The common thread in three recent cyber incidents is not a novel exploit but a familiar one: attackers are gaining entry through systems that organizations already trust. A managed backup provider's application identities, a supermarket's internet-connected refrigerators, and a global retailer's internal network all became footholds, and in each case the breach spread through access that was already legitimate rather than through a wall that was knocked down. The lesson for US technology companies is that the perimeter now includes every vendor, every connected appliance, and every identity with standing privileges - and none of those are reliably defended by the same controls that guard the front door.
Access You Handed Over Is Access You Can Lose
The ConnectWise case, as BleepingComputer reported, is the clearest example. Hackers accessed application identities and used them to compromise Microsoft 365 tenants, and ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, in response. That is a supply-chain attack in the precise sense: the victim did not misconfigure its own defenses so much as inherit the trust it had placed in a software vendor. Application identities are especially attractive because they are non-human accounts that often carry broad permissions and are monitored less closely than employee logins. When a provider holds those identities on behalf of many customers, a single compromise can fan out across an entire customer base, and the remediation - shutting off a service - can itself disrupt the customers who depended on it.
The Appliance Is the Attack Surface
The French supermarket incident, covered by CNET, makes the same point at a smaller scale. Hackers took advantage of a software vulnerability in connected refrigeration equipment, forcing mass food disposal. The damage was not data theft but physical and operational: spoiled inventory, disrupted stores, and a reminder that any connected appliance on the internet can be a target. For US technology companies, this is a warning about the operational technology they increasingly sell and support. Retailers, grocers, and logistics operators run large fleets of networked devices that were never designed with hostile networks in mind, and the software that keeps them running is often updated on the vendor's schedule rather than the customer's. An internet-facing refrigerator is a strange entry point until it is understood as a general-purpose computer with poor security hygiene and a long service life.
Retailers Are a Target Class
The Ahold Delhaize case, also reported by BleepingComputer, shows what happens when the intrusion reaches the core network. The retail giant, one of the world's largest food retail chains, confirmed it had to take some systems offline after a cybersecurity incident affecting its network, without offering further detail. Taking systems offline is a defensive move, but it also converts a security event into an availability event, and for a food retailer that means stores, supply chains, and customers all feel it. The pattern across all three stories is that availability, not confidentiality, is increasingly the cost that gets passed to the public. A breach that forces food disposal in France and systems offline at a global grocer is a breach whose primary victim is the ordinary consumer standing in the aisle.
