I would be very skeptical of anyone relying on Shodan data. At one point I was trying to write honeypots myself by replicating wifi cameras, but almost all the ones on the internet I found were honeypots of some sort, and the ones that weren't were already hacked and had their web pages replaced. In retrospect it would have probably been better to get a vulnerable device myself and probe it.
If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though.
hedgerow-dev 23 hours ago [-]
At this point the honeypot I'm running is not marked as honeypot. Guess that it's a good sign?
supriyo-biswas 23 hours ago [-]
What I meant is that I'd find some way of ensuring that I'd want to ensure that the responses you're serving up are real. If you are happy with what you have, we're good.
Plot twist: the hackers are members of the Van Helsing Society and the supermarkets were just a trial run in their war against the International Vampire Cabal.
hedgerow-dev 23 hours ago [-]
One thing keeps coming back, (and it's the story of industries where security and patching is an afterthought).
a supermarket has no security team.
If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default.
One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.
amenghra 21 hours ago [-]
This is how it should work: supermarket wants to use high tech stuff such as connected fridges, they get a cyber insurance policy as part of all the other insurances they have. The insurer then has domain experts to figure out what the insured needs to do to meet a risk threshold (or they adjust fees accordingly).
This model has worked fine for many other types of risks.
rcxdude 8 hours ago [-]
In practice this insurance (which already exists!) just creates another compliance checklist and not a meaningful focus on actual security.
hedgerow-dev 21 hours ago [-]
Many of these supermarkets are part of big brands but operate independently. I doubt cyber insurance is top of mind for those small owners
SoftTalker 20 hours ago [-]
It will be soon. How many refrigerated cases of product can they afford to lose?
gruez 15 hours ago [-]
Not to mention other ways cyberattacks can paralyze their business, eg. their POS system
_kb 14 hours ago [-]
That seems pretty location dependant. In Australia at least the two major supermarket chains are not insignificant (e.g. EBITDA ~$5 billion and ~$2.6 billion) and have large internal tech and cyber teams.
I think this is more indicative of the plethora of technical debt and straight up technical negligence that's accompanied the past 10-15 years of internet connected everything. What's happening today is the predictable result of project based works funded by capex deploying assets (of all types) with no consideration of opex funding for the technology components.
Just because a webserver is running in some physical device (fridge, camera, vacuum, washing machine, pump controller, lighting system, audiovisual equipment, access control system etc) does not magically exempt it from the same sort of ongoing sysadmin and maintenance you'd expect as a baseline for something running on standard compute. That applies equally to manufacturers publishing firmware, and the asset owners/service companies that have the responsibility to apply.
gspr 8 hours ago [-]
Agree with all of what you're saying, wholeheartedly.
But I keep coming back to: why do supermarkets need networked freezers anyway? Most supermarkets are open most days, with long hours. Can't any adjustments just be done manually by staff on the rare occasions when that is needed? I've seen some people argue that the major usecase is defrosting. But when you're defrosting, you certainly have lots of people on site engaged in emptying the fridge in question. Surely flipping the thermostat is a rounding error as far as costs go?
minusLik 2 hours ago [-]
Networking freezers is good for:
* continuous monitoring and logging of the freezer's temperature (supermarkets are obliged to do so)
* sending alerts when something's off
Regarding the defrosting: Commercial freezers can defrost while the groceries stay in, just like the "No-Frost" freezer at home.
Shadowmist 1 hours ago [-]
Monitoring/logging/alerting can all be done without storing the network connected computer up to anything that can change the temperature settings. It can and should be a completely separate system.
yojo 11 hours ago [-]
I work at a company that sells security software, and one of our customers is a major grocery chain. They definitely have a security team, I’ve talked to them.
asjo 6 hours ago [-]
Can't open the link, GitHub is down:
503 Service Unavailable
No server is available to handle this request.
gukov 19 hours ago [-]
Not a headline I ever expected to read. 2026 has been a wild year.
