Following a cyberattack that caused millions in damages and sparked massive electrical fires, a major supermarket chain conceded Tuesday that connecting its commercial refrigeration units directly to the web may have been an architectural misstep.
The breach, which compromised operations across 700 store locations, occurred after hackers scanned the internet and found thousands of smart-coolers entirely unprotected by passwords or basic firewalls. Once inside the network, attackers were able to bypass the cooling controls and overdrive the compressor motors until the dairy aisles violently combusted.
Investigators noted that the underlying firmware for the industrial freezers had been pulled from an abandoned GitHub repo in 2018 and never updated. This deployment strategy left the appliances highly optimized for receiving catastrophic remote commands at scale, allowing attackers to efficiently burn down supermarkets from halfway across the globe.
We continually remind enterprise clients to air-gap their produce section, because once a malicious actor gets root access to the deli meat, a structural fire is inevitable.
Company officials defended their initial IT strategy, stating that putting the frozen food aisle on the public internet was a crucial part of their digital roadmap. The exposed connectivity allegedly allowed regional managers to monitor fluctuating cheese temperatures in real time without the friction of walking to the back of the store.
The chain has since promised to secure its remaining appliances, though a leaked memo indicates IT staff are currently struggling to install antivirus software on the bakery's bread slicer.