Cyberattack on Connected Fridges in France
Another IoT cyberattack, this one in France:
Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected.
[…]
Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process.
Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified.
Any IoT device that can’t be updated is vulnerable. And, probably, any IoT device that can be updated is also vulnerable.
Subscribe to comments on this entry
Gordon • October 14, 2026 10:54 AM
Unfortunately the BBC story doesn’t say how the attackers gained access to the network(s) in the first place.
Given the number of affected devices and the stated vulnerability being the software in each device, it seems they were all available for anyone on the internet to attempt to hack.
Why would individual devices, in this case refrigerated display cases, be directly exposed to the wider internet? Is my mental model of the network architecture somehow wrong?
I’m assuming each store has a security device at the transition to the internet, say “router on a stick” architecture, and that the central office would use VPN to connect to the router so the central control mechanism can act as if its on the LAN inside each store.
Seems to me like the problem is not only firmware which can no longer be updated, but also poor network security practices. What am I missing here?