Crunchified 18 hours ago [-]
It's been a wild year from a suburbanite perspective. There's still a long way to go before real wilderness is witnessed.
saidnooneever 9 hours ago [-]
i think it would be pretty trivial to determine the box is a pot from whois etc.
people who target these supermarket chains etc. are doing just that. not scanning the entire internet and popping all the fridges, but doing targeted attacks.
mostly your pot will just be a +1 on benign peoples scanners.
you want honeypots for things that are mass exploited, not for things used in targeted attacks.
just my 2 cents. respect the project can be fun to do ofc but i wouldnt expect much interesting results.
that being said maybe you can find parties who secure these chains, or themselves, and offer it as a TI sort of service. Seeing as they knew about these vulns for many months before they got hit, its unlikely they will pay for it or be interested.
hedgerow-dev 9 hours ago [-]
Great input, thanks!
My next step is to deploy on a normal ISP and not on a cloud provider. Just let it sit there.
I think we should give back to those companies as much as possible. OT is not where the big money is and all security experts are flocking to.
I've already started some actions in this direction btw.
amelius 18 hours ago [-]
The interesting aspect of these attacks was that they seemed to have been done per country.
DANmode 21 hours ago [-]
Super cool, especially showing your work as FOSS, but: why announce your honeypot before it’s fulfilled its intended purpose once?
hedgerow-dev 21 hours ago [-]
The more people that can deploy it, the higher the chance of discovering something about the attacks. Also this gave me an incentive to look deeper into the real software.
morkalork 23 hours ago [-]
You'd probably have more luck posing as other industrial hardware like HVAC, lighting, controllers for the kinds of pumps or valves you'd find in chemical plants. That kind of stuff.
hedgerow-dev 22 hours ago [-]
New ideas are popping up. I started with fridges because of the recent attacks, but the code makes it easy to add personas. Electric car charing stations and coffee machines were my initial idea, but HVAC and building controllers are probably better ideas. Thanks!
mathfailure 3 hours ago [-]
Why?
asdf88990 17 hours ago [-]
Did you write this post with AI?
- Letting them in. Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first. Nothing behind it is real.
Given the context, this reads like vomit.
viraptor 8 hours ago [-]
Both the post and the comments. It's cringe. Just write what you have to write, author.
grey-area 11 hours ago [-]
Of course they did. That text is Claude.
throwaway2037 11 hours ago [-]
Did anyone else notice the badge at the top of the GitHub README.md?
Something about it is cringe to me. It is giving LinkedIn self-promotion vibes.
Melatonic 16 hours ago [-]
Very cool. Seems like this is the modern hacker version of "is your refrigerator running?"
22 hours ago [-]
IshKebab 23 hours ago [-]
The hilarious thing about this is that there was an initial hack, and then like a month later another one that was equally successful. Who could have possibly seen that coming lol.
> Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first.
I think we're past the point where it's reasonable to expect people to not use AI for code, but their prose still sucks balls. You should at least write your submission here yourself, come on.
23 hours ago [-]
hedgerow-dev 23 hours ago [-]
I agree, I rushed this one a bit. Glad to share with the industry at least.
realty_geek 22 hours ago [-]
TBH, I think at this point it is the "holier than thou" people pointing out every instance of slightly AI sounding text that are getting annoying.
I was happy reading you post and I imagine there are many many more people like me than the grinch.
hedgerow-dev 22 hours ago [-]
Thanks! To be honest, using AI helps 'gettings things out' instead of shelving it because it's never perfect.
realty_geek 7 hours ago [-]
I have met super intelligent people who speak multiple languages but need a bit of help writing stuff in English.
I have no idea who you are, but I would rather give you the benefit of the doubt then try to get a dopamine hit by attacking you.
phyzome 12 hours ago [-]
While it might help you get things out faster, it's still counter to this one fundamental rule:
If you couldn't be bothered to write it, I can't be bothered to read it.
