Hackers targeted European supermarkets and French blood banks by remotely spiking refrigeration temperatures using factory-default passwords. On 610 CKTB, Jon Liedtke argued this physical cyber-sabotage stems from corporate laziness and over-centralized automation, warning that fragile just-in-time supply chains pass these costly vulnerabilities straight to everyday consumers.
Liedtke’s Got a Take! is on 610 CKTB’s Gene Valaitis Show every Monday, Tuesday, Thursday, & Friday morning!
Transcript (Gemini Generated):
GENE VALAITIS:
It is time for another edition of Liedtke’s Got a Take. Good morning, Jon.
JON LIEDTKE:
Good morning, Gene Valaitis.
GENE VALAITIS:
Well, this is quite something. We’re talking about what you termed the “cold chain hack”—why supermarkets and blood bank freezers are being hacked in the internet. So, when headlines broke about supermarket freezers in Europe being cranked up to 50 degrees, wrecking all the food, the Pentagon probing U.S. military bases, and overnight hackers targeting French blood banks, everybody, including me, pictured, you know, Russian or Chinese cyber hackers in dark rooms. But you’re suggesting we just might be looking at overweight guys in their underwear living in their parents’ basement just having fun on the internet—or at least what they think is funny.
JON LIEDTKE:
(Laughs) Gene, 24-hour news—I mean, listen, you and I, we’re both desperate for a Tom Clancy–style script here. Everyone wants a shadowy GRU colonel sitting in a Moscow bunker whispering, “Activate ice protocol… melt the Häagen-Dazs.” (Gene chuckles) I don’t think it’s that way, though. This doesn’t smell like the Kremlin. This smells like Axe Body Spray, stale Doritos, and teenage boredom. I think that some kids found an unpatched industrial port, or a hacker did, dumped the code or the blueprints of how to do it on the web, and now you’re getting a bunch of acne-faced trolls realizing, “Hey, why don’t we try and cook a grocery store in Brussels from home?” I think it’s just copycats. I really think, though, that the real crisis is not military super-weapons or super hacking; it’s that our critical civic infrastructure is so laughably porous that people are able to hold our groceries hostage.
GENE VALAITIS:
Yeah. Now, we hear endless talk about sophisticated hacking, but according to your reports and the research you’ve done, these cooler controllers were sitting wide open to the public in the internet with things like factory-default logins, where literally you just had to type the word “admin” in. (Sighs) Oy, oy, oy, oy, oy. Now, I know that you spoke to a local grocery manager down in Windsor, your neck of the woods. What did he tell you is actually happening with the thermostat on frozen foods?
JON LIEDTKE:
Yeah, I did speak with a grocery manager here in Windsor this week, and I asked him if someone targets the store tonight, are the frozen pizzas safe? And he looked at me like I had two heads. The answer was that nobody in the building touches the dial—nobody in the city even touches the dial or the thermostat. It’s all remotely managed. The people stocking our dinners don’t even have keys, quite frankly, to the fridge; they can only load the food in. So this is the sheer institutional laziness of it. The media, us, we can paint a picture of elite cyber operatives cracking military-grade encryption, but the punchline, yeah, I mean the passwords and user names were “admin” and “password,” “default.” This isn’t a hack. This is leaving the front door to the grocery store wide open with a neon sign that’s blinking saying, “Free food.”
GENE VALAITIS:
Wow. Now, you know, hacking a grocery store, spoiled food, you know, sounds kind of comical uh-until you look at the economics. So as I understand it, Canada’s food supply is razor-thin. It’s all about the logistic chain. So if this wave of freezer sabotage continues to hit grocery warehouses and stores, who ends up paying for all that spoiled food?
JON LIEDTKE:
It does sound hilarious until we remember that grocery chains don’t keep warehouses of surplus food anymore. I mean, this is a hyper-lean, just-in-time logistics chain. The Food Professor, Sylvain Charlebois, he made actually a really good point about it in a new post, and he says that perishability actually gives attackers an automatic countdown clock. When it’s financial files, you can haggle back and forth with extortion for days, but when it’s raw chicken and dairy, the cost of waiting doubles every three hours. So spoilage does the extortion work itself, and even if you get the power back on, how do you even verify that if the meat that you have didn’t get too warm? You’ve got to dump it all, right? So who eats the cost? Well, it’s not going to be the insurers, it’s not going to be the grocery store. I mean, it’s going to be you, it’s going to be me. It’s going to be passing the cost on to the consumer onto our receipts. You’ll walk through the checkout line next week, and you’ll be paying an unwritten corporate incompetence surcharge. It’ll just show up on your butter or on, excuse me, maybe on something that’s not supply-managed. So the issue is that our supply chain is brittle, and working families are always the designated shock absorber.
