# Fridge Hack Prevention - webcentive

Source: https://www.webcentive.com/fridgesecurity/fridgesecurity.html  
Format: Markdown version of the HTML page (same content, lookups and page chrome left out).

Fridge hack prevention: what refrigerator hacks are, real incidents, and how to protect a smart fridge at home or the refrigeration controllers in a store. Two kinds: home smart fridges (Samsung Family Hub, LG ThinQ, GE SmartHQ, Whirlpool) that join your WiFi, and commercial controllers that run a whole store's cold aisles and are often reachable over the internet so service companies can adjust them.  

More on webcentive: [Today in Refrigerator Hacks News](https://www.webcentive.com/2026/todayhub/today_in_fridgehack_news.html)  

Popular on Amazon: [refrigerator thermometers](https://www.amazon.com/s?k=refrigerator+thermometer&tag=webcentive0d-20) | [wireless freezer temperature alarms](https://www.amazon.com/s?k=wireless+freezer+temperature+alarm&tag=webcentive0d-20) | [WiFi temperature sensors](https://www.amazon.com/s?k=wifi+temperature+sensor&tag=webcentive0d-20) | [mesh routers with IoT networks](https://www.amazon.com/s?k=mesh+wifi+router&tag=webcentive0d-20) | [firewalls](https://www.amazon.com/s?k=home+firewall+appliance&tag=webcentive0d-20)  

Each site has quick lookups: who owns it (whois), its history (Wayback Machine), a safety check, and one-tap questions to AI helpers. Grok asks you to tap Send first.  
Links last checked Nov 2, 2026.  

