We Have Connected Our Entire Society to the Internet. But Forgot to Lock the Door.

I believe that would be a fundamental misunderstanding.

What happened in France exposes a much larger problem. For decades, we have been building a society in which almost every physical function increasingly depends on digital systems. Yet we have failed to develop security, accountability, and organisational competence at the same pace.

We have built a smarter society. The question is whether we have also built a far more vulnerable one.

A Password That Follows the Calendar

The Danish industrial company Danfoss manufactures advanced systems for refrigeration, ventilation, and building automation. One of its products, the AK-SM 800A, is designed to centrally monitor and manage refrigeration installations.

It is sophisticated technology serving a perfectly reasonable purpose. Instead of requiring employees or technicians to inspect every refrigerated display individually, an entire installation can be managed through a common interface. Temperatures are monitored, alarms are generated, operations are optimised, and maintenance can be carried out remotely.

The problem begins when that same interface becomes accessible to people who should never have been able to reach it.

In August 2026, security researchers from Claroty's Team82 published an investigation into the Danfoss system. They had identified several serious vulnerabilities, including a hidden authentication mechanism using a special code based on the current date.

By reconstructing the underlying algorithm, researchers were able to generate valid codes and bypass the normal login process.

It was not quite as simple as entering today's date as the password. Instead, the system generated a daily code calculated from the date. That distinction matters technically, but the underlying security problem remains remarkable.

The researchers also identified weaknesses that could enable command execution and manipulation of the system's web server. The vulnerabilities were reported to Danfoss, which released security updates.

There is not yet a complete public technical reconstruction proving that this specific date-based mechanism was used in the attacks in France. However, the research demonstrates how serious security weaknesses can exist in systems responsible for controlling real, physical infrastructure.

And this is where the story becomes genuinely disturbing.

We are not talking about a smartphone or a personal computer.

We are talking about equipment that controls the temperature at which people's food is stored.

The Internet Was Never Supposed to Become a Universal Master Key

I have worked in environments where technology, people, logistics, and physical infrastructure must function together. Festivals, major events, film productions, and complex projects where a single technical failure can have consequences far beyond the component where the problem originated.

One lesson becomes clear very quickly: it is not enough for every individual component to work. The entire system must continue to function when something goes wrong.

This is an understanding I often find missing from today's digitalisation debate.

We discuss connectivity, automation, artificial intelligence, efficiency, and data collection. We calculate savings and productivity improvements. We build centralised control rooms and remote management solutions.

But how often do we ask what may be the most important question?

What happens when someone else takes control of the system?

There is now a search engine called Shodan. Unlike Google, which primarily helps us find websites, Shodan maps devices and services that are visible from the internet.

These may include servers, cameras, routers, industrial systems, and other connected installations.

A screenshot showing a search for Danfoss-related interfaces displays 4,551 results worldwide, with France representing by far the largest share.

That does not mean all those devices can be hacked. Nor does it mean every result represents a physical refrigeration installation. But it illustrates something fundamental: industrial control systems can be discoverable directly from the public internet.

And a system that can be discovered can also be investigated.

It does not matter how sophisticated the hardware may be if its administrative interface is exposed without adequate protection.

We have created systems that can be controlled from the other side of the planet. That is extraordinary when the right person is doing it.

It becomes something very different when the wrong person gains the same capability.

Perhaps the Most Dangerous Vulnerability Is Not Technical

Danfoss had already published security information concerning affected systems before the attacks. Updates and recommendations were available to help operators protect their installations.

Nevertheless, reports suggested that outdated or insufficiently updated systems may have contributed to the incidents in France.

This leads to a much bigger question than who originally wrote the vulnerable software.

Who actually owns responsibility for security?

Is it the manufacturer that developed the system? The company that installed it? The technician responsible for maintenance? The IT department managing the network? Or the supermarket chain using the equipment?

In practice, all of them may be involved, while none has complete responsibility for the whole system.

I recognise this structure from many large organisations.

We have become extremely skilled at dividing work among specialists, suppliers, consultants, and subcontractors. Every participant is responsible for a specific part. Every part has its own contract, budget, guarantees, and limitations.

But nobody is necessarily responsible for what happens between those parts.

When something goes wrong, it often turns out that everyone did approximately what they were supposed to do, while the system as a whole failed.

This is not merely an IT problem.

It is a management problem.

An organisation can be administratively compliant and technically catastrophically vulnerable at the same time.

Europe Is Digitalising Faster Than It Is Taking Responsibility

The European Union is introducing new cybersecurity legislation. The NIS2 Directive strengthens security requirements across critical and important sectors. The Cyber Resilience Act gradually introduces new cybersecurity requirements for many products containing digital components.

These are necessary developments.

But legislation is not the same thing as actual security.

Europe is filled with technical installations that were designed, supplied, and installed under circumstances very different from today's. Many have an expected operational lifespan of twenty or thirty years. An industrial installation cannot be replaced as easily as a smartphone.

Meanwhile, the digital environment changes dramatically.

A system may have been installed when internet connectivity was still considered a convenient additional feature. Ten years later, that same connection may have become central to the entire operation.

