurprised because the underlying flaws—such as hardcoded default credentials (admin / 12345) and predictable date-math authentication bypasses (Code of the Day, CVE-2025-41450)—represent decades-old, textbook security anti-patterns. They didn’t require an advanced intelligence breakthrough to discover.
However, the connection to AI in the context of these attacks involves two distinct angles:
1. Did AI find the flaws originally?
No. The vulnerabilities were discovered and analyzed through traditional security research methods (such as reverse engineering firmware binaries in tools like Ghidra and manual code auditing by human security teams like Claroty Team82).
2. Was AI used to execute or scale the attacks?
While attackers didn’t need a cutting-edge AI model to guess credentials that were literally written in open user manuals, security experiments conducted shortly after the outbreak demonstrated how low-barrier AI tools lower the execution threshold:
* Researchers demonstrated that using consumer-grade AI coding and reasoning agents (such as Claude Sonnet via development environments), a user could take public vulnerability advisories (CVE-2025-41450, CVE-2025-41451) and automate the reproduction and chaining of the exploit code for a few dollars in under half an hour.
* Intelligence officials (including representatives from agencies like the UK’s NCSC) pointed out that while the flaws themselves were trivial, AI-driven automation is accelerating the speed at which threat actors can scan global IP space, identify legacy operational technology (OT) equipment, and weaponize known vulnerabilities before small businesses can patch them.
The Bottom Line
The headlines about “AI-driven attacks” are partly sensationalized framing. The refrigeration hack succeeded not because of hyper-advanced artificial intelligence, but because thousands of industrial devices were left wide open to the public internet with default factory passwords—a failure of basic human cyber hygiene.
AI’s role in this scenario is largely as a force multiplier for speed and scale: it allows low-skill threat actors to rapidly operationalize trivial, poorly written legacy code across thousands of targets simultaneously.
Tomi Engdahl says:
Spot on. That “probing” phase is exactly how threat actors turned a collection of isolated vulnerabilities into a synchronized, multi-country operation.
Security researchers and incident reports looking back at the October 2026 French outbreak and the subsequent November European wave noted a very distinct playbook:
* Mass Reconnaissance & Fingerprinting: Before a single fridge was forced into defrost mode, attackers spent weeks running automated sweeps across global IP blocks. They specifically targeted the default ports and web service signatures used by industrial supervisory controllers (like Danfoss AK-SM units and Dixell/Copeland XWEB dashboards).
* Cataloging Vulnerable Endpoints: Using tools similar to Shodan or custom python scripts, they mapped out which grocery store IPs had management interfaces answering on the public internet.
* Automated Credential/Exploit Validation: The probing phase identified which units were running unpatched legacy firmware (making them vulnerable to the date-math bypass/Code of the Day) versus those that could simply be entered using default factory credentials like admin / 12345.
* The Staged Payload Drop: Once the target list was fully mapped and categorized, the actual destructive payloads (the commands forcing max defrost heating) were queued up and deployed simultaneously overnight across hundreds of locations to maximize the surprise and food spoilage impact.
The probing phase proves that this wasn’t random vandalism—it was a systematically prepared campaign that capitalized on the fact that thousands of critical cold-chain systems were sitting entirely visible and undefended on the public internet.
Tomi Engdahl says:
About https://www.theguardian.com/news/ng-interactive/2026/nov/08/hot-fridges-a-fake-nuclear-alert-and-a-6bn-heist-are-we-in-the-foothills-of-a-hacking-epidemic?CMP=fb_gu&utm_medium=Social_img&utm_source=Facebook#Echobox=1794127366
The Guardian piece groups the refrigeration attacks into a broader narrative about AI accelerating exploit discovery and driving a new wave of physical-digital sabotage.
From a freezer’s point of view, the article essentially highlights the absurd reality of modern IoT engineering:
* A heavy-duty, insulated box meant to hold frozen food for 15 years was given a web server, hooked directly to the public internet without a firewall, and left running default passwords like admin / 12345.
* It didn’t need a super-intelligent AI to ruin its contents—just a basic script reading an open IP address telling it to turn into an oven.
As the article notes, the ultimate fix isn’t complicated: stop gluing internet connections to appliances that just need to stay cold.
Tomi Engdahl says:
I can agree all cyber attacks should be a massive wake up call to everyone. Maybe call to wider number of people. I have has my wake up call long time ago.
We live our lives too much on a digital age, where it seems like morons are installing modt of our essential digital services in unsafe way.
We kinda need to change that.
