Hacked supermarket fridges: does everything need to be online?

Overnight into 2 November, the fridges and freezers in dozens of Belgian shops switched to defrost: at Delhaize, Carrefour, Intermarché, Spar, the IKEA in Mons and a butcher’s shop in Hove. Three weeks earlier, the same thing happened to some 700 French supermarkets. No fault: someone had changed the settings remotely.

It didn’t take much. The refrigeration controllers could be reached straight from the internet, often ran outdated software and sometimes still had their default password. That isn’t one supplier’s problem, but a reflex: putting everything online because we can. And it doesn’t just hit big chains, but just as much the butcher’s, the corner shop and the office down the street.

What happened

In France, overnight from 11 to 12 October, attackers took over the refrigeration in about 700 of the country’s 10,000 supermarkets, according to finance minister Roland Lescure. Display cases heated up to 50 °C and shops threw out their fresh and frozen stock. France’s CERT-FR warned about compromised refrigeration controllers from Danfoss, Copeland and Dixell.

On 2 November, around 2 a.m., a second wave swept across Europe. In Belgium it hit dozens of Delhaize shops, 15 Carrefour stores, 10 to 15 Intermarché branches, five Spar shops and the IKEA in Mons. The De Laet & Van Haver butcher’s in Hove lost around €15,000 worth of meat. In the Netherlands, according to Danfoss, seventeen businesses were hit, including butchers and small local shops. Belgium’s federal prosecutor has opened a criminal investigation. Who is behind it is unknown.

How they got in

Refrigeration controllers are small computers that run a shop’s fridges. They’re connected to the internet so the refrigeration contractor can keep an eye on them remotely. According to the Centre for Cybersecurity Belgium (CCB), the attacked management pages could simply be reached from the internet, against all good practice.

Many were also old devices that no longer get updates, and in the Netherlands, systems with a default password. After the first wave, Danfoss advised its customers to take their fridges off the internet. According to Danfoss, the Dutch shops that got hit were precisely those that hadn’t.

The weaknesses were known. In August, researchers at Claroty described a hidden login in the Danfoss AK-SM 800A: with a “code of the day”, derived from the date, an attacker gets in without a password (CVE-2025-41450). In practice, that’s a backdoor. There’s an update for it, but it has to be installed. Whether the attackers used this flaw hasn’t been confirmed.

The same pattern in your business

Fridges are just one example. Look at what you find in an ordinary small business: a camera over the till, a video doorbell at the entrance, an alarm with an app, a smart thermostat, the printer. They’re often the same devices people have at home, installed in fifteen minutes, and by default they send their footage and data to the manufacturer’s cloud. There’s rarely an IT department, so nobody keeps track of who has access or whether updates still come.

What can happen then:

Ring, Amazon’s video doorbell. According to the US Federal Trade Commission, any Ring employee or contractor could view customers’ videos, and hackers got into the accounts of about 55,000 customers. Through the cameras’ speakers, they threatened people, children included.
Wyze, low-cost cameras. After an outage in February 2024, about 13,000 users were shown images from other people’s cameras.
Amazon. When Amazon’s cloud was disrupted for hours in October 2025, Ring cameras went dark.

For a small business, that isn’t the living room, but the till, customers and staff. That footage is personal data, and under the GDPR you, as the business owner, are responsible for it.

Every connected device is a potential backdoor

Every connection out can also be a door in. Sometimes the manufacturer opens it on purpose, for remote maintenance or because it stores your footage. Sometimes it opens by accident: a default password, a flaw, a missed update. To an attacker, it makes no difference. And according to CERT-FR and the CCB, a device that no longer gets updates but stays online is very likely to be compromised.

Not everything offline, but connected differently

We think the pendulum is swinging back: less “everything connected”, more “does this need to be online at all?“. After the attacks, Sweden’s National Cybersecurity Centre advised organisations to consider whether their devices need to be connected at all.

Going fully offline isn’t the answer either: then a device gets no updates. What matters is how a device is connected. Compare it to a phone:

The device answers anyone. Its number is in the public phone book, and anyone in the world can call, scammers included. Search engines such as Shodan even keep such a phone book of every reachable device. That’s how the supermarket fridges were connected. This is the most dangerous kind.
The device is always on the line with the manufacturer. It isn’t in the phone book, but the manufacturer can always watch and adjust things over that line. Whoever gets into the manufacturer’s systems or your account is on that line too. That’s how most smart cameras and doorbells work.
The device only makes calls. It calls the manufacturer to ask whether there’s an update, then hangs up. Nobody can call it. That’s the safest way to be online.

Even the third way isn’t risk-free: whoever forges the updates still gets in. That’s why updates should be digitally signed, so the device can check that they really come from the manufacturer.

In practice:

The device also works without the internet.
It makes calls, but doesn’t answer.
Footage and data stay in the building.
Remote maintenance goes through a secure connection (VPN), only when you open it.
Anything that no longer gets updates comes off the network or gets replaced.

What to do today

List everything in your business that's connected to the internet: cameras, doorbell, alarm, refrigeration, heating, printers.
Ask for each device: does this need to be online, and who uses that connection?
Check your router for ports open to the inside (port forwarding, UPnP) and close what isn't needed.
Change default passwords and install the updates. Take anything that no longer gets updates off the network.
Only let remote technicians in through a VPN, and ask them in writing how their access is secured.
When you buy new cameras, choose ones that record locally and also work without the cloud.
If you use Danfoss, Copeland or Dixell refrigeration controllers, follow the CCB's advice. Check your insurance contract before cutting the data feed to your refrigeration contractor.

How Skedia helps

We work for small and medium-sized businesses. In a security audit, we map which devices and applications you have online, who can reach them from outside and what can come off. You get a clear report in plain language, with priorities.