Walk into any store’s back office and you’ll find a box in the corner that has been running for years.
Nobody thinks about it. It still works.
For a long time that was a good enough reason to leave it alone.
I’m not sure it is anymore.

The fridges that cooked themselves

In October, someone reached into the refrigeration controllers of hundreds of European supermarkets and told the fridges to defrost.
Temperatures climbed. Meat and frozen goods were thrown out.
France was hit hardest — around 350 stores — but units in Belgium, Spain, Portugal, Poland and Germany were affected too.
The controllers were made by Danfoss. Several of the models involved were end-of-life: still running in the store, no longer getting security updates.
No ransom. No group claimed it. The exact way in hasn’t been officially confirmed.
(Researchers had already flagged thousands of these management panels sitting open on the internet.)

“Still running” and “still safe” are two different things

Here’s what the fridge case changed for me.
When we decide whether to replace a piece of equipment, we ask one question: does it still do its job?
That question is no longer enough.
A device can work perfectly and still be the easiest door into your operation.
In an AI era, “can it defend itself” has become part of whether a device is still worth keeping. Not a nice-to-have, a condition.

Centralising everything also centralises the risk

The same month, a different kind of incident hit Ahold Delhaize.
One cybersecurity problem, and the group took systems offline across Albert Heijn, Etos, Gall & Gall, Delhaize in Belgium, and its US chains.
Website and online delivery down. Empty shelves. An estimated €10 million so far.
(The company calls it an IT incident and has found no evidence data was stolen; Dutch authorities say it isn’t linked to the fridge attack.)
Pulling everything into one place is efficient.
One compromised node is a threat to the whole system.
An exposed endpoint is one kind of fragility. Over-centralisation is another.

Attack is getting cheaper. Defence is getting more expensive.

AI lowers the cost of attacking.
Finding exposed devices, guessing weak logins, writing the script that drives a controller — all of it is faster and cheaper than it was a year ago.
Defence moves the other way. More endpoints, more integrations, more things to patch, more people needed to watch them.
And the weakest link is rarely the data centre.
It’s the POS terminal, the kiosk, the signage player, the camera, the store Wi-Fi — the things nobody was asked to guard.
Those endpoints deserve the attention we usually keep for the servers.

CRA is annoying. It might also be right.

Which brings me to the regulation everyone in this industry loves to complain about.
The EU Cyber Resilience Act is a pain. More paperwork, more obligations, devices you’ll be forced to retire earlier than you wanted.
But look at what it actually demands: no known vulnerabilities at ship, no guessable default passwords, security updates for years, someone accountable for the whole life of the device — and not just the manufacturer, retailers and importers too.
That list is a direct answer to the fridge case.
The forced replacement is a cost, and also an investment in building the security in.
It’s the first time the whole chain is being made to do it on purpose.
It’s still a hassle, but I’ve started to understand what it’s for.

The machine that’s run for ten years still works. But over the next few years — are you comfortable relying on it?