Hackers Are Reaching the Systems That Keep Us Alive

The short answer

This week's break-in did not hit a power plant or a bank vault. It came in through the software companies use to fix each other's computers. That sounds like a problem for IT departments. It is not just theirs.

Over the last few months, hackers have pushed supermarket freezers into heating cycles, changed the settings on water plant equipment, and knocked a hospital onto ambulance diversion for part of a day. Each attack had its own target. Together they show where this is heading: away from stolen passwords and toward the machines that keep food cold, water flowing and patients cared for.

You can lock down every account you own and still be hit when a grocery chain, a water utility or a hospital loses its systems. That is why we think regular households should pay attention to a story that usually gets left to tech reporters.

The newest attack came through the help desk

Remote-support tools let a technician fix a computer from miles away. Thousands of small businesses rely on outside support companies that use them. On November 11, security firm Huntress watched rogue support software get pushed onto at least 288 computers at 48 organizations in about 90 minutes. The way in appears to have been a third-party add-on for the popular ScreenConnect tool, which in some setups would accept a blank password.

The maker of ScreenConnect, ConnectWise, says it found no flaw in its own product and no break-in on its own systems. It switched off the risky add-ons on roughly 400 cloud setups. But here is the part that matters: switching off the door does not remove anyone who already walked through it. Every business that used those add-ons now has to check what was left behind.

Days earlier, another big support platform, N-able, pulled its hosted service offline worldwide after a researcher published more than 30 security holes along with working attack code. N-able says it found no sign of a break-in on its hosted servers and had them patched and back online within about two days. A careful shutdown is the right call, but for the businesses that depend on that service, two days is still two days.

There is also a simpler trick going around. Criminals call employees pretending to be the company's own IT staff and walk them to fake sign-in pages. A familiar logo, a calm voice and a deadline are all it takes.

Food: from freezers to empty shelves

We wrote yesterday about the supermarket freezer attacks in France. The official French report adds detail: about 700 stores were hit overnight on October 11 and 12, food spoiled, and at least 15 fires started when the freezers were forced into heating cycles. The same attackers also went after equipment at small hydroelectric plants, with limited effects. France blames a cyber unit of Iran's Revolutionary Guards. Iran denies it.

A second wave hit more refrigeration systems in other European countries in early November. Sweden made a fair point this week: nobody has proven that wave came from the same people.

Grocery chains are also getting hit the ordinary way. Ahold Delhaize, the company behind Food Lion, Stop and Shop and Hannaford, says an October cyberattack that disrupted its online ordering will cost it 200 to 250 million euros in lost sales this quarter. That was a separate IT attack, not freezer sabotage, but it is the same lesson: food reaches your table through computers you will never see.

Water: seven states, pressure loss and flooding

This summer, federal investigators warned that hackers had broken into control equipment at water systems across at least seven states. They changed passwords and settings so operators could not see or control their own systems. The reported effects included loss of water pressure and flooding. In Minnesota alone, more than 30 community water systems were hit, and one town took its treatment plant offline.

Nobody has reported contaminated water reaching homes. Nobody has officially named who did it either. But a drop in water pressure is not a small thing. It can let dirty groundwater seep into pipes, which is exactly why towns issue boil-water notices.

Hospitals and shipping

On October 26, the University of New Mexico's hospital system, the state's only top-level trauma center, diverted ambulances and canceled clinic appointments because of a cybersecurity problem. It had its critical systems back by the next morning. That is a fast recovery, and still, for anyone in an ambulance that day, the closest trauma center was not an option.

On November 11, shipping giant Maersk confirmed hackers had stolen data from an old system it picked up in an acquisition. Maersk says the damage appears contained and its wider operations were not affected. A criminal group is demanding five million dollars. A data theft is not a shipping shutdown, but it shows how forgotten old systems become the back door.

Is it really getting worse?

In some places, clearly yes. On October 27, Norway put its national cyber risk rating at high, the first time it has published that rating, after successful attacks on Norwegian businesses tripled in a year.

We also want to be fair. Not every number is climbing, and not every outage is an attack. The water hacks, the freezer attacks and the support-software break-ins are different cases with different culprits. Some are proven, some are suspected, and some may turn out to be nothing more than old, unpatched equipment. Lumping it all together makes for scarier headlines and worse decisions.

Our take: the backup plan is the security plan

For years, cybersecurity has meant passwords, logins and antivirus. Those matter. But the attacks above show the real question is different: when the computer cannot be trusted, can the people on the ground still do the job?

Can the store see the true freezer temperature without the network? Can the water operator run the plant by hand? Can the clinic keep seeing patients on paper? Can a small business keep working while its support company is offline? The places that got through this year's attacks did it because someone noticed an alarm and knew what to do without the screen. In France, the blood service's cold rooms were targeted too, and staff caught it before anything was lost. That gets fewer headlines than the attack. It deserves more.

We are not saying the lights are about to go out or that the taps are about to run dry. We are saying the systems behind everyday life are more connected and more fragile than most people realize, and the people running them need practiced, manual ways to keep going. So do we.

What we would do at home

Keep water stored. The Red Cross suggests at least a gallon per person per day, three days if you may have to leave and two weeks if you are staying home. Count your pets.

Know what your fridge can handle. Without power, a refrigerator you keep shut stays cold for roughly four hours, and a full closed freezer about 48 hours. A cheap thermometer inside each one tells you the truth when the lights come back.

Keep food you can eat without cooking, flashlights, charged power banks, a battery or crank radio, a written list of phone numbers and some small bills in cash. When card machines and phone apps go down, cash and paper still work.

Lock down what you control. Use a different password for every important account, turn on two-step sign-in, and install updates. If someone calls claiming to be from your bank, your employer's IT desk or tech support, hang up and call back on a number you already trust.

If you run a small business, ask your computer support company three questions this week: who can get into our machines remotely, what happens if your service goes down, and when did we last test restoring from our backup?

What we are watching

How many businesses the ScreenConnect attack really reached. Who was behind the second wave of freezer attacks in Europe. And whether the utilities and hospitals that got hit this year can show they now know how to run without their screens.

The attacks are reaching the things people need every day. The answer is not panic. It is being able to keep going when one of those systems goes dark.