- **Real incidents (verified)** On Oct 11, 2026, attackers reached internet-exposed refrigeration controllers at up to 700 French supermarkets and forced them into long defrost cycles. Cases rose to about 50°C (122°F) for around six hours, food was thrown out and some units caught fire (BBC, ABC News Australia, Wikipedia). CERT-FR named Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB controllers; Danfoss said most affected units were older models that no longer get updates. No one has claimed the attack. Home smart fridges have had flaws too (Samsung in 2015, LG SmartThinQ in 2017), fixed by the makers.
- [abc.net.au/French supermarkets hacked](https://www.abc.net.au/news/2026-10-13/french-supermarkets-hacked-causing-fires-and-food-loss/107258724) - ABC News Australia (Oct 13, 2026): temperatures raised to as high as 50°C (122°F), fires and food loss | [X: @abcnews](https://x.com/abcnews) | Amazon: none
- [bbc.com/French supermarket fridges](https://www.bbc.com/news/articles/crq5nzxv9q4yo) - BBC News (Oct 12, 2026): fridges in French supermarkets hit by cyber attack | [X: @BBCNews](https://x.com/BBCNews) | Amazon: none
- [blog.checkpoint.com/HomeHack LG](https://blog.checkpoint.com/security/homehack-how-hackers-could-have-taken-control-of-lgs-iot-home-appliances/) - Check Point (2017): “HomeHack” flaw in LG SmartThinQ appliance accounts, fixed by LG | [X: @CheckPointSW](https://x.com/CheckPointSW) | Amazon: none
- [cert.cyber.gouv.fr/CERTFR-2026-ALE-012](https://www.cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/) - CERT-FR alert (in French, Oct 12-16, 2026): Danfoss AK-SM and AK-SC, Copeland XWEB and Dixell XWEB controllers compromised; take them off the public internet, VPN-only access | [X: @CERT_FR](https://x.com/CERT_FR) | Amazon: none
- [claroty.com/Team82 Danfoss research](https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers) - Claroty Team82: vulnerabilities found in Danfoss AK-SM 800A controllers, fixed in firmware R4.3.1 | [X: @Claroty](https://x.com/Claroty) | Amazon: none
- [en.wikipedia.org/2026 French supermarket refrigerator hack](https://en.wikipedia.org/wiki/2026_French_supermarket_refrigerator_hack) - Wikipedia: 2026 French supermarket refrigerator hack (Oct 11, 2026; up to 700 stores) | [X: @Wikipedia](https://x.com/Wikipedia) | Amazon: none
- [pentestpartners.com/Samsung fridge](https://www.pentestpartners.com/security-blog/hacking-defcon-23s-iot-village-samsung-fridge/) - Pen Test Partners (2015): a Samsung smart fridge could expose the owner’s Google login | [X: @PenTestPartners](https://x.com/PenTestPartners) | Amazon: none
- [theguardian.com/who hacked the fridges](https://www.theguardian.com/world/2026/oct/17/who-hacked-frances-supermarket-fridges) - The Guardian (Oct 17, 2026): who hacked France’s supermarket fridges? | [X: @guardian](https://x.com/guardian) | Amazon: none
- **Manufacturers involved and their security updates** Danfoss (Denmark): AK-SM 8xxA series, fixed in releases R4.2 and R4.3.1 (CISA ICSA-25-140-03). The older AK-SM 800 (non-A) and AK-SC 355 controllers hit in France are end-of-life and get no fix; Danfoss advises replacing them. Copeland (US) and its Dixell brand: XWEB and XWEB Pro, fixed in firmware 1.13 (CISA ICSA-26-057-10, Feb 26, 2026). LG: SmartThinQ 'HomeHack' flaw reported by Check Point on July 31, 2017 and patched by LG at the end of September 2017. Samsung: the 2015 RF28HMELBSR fridge flaw (Pen Test Partners); we could not confirm a Samsung advisory or fixed version. GE Appliances and Whirlpool: no refrigerator-specific advisory found; their security pages are listed for reporting. Stores: ask your refrigeration contractor which controller and firmware you have.
- [cisa.gov/ICS advisories](https://www.cisa.gov/news-events/ics-advisories) - CISA: all industrial control system advisories (search for your controller) | [X: @CISAgov](https://x.com/CISAgov) | Amazon: none
- [cisa.gov/ICSA-25-140-03 Danfoss](https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-03) - Danfoss: CISA advisory ICSA-25-140-03 (May 20, 2025; Update A Aug 26, 2025): AK-SM 8xxA series, versions prior to R4.2 / R4.3.1 affected; fixed in release R4.2 (CVE-2025-41450) and R4.3.1 (CVE-2025-41451, CVE-2025-41452) | [X: @CISAgov](https://x.com/CISAgov) | Amazon: none
- [cisa.gov/ICSA-26-057-10 Copeland](https://www.cisa.gov/news-events/ics-advisories/icsa-26-057-10) - Copeland / Dixell: CISA advisory ICSA-26-057-10 (Feb 26, 2026): XWEB 300D PRO, 500D PRO and 500B PRO firmware 1.12.1 and earlier affected; fixed in firmware 1.13 (units on 1.2.1 or earlier must first update to 1.3.0) | [X: @CISAgov](https://x.com/CISAgov) | Amazon: none
- [copeland.com/product security](https://www.copeland.com/en-us/tools-resources/product-security) - Copeland (owner of Dixell): official product security page and XWEB firmware updates | X: none found | Amazon: none
- [danfoss.com/vulnerability disclosure](https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/) - Danfoss: official security advisories (PSIRT) and vulnerability reporting | [X: @Danfoss](https://x.com/Danfoss) | Amazon: none
- [geappliances.com/security](https://www.geappliances.com/security) - GE Appliances: SmartHQ cybersecurity page (no fridge-specific advisory found) | [X: @GE_Appliances](https://x.com/GE_Appliances) | Amazon: none
- [lgsecurity.lge.com](https://lgsecurity.lge.com/) - LG: official product security advisories (LG ThinQ / SmartThinQ appliances) | [X: @LGUS](https://x.com/LGUS) | Amazon: none
- [whirlpoolcorp.com/product security](https://www.whirlpoolcorp.com/product-security.html) - Whirlpool Corporation: product security page for Whirlpool, KitchenAid and Maytag (no fridge-specific advisory found) | [X: @WhirlpoolCorp](https://x.com/WhirlpoolCorp) | Amazon: none