IshKebab 20 hours ago [-]
> I think at this point it is the "holier than thou" people pointing out every instance of slightly AI sounding text that are getting annoying.
I don't think it's unreasonable to spend literally 3 minutes writing your own submission. I'm not asking to rewrite every code comment.
And it wasn't "slightly" AI sounding text. It's very obviously AI.
morkalork 22 hours ago [-]
Crazy thing is, when the fridges in all those military bases were hacked people were initially in denial and the people noticing that it was just a little too coincidental to be happing simultaneously were called paranoid. Well who's paranoid now?
vkaku 22 hours ago [-]
Me reading it be like:
MFs be doing everything but pulling those fridges off the Internet. Given the amount of TOR nodes, IP addresses today, Honeypots mean nothing ....
Of course, it's my unpopular opinion. :)
hedgerow-dev 22 hours ago [-]
Agreed, that's the real fix. The honeypot is just to see who's looking while they're still out there.
viraptor 8 hours ago [-]
Honeypots are not there to prevent or disrupt attacks. You use them to collect interesting interaction samples. The author is not running any real fridges or making any choices about protecting them.
todo-laterx 12 hours ago [-]
[flagged]
thenayr 17 hours ago [-]
[dead]
xrd 24 hours ago [-]
Wait, I recall reading the threads about someone speculating there was a hack. Some people suggested it could just be that a large percentage of refrigeration units received a software update at the same time which resembled a hack.
Is there a definitive story that someone actually did hack these units on a grand scale?
eterm 23 hours ago [-]
There have been (at least) two separate waves to this now, which makes the "innocent broken update" speculation much less likely?
msephton 19 hours ago [-]
Unless they push updates in waves, which is what most big rollouts do.
Muromec 21 hours ago [-]
That's a known playbook. Stir up shit, then create an uplausible denial which will take experts some time to debunk. Once it's figured out the story was bs, put out another three. By the week end there is 10 narratives and nobody except the field experts is sure that it's the usual suspects doing the usual things, but nobody listens to those
gruez 15 hours ago [-]
Examples of this happening in the past?
Muromec 5 hours ago [-]
I believe the most documented example is mh17
raizer88 23 hours ago [-]
This type of attack lasted few days in different countries, quite hard to believe the fridge manufacturer could keep pushing these updates after all the news around.
That's the first of four incidents I've seen in the news recently. As far as I know it's the one that could have been some other kind of correlated failure (bad update, calendar bug, whatever). We don't know much about it.
After that were two separate supermarket events, which I think were both linked to the known Danfoss vulnerability (CVE-2025-41450); and most recently a blood bank event.
Bengalilol 23 hours ago [-]
Now, as of November 2026, it is confirmed as a hack.
Confirmed exploits, many manufacturers, experts, …
hedgerow-dev 23 hours ago [-]
My view is that some companies installing this have not implemented any defense in depth and cut corners all around. Installing a firewall with a simple vpn service would probably have prevented lots of pain (unfrosting).
In general we also see almost every security expert working at banks or other high paying companies and not for supermarkets.
My feeling is that this 'niche' is probably interesting to spend some 'tokens' and time on.
embedding-shape 23 hours ago [-]
> Is there a definitive story that someone actually did hack these units on a grand scale?
Although seemingly the hack wasn't so sophisticated, maybe it's truly just some kids fucking around with what they see being open, and maybe just want to target European countries for the "lulz" or whatever, who knows.
hedgerow-dev 23 hours ago [-]
It's most certainly a form or hybrid warfare. While being very easy to perform, it's still quite effective. Empty supermarkets and supply chains being disturbed.
Hopefully this is a wakeup call for the industry.
noir_lord 23 hours ago [-]
> Hopefully this is a wakeup call for the industry.
Would be nice but none of the other <waves at cybersecurity for the last decade> events has been.
It seems like something horrific is going to have to happen before this is taken as seriously by government and private orgs as it should have been, that seems to be how it works with other stuff historically.