Tomi Engdahl says:
Beata Asiimwe traceability of temperature control in the food / manufacturing industry. You have to jump through so many hoops for certification and temperature control being a major CCP being able to download data / graphs show trends etc. it’s true manual recordings always used to happen but they’re easily manipulated where digital records are what they are.
Chris Bryan at the same time the readings dont need to be linked to the controls
Hector James Haddow for call out costs they do. Could be an easy remote fix. Where if you’re paying call outs every time it alarms it gets expensive.
Tomi Engdahl says:
So what we are saying is that the freezer companies don’t do their job in securing systems and sharing information. Obviously the owners of internet connected freezers do not read the news and just disconnect the freezers from the internet either. These freezers WILL run without the internet. And it would probably be just as cheap to have a security guard check them on their walk round.
Tomi Engdahl says:
Initial financial tracking and industry damage estimates place the total property and inventory loss at upwards of €10 million.
However, looking at how the numbers break down across the incident, that baseline figure primarily captures direct food waste and immediate equipment stress:
* Massive Food Waste Value: Hundreds of stores across France, followed by a second cross-European wave hitting nations like Belgium, Ireland, the Netherlands, Sweden, and Finland, had to completely throw out entire inventories of frozen, dairy, and fresh goods. Individual store branches reported localized losses ranging from tens of thousands to hundreds of thousands of euros per location.
* Hardware & Infrastructure Damage: Beyond ruined stock, forcing commercial refrigeration units into continuous maximum-heat cycles caused physical component burnouts, compressor degradation, and localized smoke or small fires in several stores, requiring costly mechanical repairs and controller replacements.
* Business Interruption & Logistical Costs: Emergency contractor call-outs, lost retail trading hours while stores restocked aisles, and supply chain scrambling added millions more in indirect economic friction.
While insurance payouts and corporate write-offs are still being finalized by major chains like Intermarché and Coopérative U, the attack stands as one of the most expensive physical-damage cyber incidents affecting Europe’s retail sector.
Tomi Engdahl says:
https://www.facebook.com/share/r/18gARWNPNd/
If you don’t think cyber attacks on refrigeration units in stores and blood banks are not an act of war, you need to tell me why! This is taking away perfectly good food and destroying it, which in the long term will cost these stores money, which they will past to their customers. Then if they hit a bunch at once that will also mess up the food supply chain. Please don’t even get me started about hitting blood banks! What’s your thoughts? #cyberattacks #emergencypreparedness #prepping #breakingnews #cyberattack
Video
https://www.facebook.com/share/r/1DbYMn9mMb/
Tomi Engdahl says:
https://www.facebook.com/share/r/1J4Qo1k8U1/
7 Countries Effected By This Now
Video
https://www.facebook.com/share/r/1DuhXTZhig/
Tomi Engdahl says:
Following the European outbreaks, international agencies and various cybersecurity bodies have been sounding alarms for operators globally to audit their inventory, pull unpatched controllers off the public internet, and ditch default factory credentials immediately.
Tomi Engdahl says:
remote monitors and alarm were good idea. Integrating this with remote management to same box is questionable design choice. Connecting a large number of those to Internet so that they are exposed is stupid. Not keep their device software updated is bad. Having maintenance “backdoor” is dangerous. Leaving those devices online with default admin password not changed is moronic and potentially criminally neglectant.
Tomi Engdahl says:
https://www.facebook.com/share/p/1CSw3Q1LFs/
Supermarket fridges were dialled up to 50°C. Someone had hacked the controls.
Last month, hundreds of supermarkets and independent shops across France were hit by cyberattacks on their refrigeration systems. Attackers altered defrost settings, forcing retailers to throw away fresh and frozen food. Intermarché reported losses running into tens of millions of euros.
Then, on 2 November, further attacks hit supermarkets across several European countries.
For electricians working with machinery and control panels, it shows how changing software settings can have very physical consequences.
Our latest article explores the attacks and what the new EU machinery rules mean for connected controls, panel builders and British manufacturers.
Full article in the first comment.
A locked cabinet controls physical access. But who can get in through the network?
We explore how supermarket refrigeration was targeted, what the new EU machinery rules change and why panel builders need to think beyond the wiring.
Read the full article: https://www.efixx.co.uk/Articles/eu-machinery-regulation-2027-control-panels
Tomi Engdahl says:
U.S. agencies warn hackers are targeting industrial refrigeration systems worldwide, potentially causing fire hazards, food spoilage, and service disruptions.
The alert follows attacks on hundreds of European supermarkets, where hackers manipulated cooling systems.
