'Unprecedented' Cyberattack cripples supermarket fridges across Europe as hackers activate automatic defrosting — delivery and store prices also impacted by incident
- Overview of the Incident: A major cyberattack targeted supermarket chains across Europe (notably in France, Belgium, and the Netherlands), disrupting refrigeration control systems, deliveries, and in-store pricing.
- Refrigeration Sabotage:
- Hackers compromised Danfoss-made refrigeration controllers used by major French supermarkets, including Intermarché, Leclerc, and Coopérative U.
- The attackers hijacked the automatic defrosting function—which normally runs for just two hours a day—and locked the units into a continuous, forced defrosting cycle set to 50 degrees Celsius.
- Store sources reported waves of heat escaping from fridges and freezers, leading to spoiled perishables and early estimated losses of €300,000 that could scale into several million euros nationwide.
- Broader Retail Disruptions:
- In the Netherlands and Belgium, retail chains including Albert Heijn, Etos, Gall & Gall, and Delhaize experienced concurrent cybersecurity malfunctions.
- Websites were taken down, halting online orders and deliveries, while preventive system shutdowns were enacted to protect IT environments.
- Electronic shelf labels were compromised, causing widespread in-store pricing issues and forcing the suspension of customer loyalty programs.
- It remains unclear whether the French refrigeration attacks and the Dutch/Belgian retail disruptions are directly connected.
Hacker News Discussion
- Trivial Authentication Bypass & Firmware Flaws:
- Commenters highlighted security research (by Claroty) detailing extreme vulnerabilities in the Danfoss controllers, including a documented authentication bypass triggered simply by sending a POST request to
/xml.cgi. - The firmware also contained a backdoor recovery mechanism alongside standard authentication that generated a daily admin password using a weak, reverse-engineerable algorithm seeded solely with the current date.
- Commenters highlighted security research (by Claroty) detailing extreme vulnerabilities in the Danfoss controllers, including a documented authentication bypass triggered simply by sending a POST request to
- Criticism of Security Certifications:
- Users mocked the fact that the manufacturer holds an ISO 27001 certification despite shipping such critical vulnerabilities.
- Industry veterans noted that certifications like ISO 27001 and SOC2 merely prove a company has documented policies and does the "audit dance," rather than guaranteeing actual technical security.
- IoT Exposure vs. Network Isolation:
- A debate emerged over why critical food-safety infrastructure is exposed to the public internet.
- While many argued industrial appliances should never be online, others pointed out that remote temperature monitoring is vital for preventing mass spoilage—though it should be strictly read-only, isolated behind a VPN, or rely on one-way alert systems rather than full remote control.
- Regulatory Impact:
- Embedded security professionals pointed out that the EU's upcoming Cyber Resilience Act (CRA), taking effect in late 2027, will make shipping hardware with such negligent security practices illegal and subject to heavy fines.
- Links to Previous Attacks & Geopolitics:
- Commenters connected this incident to a remarkably similar August 2026 event where freezers at US military commissaries mysteriously failed, suspecting the same Danfoss vulnerability was exploited.
- Speculation on motives ranged from state-sponsored grey-zone warfare (such as Russia sowing general chaos and exhausting organizational response capacity) to opportunistic attackers exploiting a known vulnerability before it gets patched.