Then come further software updates, external cloud services, new suppliers, and remote access for maintenance technicians.

Eventually, we have a technical ecosystem that no single person fully understands.

Yet we continue connecting more.

Smart buildings. Smart cities. Smart factories. Smart power grids. Smart transportation.

I am not opposed to this development. Quite the opposite. I see enormous opportunities in automation, artificial intelligence, and intelligent digital systems.

But intelligence without resilience is not progress.

A building that can automatically optimise its energy consumption but can also be manipulated from outside is not necessarily smart. It may also demonstrate how we have replaced an understandable problem with a far more complicated one.

When a Cyberattack Leaves the Screen

There is a fundamental difference between hacking a conventional information system and hacking a system that controls physical equipment.

When a traditional computer system is attacked, information can be stolen, manipulated, or destroyed. The damage can be enormous. But in many cases, systems can at least be restored from backups.

When a refrigeration system is manipulated, something is destroyed that cannot be digitally restored.

Food that has become unsafe to consume must be discarded.

If a ventilation system is manipulated, indoor environmental conditions may be affected.

If a water treatment facility is compromised, the consequences could be considerably more serious.

This is precisely why industrial control system security matters so much. Digital decisions can change physical conditions.

Today's technology gives us an extraordinary ability to influence the real world remotely. But it also gives attackers capabilities that once required physical presence.

A command can travel across several countries in a fraction of a second and cause damage inside a building the attacker has never visited.

That should fundamentally change how we think about public safety.

We Have Confused Efficiency With Resilience

For decades, efficiency has been one of the business world's strongest ideals.

Fewer manual procedures. Reduced staffing. Centralised monitoring. Remote management. Automated administration.

All of these can provide significant advantages.

But efficiency and resilience are not the same thing.

An organisation can become more efficient while simultaneously becoming more vulnerable to disruption.

If one hundred supermarkets previously operated separate, locally functioning technical systems, a malfunction might have been limited to a single store.

When those same stores become integrated into a shared digital infrastructure, new dependencies can emerge.

That does not mean centralised systems are always worse. Properly designed, they can provide better security, monitoring, and faster intervention.

But centralisation can also mean that a single weakness affects multiple facilities simultaneously.

This is why we need to start asking different questions when developing new systems.

Not only: How much can we save?

But also: How much could we lose?

Not only: Can we automate this?

But also: Can we still manage it when the automation stops working?

And above all: Is there someone who understands the system well enough to take back control?

Security Requires People Who Understand the Whole Picture

I believe we need to restore the value of people who can understand entire systems.

Not just programmers. Not just technicians. Not just managers or security specialists.

But people who understand the connections between technology, operations, organisations, users, and real-world consequences.

We also need to build systems in which security is not something added after installation has already been completed.

Every important technical installation should have a clearly identified owner, documented dependencies, a maintenance and update strategy, protected remote access, and a well-designed fallback solution.

These requirements must be part of the original design and everyday operation.

We also need to stop treating technical security as something exclusively discussed among experts behind closed doors.

If a supermarket can lose its entire refrigerated inventory through a digital intrusion, cybersecurity is also an issue for the store manager, property owner, executive management, and insurance provider.

And if the same technical principles apply to critical public infrastructure, then ultimately it becomes a question for society as a whole.

The Real Warning From France

It is still too early to draw every conclusion about the attacks on French supermarkets. Investigations are ongoing, and the exact sequence of events needs to be established.

But the fundamental lesson is already clear.

We do not need to wait for an attack against a hospital, a water treatment plant, or an energy system before recognising the risks.

We already have enough examples to begin acting.

Europe needs to become significantly better at mapping its digital dependencies, updating ageing installations, introducing effective security requirements in procurement, and establishing clear accountability throughout the entire lifespan of technical systems.

Above all, we need to understand that digitalisation is not an end in itself.

Technology should make life better, easier, safer, and more sustainable. If it simultaneously creates new risks, we must have the competence and determination to manage them.

What happened in France was not simply an attack against refrigerators.

It was a reminder that our increasingly connected societies have also acquired an increasing number of digital entry points into the physical world.

We have invested enormous resources in opening these entry points for efficiency, service, and automation.

Now it is time to invest at least as much intelligence in deciding who should actually be allowed through them.

Because there is something deeply absurd about all this.

We would never accept someone installing a new locking system in our buildings and then leaving the master key hanging outside the front door.

Yet when the same principle is transferred to digital systems, we have spent far too long treating it as a technical problem for somebody else to solve.

It is time to stop doing that.

We must stop confusing a connected society with an intelligent society.

Sources and Further Reading

• Reuters, October 12, 2026 – Cyberattack on French supermarkets

• Euronews – Hundreds of French supermarkets affected by refrigeration system attacks

• Claroty Team82 – Technical security research into Danfoss refrigeration controllers

• Danfoss – Official security advisories and vulnerability disclosures

This article combines reported events, documented security research, and personal analysis. The precise technical methods used in the French attacks had not been fully established at the time of publication.