The Attack Came Through the Fridge: When Your Attack Surface Leaves the Server Room
The Sekhmet Scribe | Team Sekhmet
THIS MONTH, SOMEONE DEFROSTED A SUPERMARKET FROM THE OTHER SIDE OF THE INTERNET.
No ransom note on a server. No stolen spreadsheet. Across France, attackers reached into the refrigeration systems of supermarket stores and turned the temperature up, putting stock at risk in every chilled aisle they could touch.
The same week, closer to home, the group behind Phase Eight, Hobbs and Whistles took systems offline after a cyber attack. The shops stayed open. Online orders slowed. Specialists were called in.
Two very different incidents, one shared lesson. The attack surface is no longer the server room. It is the till, the fridge, the door controller, the supplier portal and every other thing that quietly got an internet connection while nobody was keeping count.
This edition of The Sekhmet Scribe is about the devices and systems that sit outside the IT team’s line of sight, and why that is exactly where attackers are now looking.
Protect • Empower • Evolve
WHAT’S HOT 🔥
Operational Technology Is Now Front Line
Refrigeration controllers, building management systems, CCTV, access control, smart meters. Most of them were installed by facilities teams or contractors, configured once and never revisited. Many still run default credentials. Plenty are reachable from the internet because someone needed remote access years ago.
They rarely appear on an asset register. They are rarely patched. And because they are not “IT”, they often fall between the IT provider and the facilities contractor, each assuming the other has it covered.
The French incident is a reminder that disruption does not need to touch data at all. Spoiled stock, closed stores and lost trading days are a perfectly effective outcome for an attacker.
WHAT’S HOT 🔥
The Rules Are Catching Up
The Cyber Security and Resilience Bill continues its passage through the House of Lords. When it lands, it will widen the net to more digital service providers, including managed service providers, and tighten incident reporting.
The direction of travel is clear. Regulators, insurers and customers increasingly expect businesses to know what is connected to their network and to show who is responsible for securing it. “We didn’t know that was online” is becoming a harder answer to give.
WHAT’S NOT ❄️
Treating Connected Kit as Someone Else’s Problem
The till supplier patches the tills. The facilities firm looks after the fridges. The landlord handles the door entry. The IT provider looks after the laptops.
Everyone owns a piece. Nobody owns the picture. And attackers do not care whose contract a device sits under. They only care that it shares a network with something more valuable.
A business that cannot list its connected devices cannot defend them.
THE SEKHMET STANCE
Every connected device is part of your security estate, whoever installed it and whoever invoices for it.
The fix is not glamorous, and it does not need to be expensive. Find everything that talks to your network. Change the defaults. Separate operational kit from the systems that hold your data and run your payments. Put patching for every device, not just laptops, on someone’s list with their name next to it. And make sure your suppliers can tell you, in writing, how they secure the systems they look after for you.
At Sekhmet we help businesses build that single view, across IT, operational technology and third parties, so there are no forgotten corners.
The lioness does not guard only the ground she can see from where she rests. She walks the edges of her territory, because that is where trouble comes in.
Walk your edges. Then decide who guards them.
Protect • Empower • Evolve
Team Sekhmet