Back in 2013, Target suffered a massive breach. In 2024, I asked why traffic-light controllers were accessible over the Internet. Now, in October 2026, we have reports of attackers manipulating refrigeration systems in French supermarkets and causing food to spoil.
Seriously, folks: what could possibly go wrong?
I understand why a grocery chain wants to monitor refrigeration equipment. If a freezer stops working overnight, somebody needs to know. Remote diagnostics and maintenance can save time and money. But there is a huge difference between collecting temperature readings and letting somebody on the public Internet change operating conditions on equipment that protects the food supply.
According to reporting from BleepingComputer, Reuters and other outlets, attackers targeted remotely managed refrigeration systems at French supermarkets during October 11–12. Reports describe forced defrost cycles, elevated temperatures, discarded food and disrupted store operations. Early estimates of the number of affected stores varied, and the investigation is continuing. We do not yet know exactly how every system was compromised or who was responsible. That uncertainty matters.
Some reporting points to older Danfoss controllers and publicly exposed management interfaces. Security researchers have documented vulnerabilities in certain controllers, but the exact vulnerability or combination of weaknesses used in these incidents has not been conclusively established. This is not a reason to speculate. It is a reason to ask why sensitive controls were reachable in the first place, whether old equipment was still supported, and whether independent safety measures could have limited the damage.
The Target lesson we should have learned
In 2014, Brian Krebs reported that the attackers behind Target’s 2013 payment-card breach used credentials stolen from Fazio Mechanical Services, a refrigeration and HVAC contractor. The attackers ultimately reached Target’s point-of-sale environment. Fazio later clarified that its connection to Target was for billing, contracts and project management, not remote control of Target’s heating or refrigeration equipment.
That clarification is important. The Target breach was not an example of hackers turning up a thermostat. It was an example of third-party credentials becoming part of a path to sensitive systems. Why wasn’t access sufficiently restricted? Why could a compromise involving one business relationship become a problem for payment systems?
I wrote about that breach in February 2014. More than a decade later, we’re still asking whether organizations know what their vendors can access and whether those connections are properly isolated.
Traffic lights: Another warning
In July 2024, I wrote about researcher Andrew Lemon’s investigation of traffic-light controllers. Reporting described an exposed controller interface that could allow changes to signal timing. A separate safety device reportedly prevented the nightmare scenario of making every light green at once, but that did not eliminate the potential for traffic disruption.
What particularly bothered me was the response to the research. Q-Free said the affected equipment was old and that it could not confirm all legacy units had been updated. The researcher also described receiving legal correspondence after reporting his findings.
I asked then, and I ask again: who is keeping an inventory of these systems? Who knows which ones are still operating, what software they run, whether they receive security updates, and whether they are exposed to the Internet?
If a controller is too old to secure, leaving it accessible is not an acceptable long-term maintenance plan.
Refrigeration: The physical consequences
This latest incident is different from both Target and the traffic-light research. The reported harm wasn’t primarily the theft of credit-card numbers or the possibility of congestion. It was spoiled food. A legitimate function of refrigeration equipment—defrosting—was reportedly used in a way that defeated the equipment’s purpose.
Why should a remotely issued command be able to push temperatures into an unsafe range without a separate alarm, local override or independent physical limit? If a technician needs remote access, why isn’t that access narrowly scoped, authenticated, monitored and restricted to approved paths? And if the connection goes down—or somebody malicious takes control—can the store still operate the equipment safely by hand?
The Internet is not a maintenance plan
I’m not saying nobody should ever monitor a freezer remotely. I’m saying that “we need to see its temperature” is not a justification for exposing an administrative interface to the entire Internet.
Segment operational technology from payment systems, office computers and other networks. Keep controllers off the public Internet wherever possible. Use strongly authenticated, time-limited vendor access, preferably through a controlled gateway. Maintain a real asset inventory, replace unsupported devices, monitor abnormal commands, and make sure safety alarms and local controls do not depend on the same system an attacker might compromise.
And don’t confuse segmentation with a magic shield. A poorly designed connection between networks can still be abused. The rules have to be enforced and tested.
The question remains
Target’s breach showed the danger of third-party access reaching beyond its intended purpose. The traffic-light research showed what exposed control interfaces can permit. The French supermarket incident shows how a cyberattack against operational equipment can have immediate physical and economic consequences.
Different incidents, same uncomfortable question: why the hell are we connecting sensitive systems to the Internet without making security and safety fundamental requirements?
As Steve Gibson might ask: what could possibly go wrong?
Apparently, quite a lot.
Sources and previous coverage
- French supermarket refrigeration incident, BleepingComputer (October 12, 2026)
- Reuters, investigators hunt French supermarket fridge hackers (October 13, 2026)
- ONYPHE, refrigeration as critical infrastructure (October 2026)
- Krebs on Security, Target hackers broke in via HVAC company (February 5, 2014)
- Krebs on Security, follow-up on the vendor intrusion (February 12, 2014)
- My Target coverage (February 5, 2014)
- My traffic-light commentary (July 22, 2024)
Related
Discover more from Jared's Technology podcast network
Subscribe to get the latest posts sent to your email.