- **How to prevent it** At home: install firmware updates (turn on auto-update; video: [How to Update Software! (We Can Secure Our World)](https://www.youtube.com/watch?v=zCcX6aSXcLI), CISA), use a strong unique password and two-factor login on the appliance app account, put smart appliances on a separate guest or IoT network, and turn off features you do not use. For businesses: never put a controller's web login on the public internet; allow remote access only through a VPN with MFA; change every default password; segment refrigeration from store and payment networks; and keep an independent battery-powered thermometer or temperature alarm in every case and walk-in, so you get an alert even if the controller is wrong. Stores: see [Firewalls for stores](https://www.webcentive.com/firewalls/firewallsforstores.html) (how a firewall and a separate refrigeration network stop these attacks). Why it matters: spoiled food is a food-safety risk, and a hacked device can be a foothold into the rest of the network or part of a botnet.
- [bleepingcomputer.com](https://www.bleepingcomputer.com/) - BleepingComputer: security news and how-tos | [X: @BleepinComputer](https://x.com/BleepinComputer) | Amazon: none
- [cisa.gov/update software](https://www.cisa.gov/secure-our-world/update-software) - CISA Secure Our World: turn on automatic updates | [X: @CISAgov](https://x.com/CISAgov) | Amazon: none
- [foodsafety.gov/power outage](https://www.foodsafety.gov/keep-food-safe/food-safety-during-power-outage) - FoodSafety.gov: when to throw food out after a fridge or freezer warms up (may block automated checks) | X: none found | Amazon: none
- [krebsonsecurity.com](https://krebsonsecurity.com/) - Krebs on Security: news on IoT botnets and hacks | [X: @briankrebs](https://x.com/briankrebs) | Amazon: none
- [nist.gov/IoT program](https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program) - NIST Cybersecurity for IoT program: guidance for connected devices | [X: @NIST](https://x.com/NIST) | Amazon: none
- [shodan.io](https://www.shodan.io/) - Shodan: search engine that shows which devices are reachable from the internet. Businesses use it (or a security firm) to check their OWN exposure | [X: @shodanhq](https://x.com/shodanhq) | Amazon: none
- **Products that help**
- [amazon.com](https://www.amazon.com/s?k=refrigerator+thermometer&tag=webcentive0d-20) - Amazon: refrigerator thermometers and temperature alarms | X: none found | [Amazon: refrigerator thermometer](https://www.amazon.com/s?k=refrigerator+thermometer&tag=webcentive0d-20)
- [eero.com](https://eero.com/) - eero (Amazon): mesh WiFi with a separate IoT network | X: none found | [Amazon: eero mesh wifi](https://www.amazon.com/s?k=eero+mesh+wifi&tag=webcentive0d-20)
- [firewalla.com](https://firewalla.com/) - Firewalla: home and small-business firewalls that can isolate smart devices | X: none found | [Amazon: Firewalla](https://www.amazon.com/s?k=Firewalla&tag=webcentive0d-20)
- [govee.com](https://us.govee.com/) - Govee: WiFi thermometers and hygrometers (Shenzhen company) | X: none found | [Amazon: Govee thermometer](https://www.amazon.com/s?k=Govee+thermometer&tag=webcentive0d-20)
- [inkbird.com](https://www.inkbird.com/) - INKBIRD: WiFi fridge and freezer thermometers (Shenzhen company) | X: none found | [Amazon: INKBIRD fridge thermometer](https://www.amazon.com/s?k=INKBIRD+fridge+thermometer&tag=webcentive0d-20)
- [netgear.com](https://www.netgear.com/) - NETGEAR: routers with guest and IoT networks | [X: @NETGEAR](https://x.com/NETGEAR) | [Amazon: NETGEAR router](https://www.amazon.com/s?k=NETGEAR+router&tag=webcentive0d-20)
- [sensorpush.com](https://www.sensorpush.com/) - SensorPush: wireless temperature sensors with phone alerts | [X: @SensorPush](https://x.com/SensorPush) | [Amazon: SensorPush](https://www.amazon.com/s?k=SensorPush&tag=webcentive0d-20)
- [taylorusa.com](https://www.taylorusa.com/) - Taylor: battery fridge and freezer thermometers | X: none found | [Amazon: Taylor refrigerator thermometer](https://www.amazon.com/s?k=Taylor+refrigerator+thermometer&tag=webcentive0d-20)
- [thermoworks.com](https://www.thermoworks.com/) - ThermoWorks: thermometers and temperature alarms (Utah) | X: none found | [Amazon: ThermoWorks thermometer](https://www.amazon.com/s?k=ThermoWorks+thermometer&tag=webcentive0d-20)
- [ui.com](https://ui.com/) - Ubiquiti UniFi: business networking with VLANs for IoT | [X: @Ubiquiti](https://x.com/Ubiquiti) | [Amazon: Ubiquiti UniFi](https://www.amazon.com/s?k=Ubiquiti+UniFi&tag=webcentive0d-20)
- **Report a fridge hack** If you think a fridge or controller was hacked: unplug it from the network (keep it cold), check temperatures with a separate thermometer and throw out food that got too warm, change passwords on the appliance account and router, reset and update the device, and call the maker or your refrigeration contractor. Then report it: businesses to CISA and the FBI (IC3); consumers to the FBI (IC3), the FTC and the manufacturer's security contact (listed above).
- [cisa.gov/report](https://www.cisa.gov/report) - CISA: report a cyber incident (businesses and critical infrastructure) | [X: @CISAgov](https://x.com/CISAgov) | Amazon: none
- [ic3.gov](https://www.ic3.gov/) - FBI Internet Crime Complaint Center | [X: @FBI](https://x.com/FBI) | Amazon: none
- [reportfraud.ftc.gov](https://reportfraud.ftc.gov/) - FTC: report fraud and scams | [X: @FTC](https://x.com/FTC) | Amazon: none

Number of links: 35  

As an Amazon Associate, Webcentive earns from qualifying purchases.