Read the advisory closely and notice who it addresses. Not the companies that built refrigeration controllers and shipped them with default passwords and an open door to the internet. It addresses the people who bought them: grocery managers, clinic administrators, small food distributors. Update your software. Reset your passwords. Unplug if you can. The instruction, in effect, is to do better against an adversary that may be a hostile state, with the IT budget of a regional supermarket.
This is how we have handled cybersecurity for twenty years, and it keeps failing. We treat insecurity as a customer problem. The vendor who sold the vulnerable box keeps the margin. The customer who installed it inherits the liability. The public, who eat the food and rely on the blood supply, inherits the risk.
The risk is not abstract. In Belgium, Luxembourg and Sweden, intruders reportedly raised temperatures in commercial refrigeration and spoiled food. French officials say attackers went after the emergency blood-supply network, aiming to warm multiple blood banks. Nobody needs a Hollywood scenario here. Spoiled insulin, ruined vaccines and compromised blood are enough. Cold storage is not a convenience. It is the quiet infrastructure that keeps a city fed and its hospitals functioning.
To be fair to the facts: U.S. authorities have confirmed no domestic compromises. The Army is investigating refrigeration outages at six military installations in August, and no one has said they were attacks. We should not pretend to know more than we do. But the warning is rational, because the vulnerability does not depend on attribution. A device exposed to the internet with a factory password is a liability whether the next intruder is a state, a ransomware crew or a bored teenager.
What should embarrass Washington is the timing. This administration has spent the past year dismantling the capacity that would turn warnings like this into protection. It dismissed the members of the Cyber Safety Review Board, which had been investigating major intrusions, in the middle of an inquiry into a Chinese hacking campaign. It cut deeply into the Cybersecurity and Infrastructure Security Agency's workforce. It pulled funding from the program that helped state and local governments share threat information. Then came the advisory, which amounts to a flyer taped to the door of a house whose fire department has been laid off.
The usual Republican answer is that regulation burdens business and that the private sector knows its own risks best. But the private sector's incentives are precisely the problem. A manufacturer competes on price and features, and security is an invisible cost that buyers rarely check. Voluntary pledges and labels are easy to announce and easy to ignore. Where governments have made baseline security a condition of sale, they have been able to ban universal default passwords and require patching. The United Kingdom has done it. The European Union is phasing in broader requirements. California has had a default-password law since 2018. Nobody has suffered from a refrigeration controller that must ship with a unique credential.
The Left should be clear about what it wants, and not merely cluck about neglect. Make security a product-safety standard, as we do for electrical wiring and car brakes. Put liability on the party that can actually fix the flaw, which is the one who built it. Fund the federal and state defenders who help hospitals and small operators, because a rural clinic cannot hire a threat-intelligence team. And treat the cold chain as the critical infrastructure it is.
We regulate fridges for energy efficiency and refrigerant chemistry. It is absurd that we don't regulate whether a stranger across the world can turn the dial. When the warning arrives after the harm, it is not leadership. It is a disclaimer.
How it may affect me
No U.S. compromises have been confirmed, so there is no need to change how you store food at home. If you run a grocery, restaurant, clinic or warehouse, ask your refrigeration vendor whether controllers are reachable from the internet, change any default passwords, apply updates, and keep a manual temperature log and a spoilage backup plan.