Why the Hell Are Refrigeration Controllers on the Internet? From Target to Traffic Lights to Spoiled Food
Back in 2013, Target suffered a massive breach. In 2024, I asked why traffic-light controllers were accessible over the Internet. Now, in October 2026, we have reports of attackers manipulating refrigeration systems in French supermarkets and causing food to spoil.
Seriously, folks: what could possibly go wrong?
I understand why a grocery chain wants to monitor refrigeration equipment. If a freezer stops working overnight, somebody needs to know. Remote diagnostics and maintenance can save time and money. But there is a huge difference between collecting temperature readings and letting somebody on the public Internet change operating conditions on equipment that protects the food supply.
According to reporting from BleepingComputer, Reuters and other outlets, attackers targeted remotely managed refrigeration systems at French supermarkets during October 11–12. Reports describe forced defrost cycles, elevated temperatures, discarded food and disrupted store operations. Early estimates of the number of affected stores varied, and the investigation is continuing. We do not yet know exactly how every system was compromised or who was responsible. That uncertainty matters.
Some reporting points to older Danfoss controllers and publicly exposed management interfaces. Security researchers have documented vulnerabilities in certain controllers, but the exact vulnerability or combination of weaknesses used in these incidents has not been conclusively established. This is not a reason to speculate. It is a reason to ask why sensitive controls were reachable in the first place, whether old equipment was still supported, and whether independent safety measures could have limited the damage.
The Target lesson we should have learned
In 2014, Brian Krebs reported that the attackers behind Target’s 2013 payment-card breach used credentials stolen from Fazio Mechanical Services, a refrigeration and HVAC contractor. The attackers ultimately reached Target’s point-of-sale environment. Fazio later clarified that its connection to Target was for billing, contracts and project management, not remote control of Target’s heating or refrigeration equipment.
That clarification is important. The Target breach was not an example of hackers turning up a thermostat. It was an example of third-party credentials becoming part of a path to sensitive systems. Why wasn’t access sufficiently restricted? Why could a compromise involving one business relationship become a problem for payment systems?
I wrote about that breach in February 2014. More than a decade later, we’re still asking whether organizations know what their vendors can access and whether those connections are properly isolated.
Traffic lights: Another warning
In July 2024, I wrote about researcher Andrew Lemon’s investigation of traffic-light controllers. Reporting described an exposed controller interface that could allow changes to signal timing. A separate safety device reportedly prevented the nightmare scenario of making every light green at once, but that did not eliminate the potential for traffic disruption.
What particularly bothered me was the response to the research. Q-Free said the affected equipment was old and that it could not confirm all legacy units had been updated. The researcher also described receiving legal correspondence after reporting his findings.
I asked then, and I ask again: who is keeping an inventory of these systems? Who knows which ones are still operating, what software they run, whether they receive security updates, and whether they are exposed to the Internet?
If a controller is too old to secure, leaving it accessible is not an acceptable long-term maintenance plan.
Refrigeration: The physical consequences
This latest incident is different from both Target and the traffic-light research. The reported harm wasn’t primarily the theft of credit-card numbers or the possibility of congestion. It was spoiled food. A legitimate function of refrigeration equipment—defrosting—was reportedly used in a way that defeated the equipment’s purpose.
Why should a remotely issued command be able to push temperatures into an unsafe range without a separate alarm, local override or independent physical limit? If a technician needs remote access, why isn’t that access narrowly scoped, authenticated, monitored and restricted to approved paths? And if the connection goes down—or somebody malicious takes control—can the store still operate the equipment safely by hand?
The Internet is not a maintenance plan
I’m not saying nobody should ever monitor a freezer remotely. I’m saying that “we need to see its temperature” is not a justification for exposing an administrative interface to the entire Internet.
Segment operational technology from payment systems, office computers and other networks. Keep controllers off the public Internet wherever possible. Use strongly authenticated, time-limited vendor access, preferably through a controlled gateway. Maintain a real asset inventory, replace unsupported devices, monitor abnormal commands, and make sure safety alarms and local controls do not depend on the same system an attacker might compromise.
And don’t confuse segmentation with a magic shield. A poorly designed connection between networks can still be abused. The rules have to be enforced and tested.
The question remains
Target’s breach showed the danger of third-party access reaching beyond its intended purpose. The traffic-light research showed what exposed control interfaces can permit. The French supermarket incident shows how a cyberattack against operational equipment can have immediate physical and economic consequences.
Different incidents, same uncomfortable question: why the hell are we connecting sensitive systems to the Internet without making security and safety fundamental requirements?
As Steve Gibson might ask: what could possibly go wrong?
Apparently, quite a lot.
Sources and previous coverage
Share this:
Like this:
Related
Discover more from Jared's Technology podcast network
Subscribe to get the latest posts sent to your email.
Published in article commentary