Welcome to Kernel Panic, a weekly newsletter by Lily Hay Newman and Matt Burgess from inside the new world of privacy and digital security. To receive this newsletter in your inbox each week, sign up here.
Amid an onslaught of AI vulnerability discovery and AI-assisted hacking, some of the most consequential critical infrastructure attacks this year may have little to do with the technology at all—instead providing a stark reminder that cybersecurity fundamentals are still key to digital defense.
Three sites in France that handle blood and plasma bags were briefly impacted this week by widespread attacks on vulnerable internet-connected refrigerators. On Wednesday, the Établissement Français du Sang (EFS) confirmed that cold rooms storing blood were “raised to very high temperatures” on November 2. The blood samples, thankfully, weren’t altered or damaged, the EFS said, because the organization’s alarm facilities and staff quickly detected the changes and implemented fail-safe measures.
The incident, however, comes amid a wave of cyberattacks in recent days affecting supermarket chains in at least 11 European countries that also drastically increased the temperatures of their refrigerators. Pictures from across the continent show huge volumes of food being trashed following the spikes. Similar fridge attacks in October affected hundreds of French stores that were forced to throw away food. And in August, roughly six commissaries and grocery stores on United States military bases suffered similar incidents resulting in spoiled food. The Pentagon is investigating the incidents and is collaborating with French law enforcement, Reuters reported last week.
“It’s been true for more than a decade now that our dependence on connected technology is growing faster than our collective will to protect it, which has exposed us to accidents, adversaries, and now potentially agents,” says longtime critical infrastructure researcher Josh Corman, who is currently the executive in residence for public safety and resilience at the nonprofit Institute for Security and Technology. “These fragile cold-chain systems are too critical to fail, but we keep experiencing hard lessons.”
It is still unclear who is behind the incidents and whether the attacks are all connected or being carried out by multiple actors. The first recent wave of attacks against French supermarkets last month appears to have been caused by attackers exploiting unpatched refrigeration controllers exposed to the internet—including software versions that allegedly used weak passwords formulated based on the date.
Many of the hacks stem from attackers exploiting vulnerabilities in temperature controllers made by the Danish firm Danfoss, and researchers say the attacks would not have been particularly difficult to pull off. Danfoss did not return WIRED’s request for comment.