GENE VALAITIS:
Yeah. You know, you make a good point there. I wonder if the grocery stores even have insurance against something like this happening, because this is like brand new, this is uncharted territory. You know, melted ice cream is one thing, but overnight in France, hackers tried to raise the temperature of the freezers holding donor plasma meant for surgeries and cancer treatments up to 110 degrees, you know? So moving from food to life-saving blood supplies is crossing the line. Do we know what the Canadian Blood Services and our healthcare system are doing to protect the plasma and bloods that ill people need in Canada?
JON LIEDTKE:
Yeah, hackers trying to target French blood clinics in France, that’s where the joking stops completely. Spoiled waffles, yeah, petty vandalism, kind of funny. Spiking trauma plasma kept at minus-30 up past the boiling point of water, that would be—that would be horrifying. You’re rolling the dice on cancer patients and people bleeding out on surgical tables. So I can’t speak for Canadian Blood Services and what they do internally, but I can say step one doesn’t require an expensive blue-ribbon federal panel: change your passwords. Change the login on all the freezers. If life-saving medical assets share the security protocols of, I don’t know, your smart toaster, you shouldn’t be running a lemonade stand, let alone, you know, a medical network. Step two, what should be done, is treat cold storage as a closed, sovereign chain of custody. From the minute a volunteer rolls up a sleeve in Niagara to the hospital bed in St. Catharines, that stock must be secured like bullion. I mean, never wire life support to the public internet.
GENE VALAITIS:
Yeah. Grocery chains, health networks, they’ve been running pretty lean lately, and generally people off-site are managing those freezers for blood and food and all the rest of it. Have we become so obsessed with trimming corporate fat that we’ve completely forgotten about basic safety?
JON LIEDTKE:
It is the fatal rot of the modern boardroom. Some McKinsey suit walks in with a PowerPoint and says, “Fire 30 skilled on-site engineers who actually know how to turn a wrench; outsource the system monitoring to a third-party contractor on an iPad.” I mean, that can be called trimming corporate fat. In reality, though, sometimes you end up hacking straight through muscle and sawing off the bone. And as Charlebois noted, the real trap is that big players like the Loblaws of the world can afford enterprise IT firewalls, but they depend on small, family-owned farms and independent processors who can’t afford 20 IT consultants. So if an attacker knocks out a greenhouse or a local packaging plant, the supermarket shelves would still be empty. So a fortress with a cardboard back door is no fortress at all, and everyone needs to remember this in any aspect of business. So we’ve dismantled mechanical systems that functioned reliably for 50-plus years and replaced them with fragile digital loops all to extract what—a miserable half-percentage bump in quarterly EBITDA? A licensed human being walking the floor with a clipboard was not an operational inefficiency; that human was the only fail-safe keeping the system alive.
GENE VALAITIS:
Yeah. Well, everything does get plugged into the internet. For example, I’ve got my cell phone here, and if somebody is coming to my condo because they want to come and see me, you know, I can open the door and I’m a half-hour away from home. So, I mean, it includes everything. Like I said: doorbells, cars, refrigerators. So what’s the hard lesson here for companies and consumers who think digital convenience is always better?
JON LIEDTKE:
You know, I just helped my parents set up their new smart oven. It connects to Wi-Fi. They’re able to check the timer and change the temperature of it all from the convenience of the couch, not 15 feet away from the kitchen. (Chuckles) I don’t get it. The takeaway, Gene, is staring us in the face: slapping an antenna onto something doesn’t necessarily make it smarter. It might make it smart, but not smarter. We’ve been conditioned to believe that if hardware doesn’t have an app, Bluetooth, or cloud, it belongs in the Stone Age. But sometimes low-tech is better tech. A heavy deadbolt, a mechanical thermostat, and equipment that has zero capability to let Silicon Valley say hello—that can’t be hacked from 3,000 miles away. Not every aspect, I think, of our life needs frictionless convenience. Vital systems—I mean our food, our drinking water, our medical supplies—I don’t think those should ever trade baseline resilience for notifications on an app. If an operational fix, Gene, requires an engineer to walk down a hall with a physical brass key, congratulations: you’ve actually built something very secure. So my takeaway: keep the internet on our phones, and keep it out of your fridges and ovens.
GENE VALAITIS:
Mmm. I still can’t get over the fact that you discovered that some of the logins and passwords were “admin 1 2 3 4.” Oh, Jesus. (Laughs)
JON LIEDTKE:
Yeah, it’s not great, Gene. (Laughs) Change your passwords, that’s the takeaway, too.
GENE VALAITIS:
All right. Great take today, appreciate you. We’ll see you tomorrow morning, 9:15.
JON LIEDTKE:
Cheers.
GENE VALAITIS:
There he goes, Jon Liedtke. It’s called Liedtke’s Got a Take, and there’re always something else.
This aired on 610 CKTB
Leave a Reply