You can literally recreate it with a single line bash command to apply to the internet in a loop. A write-up on how to defrost the fridges appeared online in August. It’s a zero-skill thing to pull off, I wrote the bash script while having a shit.
LinkedIn’s absolutely awash with security vendors posting brain-dead takes on the fridge thing as they have no idea, at all, what they’re talking about. It’s great as it’s a list of people not to hire.
You may be surprised to know the through line to the posts is.. AI. Remember when we had intelligence.
The manufacturer has confirmed this was caused by unpatched systems being internet-facing. The French government CERT has also issued an advisory saying the same. The patch in question removed the date-based backdoor password. https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-012/
German authorities are reminding orgs not to directly connect food cooling solutions to the Internet. https://www.allianz-fuer-cybersicherheit.de/SharedDocs/Downloads/Webs/ACS/DE/BSI-CS/BSI-CS_154.html
This incident didn’t just impact one French company, btw. It’s multiple orgs. The media is focused on the supermarket as they’re the big one who disclosed publicly.
I was being too glib with zero skill in this thread, as it evidently needs some skill. I’m tempted to do a write up but a bit worried about defrosting cold storage warehouses 😅
@GossiTheDog that ... gives "internet of shite" a whole new meaning.
@GossiTheDog And... that is why your toilet seat is cleaner than your keyboard or mobile phone 🤣 😎
The jobs not finished until you do the paper work! 😉🤷♂️
@GossiTheDog You mustn't forget that we really do need the hype around the AI-threat. I mean... how else are we going to sell products countering the very-soon-to-come onslaught of autonomous AI-agent attacks that, unless countered, will entirely enslave and make a botnet of all computers on the internet.
@GossiTheDog
I went to linkedIn to see if I had any in my timeline.
This was a huge mistake. Looking at LinkedIn makes me want to vomit every time. (My timeline was all Nobel prize, CERN, and crap about robots.)
Oct 13, 2026, 2:03 AM@GossiTheDog Brain head vendors are the norm, though.
Oct 13, 2026, 2:05 AMpass the dab rig
Oct 13, 2026, 2:58 AM@cyberquixote @GossiTheDog Eh.. close enough for government work.
@GossiTheDog I'm a big fan of AI*
*) "actual intelligence"
@GossiTheDog And then we have you... who doesn't know either why only certain "French" supermarkets were hit with this problem and other supermarkets of the same supermarket chains and users of Danfoss equipment around the world weren't hit with this problem. If there are so many exposed fridges, then why only hit the French ones? There is a good chance this had nothing to do with the Danfoss vulnerability and was a hack of a management system at a French fridge service company.
@internetthought they didn’t just hit the French ones, FWIW. A vast majority of the directly internet exposed ones were in France.
Oct 13, 2026, 1:57 PM@GossiTheDog @internetthought that might just be market dominance, or the fact that danfoss france or their reseller had noone deciding this was a bad idea, or their counterparts at the supermarket chains not giving a merde... I mean, look at @vncresolver 's posts and cry.
@GossiTheDog Where can I find information about other fridges that were hit? And why were the fast majority of internet exposed ones in France?
@GossiTheDog my apologies, I thought everyone was jumping too quickly to conclusions, because the issue appeared to be only limited to France, but it does appear to be wider spread. So much for "clues" then (see Terry Pratchett quote). I have a bias against cyber attack messaging, when often the alleged attack is human stupidity, misconfiguration, mother nature etc. and not a Neo-like leet h@ckx0r... Oh well, a few supermarkets got a slightly more expensive cybersecurity drill 😋
@GossiTheDog how does patched/unpatched fit in? How does it matter when no exploit was used?
Or have I missed something?
@AwkwardTuring the date based password thing has a patch to remove the ‘feature’
@GossiTheDog ah! That feature was built-in! I didn't expect that. Gets better by the hour! Ty
@AwkwardTuring yeah it’s likely a support backdoor
@GossiTheDog @AwkwardTuring I can imagine a tech showing up to fix something and asking the assistant to the assistant manager for the admin password. I'm sure an endless array of blank looks prompted the backdoor.
@GossiTheDog what’re the odds that someone is looking for other, only slightly more complex, methods of compromise?
Oct 13, 2026, 1:55 PM@GossiTheDog If the write up was in August, when was the patch released? Yesterday morning?
Oct 13, 2026, 2:08 PM@GossiTheDog Apparently on the 18th of September
@jfparis the date based backdoor account patch was in March 2025 https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/
@GossiTheDog @jfparis The CVE's CVSS says User Interaction: Required. Misslabelisation?
@Eldeberen @jfparis yep. I think they thought.. the attacker has to do something
I saw reports somewhere that other countries were also affected 🫤
Oct 13, 2026, 5:57 PM@GossiTheDog What a meltdown...
@GossiTheDog It's a hot topic...
Oct 14, 2026, 4:57 PM> running a cryptocurrency miner
ahh, so that's how they got the fridges warm 😜
@GossiTheDog Are you sure they were mining crypto? In the article they say that is unlikely: 'The devices are low-powered and on slow cellular links, which rules out crypto mining and makes them poor for denial-of-service.'
Did an LLM mess up the summary? 🙃
I just came here to ask the same thing.
@zsapi no, it means I can’t read 🤣
In August I know of 2 German supermarkets with the same issue ...
@GossiTheDog i am fucking crying! Wdym?!
@GossiTheDog HOW? How does a supermarket do this? I know NAT is not a firewall, but still the fridges won’t be detected or accessible from a simple port scan if behind a router. So what went wrong here?
@GossiTheDog In a parallel universe: Authorities are forcing vendors of connected devices to be secure by default. And also liable if they aren’t.
Yesterday, it was HVAC control systems for two malls here in Sweden. Why does this keep happening? (Rhetorical.)
Oct 13, 2026, 4:50 PM@GossiTheDog ... or anything else that isn't a halfway decent firewall, I might add.
Oct 12, 2026, 9:02 PM@GossiTheDog « and I’m not constipated »
@GossiTheDog one handed, on your phone 😉
😂 🤣 😆 😀 💩
This one takes the prize for winning the Internet tonight. Kudos GossiTheDog 🏆️
@GossiTheDog my coworker has informed me that they can't write bash scripts without claude. so
Oct 13, 2026, 6:33 AM@gildilinie @GossiTheDog this kind of people are my biggest point about why "just review" is not a working strategy...
