Menu
Aerial view of a large circular water-treatment basin surrounded by bright green grass and a narrow water channel.

What Do You Rely On, and Who’s Securing It?

, , , , , ,

For most people, the security of a grocery-store refrigerator is not a subject worth thinking about. You want to grab some milk, maybe wonder why eggs cost what they do, and get home. Whether the freezer has a remote management interface on the public Internet isn’t supposed to be your problem.

It becomes your problem when someone changes the settings and the food spoils.

Or when your grocery chain shuts down its ordering systems, and the website, delivery app, and usual fulfillment process suddenly stop cooperating.

This is the second article in The Infrastructure We Trust, and I want to ask a question that applies just as much to a three-person business as to a national power grid: What do you rely on, and what is its current security status?

The question is basic. The answer usually isn’t.

France’s refrigerators and Ahold’s systems failed in different ways

During October 11–13, attackers interfered with remote refrigeration controllers in hundreds of French supermarkets, damaging food supplies in the process. The French government’s CERT-FR alert identified equipment families from Danfoss, Copeland, and Dixell and advised operators to eliminate direct Internet exposure of management interfaces. It also recommended reviewing defrost settings, firmware, and credentials before restoring secure remote access.

On October 21, France’s cybersecurity agency director described what investigators were finding: exposed administration systems and weak passwords, rather than the newly publicized software flaws many initially suspected. That’s a sobering explanation. No undiscovered superweapon is required when the controls for physical equipment can be reached from outside without adequate protection.

At almost the same time, Dutch-headquartered Ahold Delhaize detected malicious activity on its network. According to its October 19 statement, the company deliberately switched off websites, apps, and related systems while investigating and protecting its operations. Stores continued trading, but online services were interrupted. Its precautionary shutdown and France’s deliberate sabotage are different technical and operational events; Dutch authorities said they had no established evidence linking the two.

That’s worth lingering on. In France, an attacker changed a physical process. At Ahold, an organization took systems down to contain an intrusion. From the customer’s perspective, both can feel like the infrastructure broke. From a defender’s perspective, the causes, responses, and recovery requirements aren’t interchangeable.

Business IT goes well beyond the website

Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.

Water: the interface is part of the public utility

On July 26 and 27, malicious cyber activity hit operational technology at more than 30 community water systems in Minnesota. Other U.S. utilities reported related incidents to federal authorities. Some facilities temporarily switched to manual work, and at least one city had its water operations briefly disrupted. Minnesota officials stressed that an affected controller did not mean every community lost water service or that drinking-water quality was compromised.

The state’s July 30 update identified programmable logic controllers, or PLCs, and human-machine interfaces, or HMIs, as part of the attack surface. PLCs are industrial computers that operate equipment. HMIs give the humans supervising that equipment a display and controls. If someone gets inappropriate access to either, the consequences can be catastrophic.

Officials described similarities among the cases but said they had not determined that every intrusion came from the same actor. Reports of possible Iranian involvement remained preliminary. And nothing public establishes that the people behind Minnesota were involved in France. I’m not drawing a conclusion here either. I’m simply examining similar vulnerabilities in two industrial systems to compare the evidence, not inventing a shared culprit.

Electricity and heat: the other side of the same problem

Poland’s national computer emergency response team documented coordinated destructive cyberattacks in December 2025 against more than 30 solar and wind installations and a combined heat-and-power plant. The attackers damaged controls and attempted to erase data. Crucially, the initial report said these attacks did not cut electricity production or interrupt heat deliveries to consumers at the major plant.

An August 2026 follow-up disclosed a second, smaller combined heat-and-power plant attack. That one temporarily interrupted the generation process, but operators prevented a heat outage to customers. The investigation described a surprising access route through a misconfigured private mobile network. Private does not automatically mean isolated. It may simply mean the wrong people have gained access to the equipment.

There is a reassuring part of this story: manual intervention, operational separation, and incident response can prevent a cyber intrusion from turning into prolonged service disruption. Successful protection often depends on controls most customers never see, not that everything will eventually fail.

Backups & recovery

Backups are comforting right up until you need one. Raymond Tec helps small businesses build practical backup and recovery plans — including the decidedly unglamorous part where we make sure the thing can actually be restored.

Agriculture and logistics are infrastructure too

On October 22, Reuters reported research from ESET on destructive activity against a Ukrainian grain-logistics company. Researchers traced an initial 2025 intrusion through malicious email and linked the later data destruction to Russia-associated operators, including Sandworm. They could not establish that grain shipments themselves were interrupted. That’s the distinction between documented destruction of computer data and a confirmed interruption of the physical food supply.

But the dependency is obvious. Grain logistics requires schedules, inventory, loading records, communications, and payments. Even if the physical product is untouched, removing the information required to move it can still create serious disruption. That’s true for grain, medical supplies, spare parts, and online orders. The supply chain now has a data chain running through it.

At this point you may be tempted to draw one giant line between Polish electricity, Minnesota water, French refrigerators, Ukrainian grain, and a grocery company’s website. I understand the temptation. These incidents don’t establish one attacker, one motive, or one command structure. What they establish is that essential services have a surprisingly large number of digital doors.

Technical discovery & auditing

The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.

Do you know what your own operation relies on?

Try this exercise without touching a vulnerability scanner. Follow one important thing your business delivers from beginning to end. If it’s an online order, start with the customer’s browser and move through DNS, the website, payment processing, inventory, email, shipping, bookkeeping, and the person who handles a return. If it’s a physical service, trace scheduling, building access, power, staff communications, and the equipment required to do the work.

Now write down who controls each step. Is it you, a hosting company, a contractor, a software vendor, or somebody’s personal account from years ago? Can that system continue without Internet access? Does it have a tested backup or a manual fallback? If the answer is “I think so,” you have an item to verify.

Security status is not a single green or red dashboard light. It includes:

  • Supported software versions
  • Known exposures
  • The authority granted to administrators and vendors
  • Logging
  • Network separation
  • Evidence that backups can be restored
  • And whether the organization has actually practiced operating without the technology

A service can be fully patched and still be fragile. It can also be exposed to a known bug and survive because the dangerous path isn’t reachable. You have to inspect the specific situation.

For business owners, five questions do most of the work: What absolutely has to keep running? Who can remotely administer it? What was last patched, and how do we know? What happens if it disappears for 24 hours? And who is authorized to bring it back? For critical public infrastructure, regulators and operators have additional obligations, but the questions underneath are remarkably similar.

The security status we can’t see

We don’t get to audit the supermarket’s refrigeration vendor, the water utility, or the company managing every cloud service we use. That uncertainty isn’t an excuse to assume everything is secure. It makes transparency, supplier accountability, independent incident reporting, and sensible contingency planning more important.

You can’t personally fix a power station or a grocery chain. You can ask a vendor for its support lifecycle, incident-notification policy, recovery expectations, and security responsibilities. You can keep a second way to reach customers. You can test a manual process before you’re forced to invent one under pressure. And you can stop connecting equipment directly to the Internet merely because the box came with a web interface.

The first post in this series was about patches and preserving a way back. This one is about mapping dependencies. Next, we’re going to complicate both problems by adding AI: a tool that can help defenders, accelerate attackers, and reshape the stories we believe about either one.

News tells you what happened. Sometimes the interesting part is what happens when you actually have to work with this stuff. Raymond Tec Insights collects longer field notes, lessons, opinions, technical decisions, and stories from real projects.

Sources and further reading

Featured photo: K via Pexels, used under the Pexels License. This is an illustrative photograph of a water-treatment basin, not a facility involved in the cyberattacks discussed.

Related Posts

Leave a Reply

Only people in my network can comment.