The bit that caught my attention this week wasn’t another warning about AI. It was governments asking people to keep enough food, water and essential supplies at home to get through a disruption.
The UK is recommending three days. Denmark says the same. Norway and Sweden recommend a week. These are broader emergency-preparedness measures, not predictions of an imminent attack, but cyberattacks are explicitly part of the picture in the UK, Denmark and Norway.
That brings the cyber conversation out of the server room and into the kitchen.
Meanwhile, the fridges are warming up
Alongside that advice came reports of cyberattacks on supermarket refrigeration systems across Europe, with knock-on effects at UK meat-processing businesses. The affected UK units were reportedly empty, and no meat was lost. A much better outcome than it could have been.
Reporting on the earlier French incidents pointed to legacy equipment connected to the internet with default passwords.
That is the part worth sitting with. Not a sophisticated new exploit. Not an AI system doing something nobody thought possible. Equipment that could be reached, with credentials that should have been changed.
If your business depends on keeping food cold, the refrigeration controller is not just another device on the network. It is part of the process that keeps your product safe and your business operating.
AI adds pressure. It doesn’t replace the old problems.
The UK’s National Cyber Security Centre has warned that AI-powered malware is “highly likely” to feature in a ransomware attack on the country’s critical infrastructure by 2028.
That deserves attention. But we shouldn’t become so focused on what attackers might do next that we overlook what they can already reach.
The maintenance connection that became permanent. The shared vendor account nobody owns. The controller everyone assumes sits behind a firewall, although nobody has checked recently.
Those are not exciting problems to talk about. They are, however, things we can do something about.
Before anyone buys another tool, there are a few questions I would want answered:
- Which systems can change a physical process, and how can they be reached?
- Who has access, including contractors and equipment suppliers?
- Would operators notice an unauthorised change before it affected safety, product or production?
- Can we remove that access and keep the process operating safely?
Answering those questions needs operations, maintenance, engineering and cyber in the same room. The connection that looks unnecessary on a network diagram might be the one maintenance relies on at two in the morning. You need to understand it before pulling the plug.
Thought for this week
Household preparedness and OT security might seem like separate conversations, but they meet at the same point: people relying on essential services.
For the public, preparedness might mean food in the cupboard, drinking water and a torch. For those of us responsible for OT, it means understanding the systems delivering those services, the access into them, and how to keep them operating when something goes wrong.
The word that matters here is consequence.
If someone changed a critical setting in your environment tonight, would your team catch it in time? Or would the first sign be spoiled product, a stopped process or a service people can no longer use?
Have a good week,
Damien Pope
Header photo: AG20044018, CC BY-SA 4.0, via Wikimedia Commons.
