Supermarket fridges hacked: what in your home is on the internet?

Published Misc Braindump

On the night of 1 to 2 November, the refrigeration in at least 40 Delhaize supermarkets in Belgium went haywire, along with about 15 Carrefour and 5 Spar stores, VRT NWS reports. In Eeklo, freezers were set to 50 degrees. In Hoepertingen they reached 15 degrees instead of −22, and at least €60,000 of food had to go. It was the second wave in Europe since mid-October, AP writes.

Possible weak spots

How exactly the attackers got in isn't known yet. Publicly reachable controllers, default passwords and outdated software are possible ways in. According to Danfoss, most affected systems were older products that no longer got security updates. A central controller like that is often reachable over the internet, so a technician can check in remotely. Richard Horne, head of the UK's National Cyber Security Centre, said the French fridges were connected straight to the internet, with their default passwords.

Ethical hacker Keanu Nys told VRT NWS he sees no reason at all for a refrigeration system to be publicly reachable. He would keep them on the internal network only, for example behind a VPN.

I get how it happens. Setting up a VPN and keeping a decent password for every controller is a hassle, and the fridge keeps cooling without it. But then anyone who finds the address can try to log in. And people are looking. Xavier Bellekens of security firm Lupovis saw many break-in attempts on fake fridge control systems his company had put online, in the week before the attack.

With the PHP vulnerability in October, AI helped find flaws that had been there since 2012. I expect we'll see more and more attacks like these, with AI scanning for vulnerabilities, default passwords and standard login pages like WordPress's.

What to check at home

It isn't only supermarket fridges. Many smart devices at home, from IP cameras and baby monitors to ovens and air conditioners, have an admin interface or an account that comes with them. Laurens Singier of Howest told Reuters that operators often don't change the manufacturer's default password. I suspect it's no different at home.

If a device still has the password it came with, change it. If it doesn't need to be reachable from outside, don't leave it open.

A strong password doesn't have to take effort. A password manager like Proton Pass or 1Password creates a long, random password and remembers it for you. I've used 1Password for years. The only password you still need to know is the one for the manager itself.

Wherever you can, also turn on two-factor authentication (2FA). A site then asks for a six-digit code on top of your password, usually from an app on your phone. 1Password and Proton Pass (in the paid plan) can generate and store those codes too. Because they live in your vault, you have them on all your devices and you don't depend on that one phone.

Your smart TV belongs on that list too, since it often has a microphone. This autumn researchers showed that LG TVs could record audio while the screen looked off, and a similar, unverified claim is going around about Samsung TVs. If you don't use voice control, turn it off.

Before you buy something new

I wouldn't buy Action's indoor camera. Belgian consumer group Test-Aankoop tested that model of around €25 in June. The app runs on the Chinese Tuya platform and the footage on the microSD card isn't encrypted. If privacy matters to you, these devices may not be for you, they conclude.

Look around before you connect something to your Wi-Fi. AI is handy for that. Ask Claude or ChatGPT how long the maker promises security updates, whether the device works without the cloud, whether you can change the password and whether any flaws are known. Do click through to the sources it gives.

Europe is tightening the rules too. Since August 2025, EU cybersecurity requirements apply to wireless devices that connect to the internet. From 11 December 2027 the Cyber Resilience Act adds requirements for securing products with software and for handling vulnerabilities. That helps with what you buy new. Whatever has been on your Wi-Fi for years, you'd better check yourself.

An offline plan for your home

On the November episode of the Nerdland podcast, a Flemish science podcast, I heard Lieven Scheire bring up an offline plan again. I really think we need to think about it. Can you still get into your house without internet? Do your solar panels still work when the connection drops?

Everything is becoming more and more "always on, always connected", like the many single-player games that want an internet connection these days. Does all of it really have to be on the internet? I think it can be smarter and more local. Matter devices run locally and stay controllable without internet or the cloud, through a central hub at home. If you want to reach them from outside, a smart router can set up a VPN that you switch on with an app on your phone, without having to be technical yourself.

At a company that isn't always this simple. But your IT team can think it through and help.

We live in a new reality, one where even a freezer has a login. It reminds me of There's a War Going On But No One Can See It, the 2019 book by Dutch journalist Huib Modderkolk. The title fits surprisingly well. You don't have to get rid of everything. Just think for a moment before you put something on the internet.