Hackers Melt Supermarkets by Forcing Fridges to 50 Degrees
Hackers turned European supermarket fridges into ovens. Connecting critical hardware to the internet is a massive liability.
Business · Source: Hacker News
What happened
Hackers launched an unprecedented cyberattack on major supermarket chains across France, Belgium, and the Netherlands. They successfully hijacked Danfoss-made refrigeration control systems used by massive retail networks. Instead of keeping food cold, the attackers weaponized the hardware. They triggered a continuous automatic defrost cycle that normally runs for just two hours a day. They cranked the target temperature to a blistering 50 degrees Celsius. Store employees reported a literal wave of heat escaping from the compromised fridges and freezers.
The attack devastated fresh produce and frozen goods across multiple retail networks. French supermarket giants Intermarche, Leclerc, and Cooperative U took direct hits. Cooperative U president Dominique Schelcher confirmed the attack on Monday morning. He stated that teams mobilized immediately to fix the extremely serious issue. Schelcher noted that attacking equipment essential to food preservation is unprecedented and unacceptable. Early reports indicate losses are already approaching 300,000 euros. These damages could easily run into several million euros nationwide as the full scale of the spoilage becomes clear.
The chaos quickly spilled over into other critical retail systems. Electronic shelf labels malfunctioned across stores. This disrupted in-store pricing and created checkout nightmares. Websites for Dutch chains Albert Heijn, Etos, and Gall and Gall went completely dark. Deliveries halted. Loyalty programs crashed. Albert Heijn had to temporarily shut down a number of systems preventatively to protect their IT environment. Belgian chain Delhaize also reported severe disruptions.
Key facts
- 50 degrees Celsius — The temperature hackers set the continuous defrost cycle to.
- 300,000 euros — Early estimated losses, which could scale into the millions.
- Danfoss — The manufacturer of the compromised refrigeration control systems.
Why it matters
This incident exposes the fatal flaw of deploying connected devices in enterprise environments without strict safeguards. Connecting dumb hardware to the cloud introduces catastrophic physical risks. Supermarkets wanted remote monitoring and control to save money on maintenance and logging. Instead, they handed hackers a literal self-destruct button for their entire inventory. When software controls physical outcomes, a digital breach becomes a kinetic attack. We are moving from hackers stealing data to hackers destroying physical goods in real time.
The blast radius of this hardware hack extends far beyond the compromised temperature sensors. Taking down the fridges was just the initial vector. The cascading failure knocked out pricing systems, logistics, and customer facing websites. This shows a massive architectural failure in how these retail networks are built. Builders must assume that if one endpoint falls, the entire operational network is in jeopardy. If your refrigeration units share a network path with your consumer website, your architecture is fundamentally broken.
For builders
Air-gap critical physical infrastructure
Never expose industrial control systems to the public internet. If a device controls temperature, power, or physical safety, it must operate on a closed local network. Retailers pay the ultimate price when convenience overrides basic security protocols.
Build hardware with hardcoded physical limits
Software should never be able to push hardware into destructive states. Refrigeration units need physical thermostats that cut power before reaching 50 degrees Celsius. Hardware engineers lose credibility when software bugs cause physical fires or mass spoilage.
Decouple operations from web infrastructure
A fridge hack should not take down a consumer website or delivery logistics. Isolate your microservices and segment your networks. Founders lose millions when a single point of failure cascades across the entire business ecosystem.
My take
Putting grocery store fridges on the internet is peak tech hubris. We traded physical security for a dashboard metric. If your hardware can be weaponized with a simple API call, you did not build a smart device. You built a massive liability. Stop connecting critical infrastructure to the web just because you can.
Original reporting: Hacker News. This is my rewrite and opinion.