Six Hours at 50°C and Not a Single Alarm

Somebody Defrosted Hundreds of Supermarkets From a Keyboard

Frost melting off the evaporator coils, water pooling under the cases, the heaters running behind the panels while ice cream turns to soup in the carton. That's what a defrost cycle looks like when nobody tells it to stop. On Sunday night, October 11, it happened in hundreds of French supermarkets at once, and according to Bloomberg the cases sat at around 50°C for about six hours.

Nobody unplugged anything. Somebody logged in and told the refrigeration systems to defrost, and they did exactly what they were told.

By Monday morning Intermarché, Netto, Coopérative U and several E. Leclerc stores were throwing out meat, frozen goods and vegetables. Intermarché's owner, Groupement Mousquetaires, first put it at about 150 of its stores. Later reports pushed that past 300 Intermarché and Netto locations, plus 100 or so Coopérative U stores. Paris prosecutors say the attack also set off fires and fire alarms, and they've opened an investigation. Intermarché is already warning that insurance may not cover it, which is a fun thing to find out on a Monday.

How they most likely got in

Most supermarket refrigeration runs through a system manager, one controller that sits above every case controller in the store. From its web page you can watch every circuit, change temperature thresholds, change schedules, run defrost, add users and clear alarms. It's the one box in the building that can touch everything, and it's usually connected so a refrigeration service company can maintain it from somewhere else.

E. Leclerc said the attack hit one of its refrigeration equipment suppliers. France's cybersecurity agency, ANSSI, reportedly found a vulnerability in that supplier's software and contacted the vendor. And security researchers had already shown this summer that some supermarket refrigeration controllers carry hidden maintenance logins, a way for a support tech to get in without the store's admin password, and that thousands of them were sitting on the open Internet.

So the most likely story is pretty simple. Someone found a way into those system managers, through a built-in maintenance login or through the service company's own remote connection into the stores, logged in as admin and hit defrost on every store they could reach, on a Sunday night when the fewest people would be around to notice. Hundreds of stores across competing chains going warm on the same night means one shared way in, and a supplier's remote access is the obvious one. None of that is confirmed yet. It's still the simplest explanation.

Why it bothers me

What gets me about this one is that the same controller that could run defrost was also the thing responsible for raising the alarm when the temperature went wrong. Once an attacker owned that box, the store was blind. And it was reachable by people the store owner never invited in, from who knows where.

[personal note: anything from your own work, a customer conversation, or your own fridge setup you want to add here?]

How I'd lock it down with Shelly

I wouldn't rip out a supermarket's refrigeration controls and swap in Shelly devices. Rack controllers, compressors and expansion valves are their own world. What I'd add is a second layer that watches the cases and can step in, and that nobody can reach from outside the building.

Start with a Shelly Plus Add-on and DS18B20 probes on a Shelly Plus 1PM in each case, so you've got a thermometer that doesn't care what the refrigeration controller claims the temperature is. Put a Shelly Pro 3EM on the refrigeration panel, or Shelly Pro 4PM devices on individual circuits, and you can see exactly what's drawing power. Defrost heaters are easy to spot, a big resistive load that's supposed to run for a few minutes on a schedule, not every heater in the store for six hours straight.

Then a script running right on the Shelly watches case temperature and heater power. If a case passes its limit or the heaters run past their normal window, it opens a Shelly Pro relay driving the contactor that feeds the defrost heater circuit - commercial defrost heaters pull a lot of current, so the Shelly switches the contactor coil, not the heaters themselves. That check runs on the device, with no server involved and nothing upstream to ask permission from.

The devices themselves are locked down. Every Gen2 and newer Shelly uses the same RPC API, and the local HTTP and WebSocket interfaces are protected with a password using SHA-256 digest authentication. MQTT and outbound WebSocket connections can use TLS. On firmware 2.0.0 and newer, Bluetooth RPC only talks to bonded clients once the device is set up, and new bonds only happen when someone deliberately opens a pairing window. There's no hidden login and no vendor back door, the only way in is the credentials you set.

However, the best protection is that none of this needs the Internet at all. Put the whole layer on an isolated VLAN with no route out, no cloud account and no vendor remote access, and send alerts and logs to a local MQTT broker or a Home Assistant server inside the store. Or skip Wi-Fi and talk to the devices over Bluetooth, where you have to be standing within a few meters of them. To touch any of it, an attacker has to walk into the building, past the checkout lanes and the deli counter, and get onto that network. Nobody is doing that to hundreds of stores from a laptop on a Sunday night.

Set up this way, the attacker can still get into the refrigeration system manager and tell every case in the store to defrost. The Shelly layer sees the temperature start climbing, cuts the heaters and alarms somebody, and Monday morning is a phone call instead of a dumpster full of food.

The thing that keeps food cold shouldn't take orders from somebody who's never been inside the building.