Refrigeration controllers running outdated software and exposed to the open internet can be taken over remotely. Take them off the public internet, update or replace them, and restrict remote access to reduce that risk.
Ars Technica reports that an attack on refrigeration equipment affected about 700 supermarkets. According to the publication, it cost millions and led to fires, and it relied on outdated devices that could be reached directly from the internet. The publication does not say how the attackers got in, which products were involved, or what triggered the fires. The steps below therefore cover the general problem of connected refrigeration and building-control equipment, not the details of this one case.
Gather what you need before starting
You need permission from whoever owns the equipment and the network, because some steps involve scanning and changing configurations. You also need access to network diagrams, firewall and router settings, and any remote-access accounts used by maintenance contractors. A list of equipment suppliers and service agreements will help, since many controllers are managed by third parties rather than in-house staff.
Ask the refrigeration engineers to take part from the start. Network staff often don’t know what each controller does, and engineers may not know how the controllers are connected. Agree on a maintenance window too. Changing settings on live cooling equipment can affect stock, and a mistake could cause the very fault you are trying to prevent.
Find every connected refrigeration device
Start with an inventory. Supermarkets often use system managers, case controllers, compressor-rack controllers and energy-monitoring units, and many of these have a network port or a built-in web interface. For each device, record its location, make, model, firmware version, IP address and who maintains it.
Compare what you find on the network with the engineers’ records. Devices installed years ago by a contractor, or left over from a refit, are often missing from official lists. A missing device is also one that nobody is patching.
Check which devices are reachable from the internet
Find out whether any controller can be reached from outside the store network. Review firewall rules and port-forwarding settings, and look for routers or cellular modems that contractors may have fitted for remote support. With proper authorisation, an external scan of your own public address ranges can confirm what is visible.
Pay attention to web dashboards, remote-desktop services and industrial protocols that answer without asking for credentials. According to Ars Technica, the incident it describes involved devices that were reachable from the internet. That kind of exposure is the first thing to fix.
Remove direct internet exposure
No refrigeration controller should be reachable directly from the public internet. Close the port forwards and remove any public addresses. Disconnect unauthorised modems as well, after checking with the engineers that this will not disable alarms they rely on.
If remote access is genuinely needed, route it through a controlled gateway. That could be a virtual private network or a remote-access service that requires multi-factor authentication, logs every session and limits each user to the devices they maintain. Contractor accounts should be personal, not shared, and should be removed when a contract ends.
Replace default and shared credentials
Many embedded controllers ship with factory usernames and passwords that are published in manuals. Change them on every device. Use unique passwords per site so that one leaked password does not open every store. Store them in a password manager that both the engineering and IT teams can audit.
Some older controllers have only one administrator account or no password option at all. Record those devices separately. They cannot be protected at the device itself and need stronger protection on the network around them.
Update or retire outdated controllers
Check each device’s firmware against the manufacturer’s current release and any published security advisories. Apply updates during the agreed window and test that temperatures, alarms and defrost cycles still behave correctly afterwards.
Some models are no longer supported and will never receive fixes. Plan to replace them, and until then, put them behind the strictest network controls you have. Ars Technica’s account highlights outdated equipment as a factor. An unsupported device that is also reachable from the internet is the worst combination on this list.
Separate refrigeration systems from other networks
Put building-control equipment on its own network segment. Keep it away from point-of-sale systems, office computers and customer Wi-Fi. Allow only the specific connections the controllers need, such as to a central monitoring server, and block everything else by default.
Segmentation limits how far an intruder can move. If a compromised laptop or a weak device elsewhere in the store is used as a foothold, a well-separated refrigeration network is much harder to reach.
Add monitoring and physical safeguards
Collect logs from firewalls, remote-access gateways and, where possible, the controllers themselves. Set alerts for logins outside maintenance hours, changes to setpoints and new devices appearing on the network.
Refrigeration systems control compressors, fans and defrost heaters, so settings that are tampered with or unsafe can damage equipment or create hazards. Ars Technica does not explain how the fires in its report started. Even so, it makes sense to check that independent safety devices are fitted and working, such as high-pressure cut-outs, thermal protection and heater limit switches. These should not depend on software that can be changed over the network.
Avoid the mistakes people actually make
- Treating refrigeration as a facilities matter that IT security does not cover, so nobody owns the risk.
- Relying on “nobody knows the address”. Exposed devices are found routinely by automated scanning.
- Leaving contractor remote-access tools running permanently after a single repair.
- Updating firmware once and never checking again.
- Using the same password across hundreds of sites for convenience.
- Segmenting the network on paper while a forgotten rule still lets all traffic through.
- Testing changes in the middle of trading hours without a rollback plan.
Recognise when this approach is the wrong choice
This guide assumes you own or are responsible for the equipment. If you are a supplier managing devices for many customers, the bigger fixes sit in your own remote-access platform and product design, and you should start there.
If a device is actively compromised, follow incident-response procedures first. That means isolating it, preserving evidence and involving the manufacturer and, where appropriate, the authorities, before you reconfigure anything. Wiping or updating a device too early can destroy evidence.
Where a controller is unsupported and cannot be isolated safely, network fixes are only a delay. Replacing it is the right answer. If there is an immediate fire or safety risk, make the equipment physically safe before working on its security.
Frequently asked questions
Can a supermarket fridge really be hacked?
Yes. Many commercial refrigeration systems use networked controllers with web interfaces or remote-management features so that engineers can monitor temperatures and alarms. If those controllers run outdated software, use default passwords or can be reached from the internet, an attacker may be able to log in and change settings. Ars Technica reports an incident affecting about 700 supermarkets that exploited exactly this kind of exposed, outdated equipment.
How did the supermarket fridge hack cause fires?
The available reporting does not explain how the fires started. In general, refrigeration controllers manage compressors, fans and defrost heaters, so settings that are manipulated or unsafe could put stress on equipment. That is why independent hardware safety devices, such as pressure cut-outs and heater limit switches, should not rely on software that can be changed over a network. Any further detail about this particular incident is not publicly known.
How do I find out if my building controllers are exposed online?
Start by reviewing firewall rules, port-forwarding settings and any routers or cellular modems that contractors have installed. With proper authorisation, run an external scan of your organisation’s own public IP addresses to see which services respond. Pay attention to web dashboards and industrial protocols that answer without credentials. Never scan networks you do not own or have written permission to test.
What should I do with refrigeration controllers that no longer get updates?
Plan to replace them. Until replacement is possible, remove any internet exposure and place them on an isolated network segment that only permits the connections they strictly need. Make sure remote access goes through a gateway with multi-factor authentication and logging, and check that independent physical safety devices are fitted. Unsupported equipment will never receive fixes for newly discovered flaws.
Sources and further reading
- Ars Technica: technology news report on the supermarket refrigeration incident and its link to outdated, internet-exposed devices.
- National cybersecurity agencies: published guidance on securing operational technology and internet-connected building-control systems.
- Industrial control system security standards bodies: frameworks for network segmentation and remote-access controls in operational environments.
- Equipment manufacturers’ security advisories: notices about firmware vulnerabilities and end-of-support dates for controllers.
Surfaced from the rss:arstechnica signal “supermarket refrigeration hack”. AI-assisted draft, editorially reviewed.
