THREE IT GAPS WE SEE AT MIDWEST BUSINESSES, AND HOW TO CLOSE THEM
This month your owner may have leaned into your office with a news story pulled up on their phone. Hackers took over grocery store freezers overseas and cooked them to 122 degrees overnight. The owner wants to know one thing.
“Could that happen to us?”
We can’t speak for grocery stores in France. We can tell you what we’ve seen at businesses we work with. And the weak spots look a lot alike.
Months. Two businesses we support learned that the hard way, before they had round-the-clock monitoring in place.
Both let their remote employees log into virtual desktops through a gateway that anyone on the internet could reach. That gateway had a weakness that let attackers walk in without a password.
Once inside, the attackers didn’t break anything. They stayed quiet. For months, they explored the network, figured out where the valuable data lived, and mapped what was there. Nobody knew. When they were ready, they started encrypting the servers.
In one case, the attackers accidentally knocked themselves off the server they were working on halfway through. It didn’t matter much. Most of the encryption was already done. Both businesses went through a forensic investigation and a long, expensive rebuild.
Here’s what changed afterward. Both now have 24/7 monitoring. And nobody can reach their systems from outside anymore without first connecting through a VPN. That’s the same advice the federal Cybersecurity and Infrastructure Security Agency (CISA) gave about the equipment in that grocery attack: keep systems off the open internet and use a VPN for remote access.
Look at the grocery attack and the two businesses above side by side, and the same three gaps show up: a way in from outside, systems that weren’t fully up to date, and nobody watching.
1. A way in from outside. For the two businesses, it was a remote desktop gateway open to the internet. In the grocery attack, it reportedly came through the outside company that services the stores’ refrigeration remotely. Every business has these doors: remote access for employees, logins for software vendors, your ERP or agronomy software support, an old IT provider. About 15% of data breaches in 2026 started with a supply-chain compromise, according to IBM figures cited by the Insurance Information Institute.
2. Systems that aren’t fully up to date. The gateway had a weakness attackers could use. Most of the grocery systems hit were older models that no longer got security updates. The office version of this is Windows 10, which stopped getting free security updates on October 14, 2025. In July, HP’s CFO said roughly 30% of HP’s installed base was still on Windows 10. Those PCs still run fine. They just aren’t getting fixed.
3. Nobody watching. Attackers lived inside those two networks for months without anyone noticing. The grocery attack started on a Sunday night and ran until morning. If something started on your network at 9 p.m. on a Sunday, who would see it before Monday?
If you’re thinking “we’re too small for anyone to bother with,” the two businesses in this story weren’t household names either. Attackers find doors like these by scanning the internet. A scan doesn’t check how big your company is. It checks what it can reach.
It looks like a phone ringing at 2 a.m., and a technician picking up.
Not long ago, an alert went off in the middle of the night at another business we support. A script was running that looked a lot like something an attacker would use. The alert went straight to our call tree, and a technician was on it right away. Our tech got into the environment, looked at the script, and found it was a backup job the business had set up itself.
False alarm. Documented and closed. The business didn’t know anything had happened until we called to say it was handled.
That’s the point. If that script had been real, the same alert, the same call, and the same response would have fired at 2 a.m. as at 2 p.m. Compare that to months with nobody looking.
That depends on which chair you’re sitting in.
List everyone who can get in from outside. Employees working remotely, software vendors, your IT provider. Ask whether each connection is open to the internet or goes through a VPN, and whether it needs a code from a phone, not just a password.
Find what isn’t getting updates. Ask how many PCs still run Windows 10, and whether any servers, firewalls, or remote access tools are past their support date.
Ask who’s watching at 2 a.m. If the honest answer is “nobody,” that’s the gap that matters most.
Get anything management-facing or remote-access off the open internet. VPN or brokered access first, multi-factor authentication on every outside login, and vendor access that’s on-demand and logged.
Track end-of-support dates for operating systems, servers, firewalls, and remote access gateways the way you track renewals.
Be honest about after-hours coverage. If it’s you and your phone, that’s the case to take to leadership.
You don’t need to learn how any of this works. Ask your team three questions: Who outside the company can get into our systems? What’s still running that no longer gets security updates? Who would notice if something went wrong overnight? You wouldn’t be alone if nobody has a great answer. In a Nationwide survey, 66% of small business owners said they haven’t given much thought to how they’d respond to an attack. That’s not a reason to panic or to buy something big. It’s a reason to get a clear picture first.
Those three answers are also worth having on hand the next time a big customer sends a security questionnaire or your insurance renewal shows up with new questions.
We don’t service grain or refrigeration equipment. We take care of the IT, and that’s where all three of these gaps live.
With our managed IT packages, someone is watching your network around the clock, and high and critical alerts get a real person on the phone at any hour. Your Windows PCs and servers get patched on a schedule, not when somebody remembers. Outside logins to Microsoft apps need more than a password. And on ARMOR and FORTRESS, a monthly vCIO meeting is where we plan the bigger decisions with you, like retiring Windows 10 machines, before a support date sneaks up.
If you already have an IT person or team, we work alongside them, not around them.
You know your operation. We know this side of it.
Start with a conversation. Tell us how people get into your systems today, and we’ll tell you plainly where the gaps are.
Compare managed IT packages. See which include 24/7 monitoring, managed detection and response, and monthly vCIO or vCISO meetings.
Want the full picture? Ask our cybersecurity team about a risk assessment you can hand to the owner or the board.
So, could it happen to us? The freezer attack, probably not. The months-long kind, it already has, at businesses a lot like yours. The difference now is that someone’s watching.
None of the attacks in this story made noise at first. A door nobody was tracking, a system nobody was updating, and months nobody was watching. That’s why it’s easy to overlook. If you’re not sure who can get into your systems or who’d notice at 2 a.m., you’re in good company, and it’s a lot easier to sort out now than in the middle of harvest or a big run. Give us a call and we’ll walk it with you.
TIME: “‘Unprecedented’ Cyberattack Targets French Supermarket Fridges” (October 13, 2026). Freezers pushed to 122°F overnight
Cybersecurity Dive: refrigeration attack (October 13, 2026). Attack began Sunday night, reportedly through an outside service company, older units no longer updated
CISA: ICS Advisory ICSA-25-140-03, Danfoss AK-SM 8xxA Series (May 20, 2025). Keep systems off the internet, use a VPN for remote access
Insurance Journal: Triple-I “Commercial Cyber Insurance: State of the Risk” coverage (October 16, 2026). About 15% of 2026 data breaches from supply-chain compromises (IBM)
Microsoft: “Windows 10 support has ended on October 14, 2025.” No more free security updates
PCWorld: “HP exec says 30% of PCs still run Windows 10” (July 27, 2026). HP CFO on Windows 10 installed base
Risk & Insurance: Nationwide Cybersecurity Survey (September 30, 2026). 66% of small business owners haven’t thought much about responding to an attack