How did every supermarket chain around the world not jump at this and investigate?

Probably most of them had exactly zero inhouse expertise in cybersec and just pretended there’s nothing to worry about because having to worry would be inconvenient. Maybe some of them made a call to their cold chain supplier and were told that there’s nothing to worry about.

▲

rickdeckard a day ago | parent | prev | next [-]

I wonder how many people working in any given supermarket chain actually know that their fridges are connected to a network at all.

▲

Sharlin a day ago | parent | next [-]

Not many, probably, but their cold chain people definitely would have known. Instrumented and remote monitored cold chains are standard these days because keeping stuff refridgerated end to end is a pretty big deal.

	▲	rickdeckard 13 hours ago \| parent [-]
		cold chains were already standard before connected fridges, one doesn't mandate the other. The issue is most of all not remote monitoring but remote management. I don't know what "cold chain people" are, at the scale of supermarkets you permanently have refridgeration for different groups of consumables. I'm not aware of a scenario where e.g. fish is being shipped, and the originating logistics remotely sets the temperature of a fridge at the destination.

▲

f6v a day ago | parent | prev [-]

I bet most managers don't even know you can even connect a fridge to the internet.

▲

ritzaco a day ago | parent | prev | next [-]

have you seen how big enterprises operate? It would generally take much longer from a decision to do something to any action happening, budget approvals etc.

And for anything infosec, unfortunately people who know a lot about infosec have a habit of 'crying wolf' and talking about infosec as some kind of absolute rule that everything has to bow down to with no willingness to balance against other business risks, so probably leadership is used to ignoring the people who knew that this was a big deal and were calling for action.

▲

vconnor a day ago | parent | prev | next [-]

Their cybersecurity departments (next to fresh produce) are all over this.

Snark aside, supermarkets are not in the tech business. The extent of their involvement is ringing their IT vendor to complain about it.

	▲	auggierose a day ago \| parent \| next [-]
		Depends. Lidl wants to be a tech company. https://en.wikipedia.org/wiki/Schwarz_Digits
	▲	kasey_junk a day ago \| parent \| prev [-]
		It really depends on the grocery. Kroger gets a big chunk of their profits from their data stack.

▲

a day ago | parent | prev | next [-]

[deleted]

▲

lofaszvanitt a day ago | parent | prev | next [-]

Because most of these chaps do not read daily news related to their profession.

▲

sillyfluke a day ago | parent | prev | next [-]

I wouldn't be surprised if its their own agencies hacking these systems preemptively in order to force the issue and increase robustness against a larger multi-pronged attack.

▲

throwaway894345 a day ago | parent | prev [-]

I’m still trying to figure out why these freezers are connected to the Internet in the first place…

▲

kasey_junk a day ago | parent [-]

Monitoring, alerting, remote diagnostics and trouble shooting.

Commercial cold chains are expensive, high value collections of equipment that even small errors at the edges can cause huge monetary losses. And grocery stores are in an extremely low margin business.

▲

AyyEye a day ago | parent | next [-]

Those are read-only. None of those things require the ability to heat up a fridge remotely.

	▲	kasey_junk a day ago \| parent [-]
		Diagnostics and troubleshooting are not necessarily read only. Some of these systems have temperature controls that are centrally managed for operations centers for instance.

▲

throwaway894345 a day ago | parent | prev [-]

Monitoring should be in a DNZ that can talk to the otherwise “airgapped” network and push metrics out to the SaaS platform or whatever. Send a technician if something needs to be adjusted, or (only if some kind of remote access super critical) give the customer the ability to grant temp access to technicians for remote troubleshooting (but require someone to be in the facility).

None of this requires the customer to be technical, the ORM could ship the equipment with the network setup, and installation would just be connecting the DMZ device to the Internet.

▲

kasey_junk a day ago | parent [-]

The question wasn’t why these systems are setup insecurely (which has an obvious answer about cost prioritization).

Of course there are ways to setup these things securely, same with smart tvs and doorbell cameras and whatever else is getting hacked. People just have a bad time figuring out the cost benefit of all of this. And frankly we don’t know if that cost benefit has even been crossed yet, perhaps this doesn’t rate.

You yourself are engaging in cost prioritizing without adequate information. Sending a technician on site may be extremely expensive (opportunity costs and inventory risk on cold chains are wild).

▲

throwaway894345 16 hours ago | parent [-]

> The question wasn’t why these systems are setup insecurely (which has an obvious answer about cost prioritization).

It’s not obvious to me that the secure approach is measurably more work than the insecure approach. Someone had to go out of their way to add support for remote temperature control.

> Of course there are ways to setup these things securely, same with smart tvs and doorbell cameras and whatever else is getting hacked.

No one expects a $20 IoT light switch to ship with its own network equipment, but a $600,000 to $1.5M fleet of freezers for a single grocery store can ship with its own network equipment without increasing the cost a single percentage point.

> You yourself are engaging in cost prioritizing without adequate information

I had hoped that was obvious from the question mark in my original post :) I’m asking what information reconciles this “it feels like they went out of their way to make this insecure” security posture. Responding with “they must have information you don’t have or else they wouldn’t have done it that way” is neither helpful nor logical.

	▲	kraligor 12 hours ago \| parent [-]
		I'm a bit shocked about all the uninformed arguments in the comments. Maybe I shouldn't be, because apparently basic infosec is a foreign language even to large supermarket chains and commercial freezer manufacturers. It's 2026, why the hell would you have critical systems exposed to the internet? In.. "normal" industries this wouldn't just be reasons for immediate termination, this would be a civil lawsuit for recklessly endangering company assets. I'm genuinely flabbergasted. And then it happened, AND IT HAPPENED AGAIN AFTER THREE WEEKS. Why did they not pull the plug at the very second they learned about the first incident? I'm not happy about the attacks, but it sure seems like someone needed a wakeup call.