Read – https://thehackernews.com/2026/11/us-agencies-warn-refrigeration.html
Tomi Engdahl says:
France blames Iranian hackers for supermarket attacks that sparked fires
https://www.bleepingcomputer.com/news/security/france-blames-iranian-hackers-for-supermarket-attacks-that-sparked-fires/?fbclid=IwdGRjcAVe8zZleHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABH7Lbfyadspky7wtyoqS-ZnPKqtFe7_lPVBfF7f4oZ4SD67ERsVevpS3_BptL_aem_x5oafx-LGqAza71SMDyt8w
France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, saying the attacks caused food losses and sparked at least 15 fires.
In a statement issued Monday, France’s Ministry for Europe and Foreign Affairs blamed the attacks on Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps (IRGC).
“France condemns in the strongest possible terms the unacceptable cyberattacks carried out on its territory by the Islamic Republic of Iran against its interests,” reads the statement.
The attacks occurred overnight on October 11–12, when hackers compromised industrial refrigeration controllers and remotely changed defrost settings to high temperatures, disrupting systems used to preserve food.
As BleepingComputer reported, the attacks affected an estimated 250 to 350 French supermarkets, forcing stores to discard fresh and frozen products.
Tomi Engdahl says:
https://www.facebook.com/share/p/1E9HJaLDtx/
CVS News
French officials believe Iran was behind nationwide cyberattacks on commercial refrigeration units at hundreds of grocery stores in October, the Paris prosecutor’s office said Monday, accusing a cyber unit of Iran’s powerful Islamic Revolutionary Guard Corps of carrying out the costly hacks.
The Oct. 11 hacking attack struck major supermarket chains, hitting “700 retail locations across France,” according to the prosecutor’s office, which said the attack caused “significant food spoilage and triggered roughly twenty fires” as the temperatures in refrigeration units shot up.
In its statement Monday, the Paris public prosecutor’s office said its cybercrime division had opened a judicial investigation on charges including “fraudulent interference with an automated data-processing system and causing damage by means dangerous to persons — both committed as part of an organized group.”
The investigation is targeting the leader of an Iranian group known as “Shahid Kaveh,” which the prosecutor’s office described as “a cyber-offensive unit affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps, as well as his two deputies and any other individuals who may be identified.”
There was no immediate response from Iranian authorities to the allegations by the French prosecutor on Monday, but the regime has threatened for months to expand its retaliation for the war launched by the U.S. https://cbsn.ws/4fkHWwS
Tomi Engdahl says:
“They Ignored a Well-Known Issue”
Security professionals knew about these vulnerabilities for years. The flaws were textbook:
Default factory credentials (admin / 12345).
Predictable authentication algorithms (Code of the Day).
Raw management interfaces sitting exposed on public IPs.
The industry didn’t ignore it out of malice; they ignored it because of how commercial refrigeration maintenance works.
Supermarket chains outsourced their cooling infrastructure to third-party HVAC and mechanical contractors. Those technicians cared about compressor pressures and cooling cycles, not network segmentation. To a local contractor who just wanted to check a temperature curve from their laptop on a Sunday night, wiring the controller straight to a store router with default logins was a matter of convenience, not a conscious security gamble.
“Yes, the current model is extremely efficient”—hits the nail on the head.
Modern retail supply chains are hyper-optimized just-in-time machines. Centralized remote monitoring was added precisely to squeeze out inefficiencies—allowing remote teams to tweak defrost cycles and monitor temperatures across hundreds of stores from a single dashboard without sending a technician on-site.
The irony is that the very “efficiency” tool introduced to save labor costs and reduce food waste became the exact vector that attackers used to turn hundreds of freezers into ovens simultaneously.
Tomi Engdahl says:
https://www.cnbc.com/2026/11/05/us-warns-of-ongoing-cyber-threat-to-industrial-refrigeration-systems.html
https://www.cisa.gov/resources-tools/resources/us-government-partners-urge-hardening-industrial-refrigeration-and-cold-chain-monitoring-systems
Tomi Engdahl says:
https://shieldworkz.com/blogs/investigating-the-suspected-cyberattack-on-u.s.-military-base-cold-storage-and-its-implications
Tomi Engdahl says:
There has been no credible indication or evidence pointing to a false flag operation, but the question of attribution took a major turn when official investigations went public.
