FULL STORY

Hackers Cook French Supermarket Freezers

Hackers hijacked legacy Danfoss refrigeration software to heat French supermarket freezers to 50°C, sparking a heated debate between Matthew Green and Zeynep Tufekci over IoT and AI security.

2026-10-12 ~ 2026-10-14 · 2 episodes · 19 posts

Episode 1 · Hackers Cooked French Supermarket Fridges to 50°C via Outdated Danfoss Systems (2026-10-12, 11 posts)

From Sunday night into Monday morning, a large-scale cyberattack hit French supermarkets' cold-chain systems: hackers breached remote refrigeration management software supplied by Danish engineering firm Danfoss, forcing chillers and freezers up to 50°C for defrost cycles, destroying vast amounts of fresh and frozen food, with losses estimated in the millions of euros. Paris prosecutors have opened an investigation. The incident exposes security weaknesses in IoT infrastructure — especially concerning as AI empowers attackers.

Confirmed

  • The target was the remote refrigeration management (legacy refrigeration control) system from Danfoss; units were remotely forced to roughly 50°C between Sunday night and Monday morning.
  • Affected chains include Intermarché and Coopérative U: AFP reported roughly 150-200 Intermarché stores and nearly 100 Coopérative U outlets; BFMTV reported about 150 stores affected. Posts vary on total store counts (about 150 to 500), with losses estimated in the millions of euros.
  • Paris prosecutors have opened an investigation (per reports relayed by @Yamapama).

Not yet confirmed

  • @Yamapama and @Su8u mentioned the attack "caused fires," but the BFMTV report relayed by @AccBalanced only cited massive food spoilage; the fire claim lacks support from more authoritative reporting.
  • Store counts and total loss figures vary across reports; official investigation findings will be definitive.

Why it matters

  • Security researcher Stocko and several posters noted that IoT infrastructure vulnerabilities are amplified on both offense and defense in the AI era; @AnnaCiaunica remarked that "AI is one step away from your food," warning that such remote attacks on physical infrastructure could become routine.

Episode 2 · Fridge IoT Attacks Spark Green–Tufekci Debate on AI's Role in Cybersecurity (2026-10-14, 8 posts)

On October 14, Johns Hopkins cryptographer Matthew Green and sociologist Zeynep Tufekci held a multi-round debate on X over the recent mass attacks on fridges and other IoT devices (including the hack of a French supermarket's refrigeration systems), focusing on AI's role in cyberattacks and where the real risks lie. It became the security community's hottest debate of the day.

Confirmed

  • The argument started with the IoT fridge attacks: Zeynep pointed out that the attacks exploited an old CVE from 2023 that vendors had long since patched—victims simply hadn't updated their firmware. The fridge firmware also contained a suspected backdoor left for vendor remote support (generating passwords from the current date).
  • Green conceded these attacks were "not AI"-driven, but argued this doesn't change the threat escalation AI will bring.
  • Green listed the two AI risks that worry him most: expert-level hacking models falling into the hands of malicious amateurs, and someone building a self-replicating agent worm. He considers these more urgent than distant concerns like "agent jailbreaks" or "rogue agents."
  • Green further warned that AI will let attackers share tools and get smarter, giving "people who just want to break things" the kind of exploit development capability that once required nation-state resources; even patched networks remain riddled with vulnerabilities, and defenders are far from keeping up. He said the fridge incident has already cost victims millions.
  • Zeynep's position: unpatched software is a longstanding problem (the FBI and Equifax cases are precedents), and AI fears might actually spur defensive action; she argued the current focus is misplaced—the real problem is the de-guardrailed models plus poor configuration exemplified by the Hugging Face incident.

Unconfirmed

  • The exact origin of the fridge firmware backdoor and its vendor remote-support purpose remain speculative.
  • Whether AI has already become "standard equipment" in real attacks at scale is pure speculation on both sides, with no empirical data.

Why it matters

  • The debate reflects a split in how the security community models AI threats: is it "AI amplifying attack capability," or is "missing basic hygiene (patching, configuration)" the root cause? The two views imply very different defense investment priorities, with lessons for policymakers and enterprise security strategies alike.