Rendered at 17:24:20 GMT+0000 (Coordinated Universal Time) with Vercel.
If I were you, I would probably ensure that the fridges you used have residential or commercial (aka non-DC) IP addresses. Maybe Shodan uses this data for their "honeypot" label, my experience was some time ago so no idea though.
Heh.
a supermarket has no security team. If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default. One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.
This model has worked fine for many other types of risks.
I think this is more indicative of the plethora of technical debt and straight up technical negligence that's accompanied the past 10-15 years of internet connected everything. What's happening today is the predictable result of project based works funded by capex deploying assets (of all types) with no consideration of opex funding for the technology components.
Just because a webserver is running in some physical device (fridge, camera, vacuum, washing machine, pump controller, lighting system, audiovisual equipment, access control system etc) does not magically exempt it from the same sort of ongoing sysadmin and maintenance you'd expect as a baseline for something running on standard compute. That applies equally to manufacturers publishing firmware, and the asset owners/service companies that have the responsibility to apply.
But I keep coming back to: why do supermarkets need networked freezers anyway? Most supermarkets are open most days, with long hours. Can't any adjustments just be done manually by staff on the rare occasions when that is needed? I've seen some people argue that the major usecase is defrosting. But when you're defrosting, you certainly have lots of people on site engaged in emptying the fridge in question. Surely flipping the thermostat is a rounding error as far as costs go?
* continuous monitoring and logging of the freezer's temperature (supermarkets are obliged to do so)
* sending alerts when something's off
Regarding the defrosting: Commercial freezers can defrost while the groceries stay in, just like the "No-Frost" freezer at home.
people who target these supermarket chains etc. are doing just that. not scanning the entire internet and popping all the fridges, but doing targeted attacks.
mostly your pot will just be a +1 on benign peoples scanners.
you want honeypots for things that are mass exploited, not for things used in targeted attacks.
just my 2 cents. respect the project can be fun to do ofc but i wouldnt expect much interesting results.
that being said maybe you can find parties who secure these chains, or themselves, and offer it as a TI sort of service. Seeing as they knew about these vulns for many months before they got hit, its unlikely they will pay for it or be interested.
- Letting them in. Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first. Nothing behind it is real.
Given the context, this reads like vomit.
> Default logins open a fake store dashboard with defrost buttons, so you see the second move, not just the first.
I think we're past the point where it's reasonable to expect people to not use AI for code, but their prose still sucks balls. You should at least write your submission here yourself, come on.
I was happy reading you post and I imagine there are many many more people like me than the grinch.
I have no idea who you are, but I would rather give you the benefit of the doubt then try to get a dopamine hit by attacking you.
If you couldn't be bothered to write it, I can't be bothered to read it.
I don't think it's unreasonable to spend literally 3 minutes writing your own submission. I'm not asking to rewrite every code comment.
And it wasn't "slightly" AI sounding text. It's very obviously AI.
MFs be doing everything but pulling those fridges off the Internet. Given the amount of TOR nodes, IP addresses today, Honeypots mean nothing ....
Of course, it's my unpopular opinion. :)
Is there a definitive story that someone actually did hack these units on a grand scale?
After that were two separate supermarket events, which I think were both linked to the known Danfoss vulnerability (CVE-2025-41450); and most recently a blood bank event.
Confirmed exploits, many manufacturers, experts, …
Given the scope here (see map at https://en.wikipedia.org/wiki/2026_French_supermarket_refrig...), it'd either be individual hackers getting inspired from their neighbor hackers, or one actor targeting European countries.
Although seemingly the hack wasn't so sophisticated, maybe it's truly just some kids fucking around with what they see being open, and maybe just want to target European countries for the "lulz" or whatever, who knows.
Would be nice but none of the other <waves at cybersecurity for the last decade> events has been.
It seems like something horrific is going to have to happen before this is taken as seriously by government and private orgs as it should have been, that seems to be how it works with other stuff historically.