The Official Attribution: French authorities (including Foreign Minister Jean-Noël Barrot and the Paris prosecutor’s office) formally attributed the October cyberattacks to Iran, specifically implicating the Islamic Revolutionary Guard Corps (IRGC) and a cyber unit known as Shahid Kaveh. France subsequently summoned the Iranian ambassador and threatened escalated EU sanctions.
https://www.timesofisrael.com/france-blames-iran-for-cyberattack-on-supermarket-fridges-warns-of-consequences/?hl=en-US#:~:text=France's%20national%20cybersecurity%20agency%2C%20ANSSI%2C%20attributed%20the,in%20connection%20with%20the%20case%2C%20Beccuau%20said.
Tomi Engdahl says:
https://en.wikipedia.org/wiki/2026_French_supermarket_refrigerator_hack?hl=en-US#:~:text=On%20November%209%2C%20French%20Foreign%20Minister%20Jean%2DNo%C3%ABl,threatened%20to%20escalate%20EU%20sanctions%20against%20Iran.
Tomi Engdahl says:
There has been no credible indication or evidence pointing to a false flag operation.
Why People Speculate on False Flags: In major cyber incidents targeting critical infrastructure or food supply chains without a financial ransom demand, skepticism is natural. Some security observers initially questioned whether the crude, destructive nature of the attack—which looked more like geopolitical sabotage or chaos-seeding than traditional espionage—pointed toward a proxy or a masked actor trying to frame someone else.
Cybersecurity analysts generally treat state-attribution announcements with analytical caution until full technical dossiers are made public. However, whether the operation was state-backed or executed by opportunistic actors, the root vulnerability remained entirely mechanical and digital: thousands of insecure, internet-exposed refrigeration units left wide open with default credentials.
Tomi Engdahl says:
https://nypost.com/2026/10/29/us-news/pentagon-treating-military-base-freezer-malfunctions-as-suspected-cyberattack-officials-say/
Tomi Engdahl says:
They should have been tied to Imternet according to how instructions said – they would have been much safer.
Typical mistakes: proper firewall missing, default admin password not changed and firmware is not updated for years
Tomi Engdahl says:
Iran has been blamed for cyber attacks on fridges that raised their temperatures and spoiled millions of euros’ worth of supermarket food.
It would make the hacks among the most disruptive cyber attacks in the US’s war with Iran that began in February, a conflict that has been marked by scattered incidents of alleged cyber disruption.
https://www.telegraph.co.uk/world-news/2026/11/09/iran-blamed-for-fridge-hacks/?WT.mc_id=tmgoff_fb_photo_news/2026/11/09/iran-blamed-for-fridge-hacks/
Tomi Engdahl says:
Not an epidemic, a pattern becoming visible. The common thread in the recent incidents is not new technology, it is access that outlived its need and systems nobody owned. The test for a small business is simple: name one owner for every internet-facing system, and check who can still log in. Most teams find accounts they forgot existed.
Tomi Engdahl says:
Why spend money on cybersecurity when dividends can be paid?
Tomi Engdahl says:
The Supermarket Hacks (Software/Network Exposure): Instead of intercepting gear at a factory, attackers exploited the fact that commercial appliances were shipped with built-in remote management tools, plugged into the internet, and left wide open with default credentials like admin / 12345.
Tomi Engdahl says:
https://www.facebook.com/share/v/1DMvGs6kTW/
Is this the future of AI?
#HumanOverAI #ArtificialIntelligence #france #foodsafety #Healthcare
Video
https://www.facebook.com/share/v/19kQRnZHfs/
Tomi Engdahl says:
Scary thing: the hackers did not need to hack the suppliers, they effectively just “walked into shops through open door” and change settings.
No magic hacking skills. Just find the targers and log in with default password. There are ways to find devices connected to Internet almost like web pages with Google.
No AI needed.
Tomi Engdahl says:
France blames Iran’s IRGC for cyberattacks that caused fires at French retail sites.
Attackers hijacked refrigeration controllers at about 700 sites, altered defrost settings and disabled temperature alerts, causing tens of millions of euros in food losses.
Read – https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html
Tomi Engdahl says:
Physically speaking, data centers do not evaporate enough water to alter regional weather patterns or impact the global water cycle.
U.S. farming consumes and evaporates 150 to 200 times more water than the entire U.S. data center fleet. A single major agricultural state growing thirsty export crops can evaporate more water in a single growing season than the lifetime total of all data centers built so far.
The Global Engine: The sun evaporates roughly 500,000 cubic kilometers (km^3) of water into the atmosphere every single year—roughly 86% coming from the oceans and 14% from land and lakes.
Total global human water consumption (all industrial, municipal, and agricultural sectors combined) accounts for only about 1,700 to 2,000 km^3 of net consumptive water loss annually—less than 0.4% of the planet’s natural evaporation cycle.
