Supermarket Fridge Hacks Put Connected Devices at Risk
Cyberattacks that changed supermarket fridges’ temperatures affected stores across Europe, with one wave hitting about 700 French outlets. The incidents have raised concerns about basic security flaws in internet-connected equipment, which can also include devices used in homes and essential services.
Hackers can take supermarket fridges over through exposed internet connections, weak passwords and outdated software, after attacks affected stores across Europe and spoiled food worth millions of euros.
Attackers heated refrigeration units at about 700 French stores to as high as 50C (122F) on October 11 and 12. A second wave of suspected cyberattacks on November 2 affected supermarkets and food businesses in at least nine European countries.
Basic security gaps exposed
The attacks exploited equipment that staff and contractors can manage remotely. Supermarket fridges and freezers often connect to a shared control panel, while home smart fridges use Wi-Fi, apps or cloud services.
Attackers reportedly used Shodan, a search engine for internet-connected devices, to find supermarket systems. Vincent Strubel, head of France’s National Cybersecurity Agency, told the French Senate on October 21 that security failures included direct internet exposure, weak or default passwords and older units that no longer receive security updates.
In France, the attackers used the refrigeration controllers’ defrost function. Once inside a system, hackers can switch a fridge off, raise its temperature or steal account details. An insecure device may also provide a route to other equipment on the same network, including laptops and smart locks.
France blamed the first attack on Shahid Kaveh, a cyberunit affiliated with Iran’s Islamic Revolutionary Guard Corps, and called it the first large-scale sabotage cyberattack on French soil. The group behind the November 2 wave has not been identified.
Risks extend beyond food storage
Strubel warned that healthcare facilities use similar equipment to store vaccines and hazardous materials in research laboratories and pharmacies. The same kinds of connected systems can also be found in power plants, water supplies, banks and hospitals.
Internet-connected devices in homes are widespread. Kepios’s Digital 2027 Global Overview Report counts about 21 billion short-range connected devices, such as smartwatches, and 5.4 billion long-range devices, including remote monitoring systems.
US households with internet service have an average of about 18 connected devices, nearly double the figure from a decade ago, according to Parks Associates.
Routers are a frequent target because they stay online. In April, the UK’s National Cyber Security Centre warned that hackers linked to Russia’s GRU military intelligence were hijacking home and small-business routers. By changing DNS settings—the system that directs website names to internet addresses—they redirected users to fake sites to steal passwords and personal details.
Other connected devices can also expose household data. In June, researchers found that more than a third of apps on LG and Samsung smart TVs could let strangers use a household’s internet connection without the owner’s knowledge.
Earlier this year, a programmer reportedly gained control of almost 7,000 DJI Romo robot vacuums using a PlayStation 5 controller. He used Claude Code, an AI coding tool made by Anthropic, to examine how the vacuums connected to DJI’s servers and accessed live camera feeds, audio and home floor plans.
