Why do supermarket refrigerators connect to the internet?

**Why do supermarket freezers connect to the internet?**

Supermarket freezers in six European countries were subjected to a cyberattack on November 2. In particular, in Belgium, this attack forced stores to throw away approximately 100,000 euros worth of food products. So, why do freezers connect to the internet? The answer to this question is provided below.

In Belgium, about 40 Delhaize supermarkets, at least 15 Carrefour stores, five Spar stores, and the De Laet en Van Haver butcher group were affected by the cyberattack. According to local media reports, temperatures in the refrigerators even rose up to 70°C. In addition, similar situations were recorded in Estonia, Sweden, Luxembourg, Ireland, and the Netherlands.

The question arises: why can someone control a supermarket refrigerator or freezer without being inside the store? Why do refrigerators connect to the internet?

Cooling systems of large supermarkets operate through central control units. These units control the temperature, defrost cycles, and warning signals of every refrigerator and freezer in the store.

According to a study published in October by the cybersecurity firm Forescout, connecting these units to the internet has long been a supported feature. This method allows refrigeration technicians to remotely diagnose faults and change settings without having to visit every store.

According to Danfoss, one of the main suppliers in Europe, connecting cooling control to the internet reduces unnecessary engineer visits by 15 to 30 percent. This is because certain faults can be fixed remotely. As a result, there is no need for staff to personally check each refrigerator up to four times a day.

Instructions from freezer manufacturers clearly show how to connect the system to the internet and set up remote access. For example, the procedure for configuring the store router to connect to the cooling device via the internet is explained there.

According to Forescout, the main problem lies in the split responsibility. The software may be managed by a contractor, the equipment may belong to the store, and the internet connection may be handled by its IT department. Until tasks are clearly assigned, neither party can fully control or see this internet-connected, vulnerable, and exposed system.

Some equipment is also old. One of the Danfoss controllers targeted in the cyberattack has been out of service support since May 2021. For this reason, it cannot receive security updates, and as a result, an opportunity for hacking from external devices has appeared.

**How large is the scale of the risk?**

Forescout experts conducted an investigation using a special search engine (Shodan) that detects internet-connected devices. As a result, it was revealed that nearly 13,000 cooling systems at 6,017 internet addresses in 99 countries are connected to the internet completely unprotected.

80 percent of Danfoss freezer systems are running old software. The security flaws in them have not yet been fixed. These figures do not indicate hacked systems, but rather systems that stand open and vulnerable to a cyberattack.

The risk is not limited to supermarkets alone. Identical systems are also used in the food processing industry, wineries, fruit storage facilities, farms, and hospital refrigeration equipment.

Attackers do not need complex malware. Once inside the system, they can use standard functions to change the temperature, trigger defrosting, or turn off warning signals. Forescout notes that such changes look like normal operational processes.

Forescout's main recommendation is to disconnect cooling systems from the open internet and allow technicians access only through special secure channels. Experts are also requesting the replacement of old devices that do not receive updates. They recommend abandoning shared passwords, assigning a personal login and password to each employee, and logging who has accessed the system.