Direct data center evaporation globally is a tiny fraction of that human slice—measuring a fraction of a percent of global industrial use.
The friction over data center water isn’t about global depletion—it is entirely about hyper-localized point-source pressure. While the oceans evaporate trillions of tons of water effortlessly every day, a data center concentrates millions of gallons of daily municipal draw into a single suburban or desert watershed, which can temporarily strain local water treatment plants and aquifers long before it ever reaches the clouds.
Tomi Engdahl says:
Europe has faced a number of security threats this month, including cyberattacks on refrigeration systems at supermarkets and hoax bomb threats which disrupted dozens of passenger flights.
Such attacks can create economic damage, public anxiety and pressure on governments even without open military conflict.
https://www.facebook.com/share/r/1DTVg5GeDv/
Tomi Engdahl says:
https://www.facebook.com/share/p/195FikL2yK/
France has blamed Iran for a cyberattack last month that took control of refrigeration systems in hundreds of supermarkets and shops across the country.
The hackers pushed up fridge and freezer temperatures, spoiling food and triggering fires. One chain, Intermarché, reported losses of tens of millions of euros in a single day.
French officials say the attack was carried out by Shahid Kaveh, a cyber unit linked to Iran’s Revolutionary Guard.
France called it “the first large-scale cyberattack aimed at sabotage on French soil.” It has summoned Iran’s ambassador, will seek EU sanctions, and Paris prosecutors have opened a formal investigation. Similar attacks later hit stores in Belgium, Luxembourg and Sweden.
Tomi Engdahl says:
No, Wi-Fi was not used.
The controllers were targeted via standard wired Ethernet network connections plugged directly into store routers or cellular gateways.
Industrial refrigeration systems rarely use Wi-Fi for primary control operations.
Tomi Engdahl says:
Iran blamed for hacking supermarket fridges in ‘unprecedented’ attack as millions of pounds of food ruined
https://www.gbnews.com/news/world/iran-hacking-supermarket-fridges-france?fbclid=IwdGRjcAVhJc5jbGNrBWElzGV4dG4DYWVtAjExAHBkb2YFc3J0YwZhcHBfaWQMMzUwNjg1NTMxNzI4AAEfDp0nz-4HNyYGU3hZ_bhxJGUL3inpBSJbRmsBV9FMb7J2MSZepGDacZaxCYE_aem_GA0KIqwsNjSn8sVLFDDBpA
Tehran’s ambassador to France was also summoned in response
Iran’s Islamic Revolutionary Guard Corps have been formally blamed for an extraordinary wave of cyberattacks targeting supermarket refrigeration systems.
France’s Foreign Minister Jean-Noël Barrot said: “I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran.”
He described the operation, which occurred on 11 and 12 October, as unprecedented in both scope and hostility.
“This attack is unprecedented in both its scale and its level of aggression,” Mr Barrot said, pledging that Paris would “implement sanctions at the European level against all those responsible for this attack.”
Britain on alert as hackers shut down supermarket fridges across Europe
Tesco and Sainsbury’s are said to rely on similar equipment
https://www.gbnews.com/news/britain-alert-hackers-shut-down-supermarket-fridges?fbclid=IwVERDUAVhJhlleHRuA2FlbQIxMQBwZG9mBXNydGMGYXBwX2lkDDM1MDY4NTUzMTcyOAABHw6dJ8_uBzcmBlN4Wf24cSRlC94p6QUiW0ZrAVfRTG-ydjEmXqRg2nGWsQmB_aem_GA0KIqwsNjSn8sVLFDDBpA
Tomi Engdahl says:
there are well over 10000 big freezer systems that are computer controlled by computers from one manufacturer. According to some reports there were over 2000 of them accessible from Internet – they should not if installed correctly.
According to reports in many of them nobody had changed the admin password from factory default that is publicly known. If the password was changed, there was also another way you could get into device (if the device software has not been updated and is older than around one year).
Tomi Engdahl says:
temperature monitoring is a very good idea. Combining temperature monitoring+alarm and controlling to same control panel is convient but risky. Connecting this control panel to Internet while failing all the cyber security basics and not having anyone to check the safety is what leads to this type of catastrophic results.
Tomi Engdahl says:
Comments seen:
Is this another Cold War?
They hacked frozen French fries it’s so cool!
Tomi Engdahl says:
those cooling systems use typically Ethernet to Internet direction (some connected throug 4G cellular gateway).
Typical connection to fridges is wired connection (like Modbus RS-485). Some configurations can have different options.