Freezers that heat up, banks that bleed, and governments advising people to turn to food pantries again—an assessment of digital vulnerability in the fall of 2026
4:44 a.m.
At 4:44 a.m.—as will later be recorded at the Intermarché in Grand-Couronne—the cold begins to give way in the early hours of October 12. The freezers, which had just moments before been maintaining a temperature of minus eighteen degrees, switch to a defrost cycle that no one ordered and remain in that state. Outside, the Seine-Maritime region lies in darkness; inside, fish sticks, ground beef, and ice cream are warming up to temperatures at which one would normally let yeast dough rise. When the staff arrives in the morning, the entire refrigerated assortment is ready for the trash. As it turns out over the course of the day, the same thing has happened in hundreds of French supermarkets.
Chronicle of an Autumn
First, the facts—because they are troubling enough on their own. On that October night, the attackers tampered with control systems from the Danish manufacturer Danfoss that regulate refrigerated display cases and cold storage rooms. They forced the defrost cycle to activate, set temperature setpoints as high as fifty degrees, and extended the cycles so that the alarms would go off late. Branches of Intermarché, Carrefour, Leclerc, and Système U were affected; small fires broke out in some stores, and the Paris public prosecutor’s office is investigating. Three weeks later, on the night of November 2, a second wave followed, this time spreading across half of Europe: Belgium, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal, and Italy. That same night, someone attempted to reprogram the plasma freezers at the Établissement français du sang, the French blood donation service, from minus thirty to over one hundred degrees. The attempt was detected in time. To date, no letter claiming responsibility has been received.
At the same time, financial systems came under attack. The Breton banking group Crédit Mutuel Arkéa reported fraudulent transactions in early November that were routed through an external service provider’s platform; French media estimate the amount at around 118 million euros, though the bank has not confirmed this figure and assures that customer balances remain unaffected. In South Korea, the names, incomes, and credit limits of approximately 25,000 customers were exposed at Shinhan Bank alone. In Germany, customer data was leaked from abc Bank via an IT service provider. On October 28, Belgium was forced to take its tax portal, MyMinfin, offline and postpone filing deadlines. And India’s cyber security agency, CERT-In, is warning of a group that uses freely available AI tools to scan payment interfaces: first a transfer of a single rupee, then large sums—preferably on weekends when security staff are stretched thin. The European Central Bank had already required the major banks under its supervision back in July to submit action plans against AI-enabled attacks by the end of October.
What do these cases have in common? Almost no ingenuity, almost always negligence. The hacked refrigeration controllers were largely older models that the manufacturer had long since stopped supporting; some, according to Danfoss itself, were left exposed on the network with their factory default passwords. The bank was compromised through a supplier, not through its own security perimeter. The point of entry is rarely the main gate—it’s usually the supplier’s side gate.
Of Hats and Hands
At this point, it is important to defend a distinction that is regularly lost amid the alarmist headlines. “Hacker” is not a synonym for criminal. As far as we know, the attacks this fall were carried out by criminal gangs or state-tolerated groups known in the scene as “black hats.” Opposing them are the “white hats”: researchers who look for vulnerabilities in order to fix them. They inform manufacturers confidentially, give them time to make corrections, and only go public afterward. This is called “coordinated disclosure,” and it is one of the quiet civilizational achievements of the digital age. Organizations such as the Chaos Computer Club have used this method for decades to uncover vulnerabilities in voting machines, healthcare networks, and government software.
The case of the freezers serves as a bitter lesson. The security firm Claroty had examined the controllers from Danfoss and Copeland, found serious vulnerabilities, and notified the manufacturers; both provided new firmware. In August, two months before the attack, the researchers presented their findings publicly at the DEF CON hacker conference in Las Vegas. And yet, even after that, search engines for connected devices still found around 2,700 publicly accessible Danfoss controllers. The warning had been issued, the patch was ready—but no one applied it. The “good” hackers had done their job; many operators had not.
It’s fitting that these days mark the anniversary of an event that illustrates both sides of the coin. On November 2, 1988, Cornell University doctoral student Robert Tappan Morris released a program onto the fledgling Internet designed to measure its size. A programming error turned it into a plague: Within hours, the “Morris worm” crippled an estimated 6,000 computers—roughly one in ten on the network at the time. The more lasting consequence, however, was the creation of an institution: Carnegie Mellon University established the first Computer Emergency Response Team, the forerunner of all today’s cybersecurity agencies—from Germany’s BSI to Switzerland’s Federal Office for Cybersecurity. The catastrophe gave rise to preventive measures, and the perpetrator became a respected computer science professor at MIT.
Max Weber saw modernity as characterized by the “disenchantment of the world”: by the belief that everything can, in principle, be mastered through calculation. The white hats are Weber’s late heirs. They believe in the predictability of systems, but they know that this mastery is never guaranteed—it must be earned anew every day.
Is there a big switch?
So, here’s the question in the title. Can you turn off the Internet—all of it, in one fell swoop? The honest answer is: No, at least not the way you flip a light switch. The Internet isn’t a device; it’s a system of agreements. It consists of more than seventy thousand autonomous networks—ISPs, universities, corporations, government agencies—that use a protocol called BGP to tell each other who can reach whom and how. There is no central hub whose plug you could pull. Even the network’s address book—the Domain Name System—rests on thirteen root server identities, which are operated by twelve independent organizations and mirrored at well over a thousand locations worldwide. A global shutdown would in fact require the coordinated participation of virtually all nations and operators. However, there is no issue in this world on which all nations coordinate—least of all one that would harm them all equally.
What does exist, however, is the national shutdown. In January 2011, at the height of the protests in Tahrir Square, Egypt almost completely cut off its internet access; the country disappeared from the digital world for days. The human rights organization Access Now counted at least 313 internet shutdowns in 52 countries in 2025—a dismal record, led by Myanmar. As early as 2019, Russia enacted a law establishing a “sovereign internet” that can be disconnected from the rest of the world in an emergency.
This shows that the real danger of a shutdown comes less from hackers than from governments. Carl Schmitt’s infamous statement—that sovereignty lies with whoever decides on a state of emergency—has been given a digital twist: sovereignty lies with whoever decides on internet access. The Internet will not die in a big bang. It is in danger of disintegrating—into chambers, zones, and territories, into an archipelago of national intranets, between which ferries run ever less frequently.
The More Likely Darkness
And yet it would be reckless to dismiss the question posed in the title with a complacent “no.” After all, you don’t have to shut down the Internet to render it useless. All it takes is to cut off its power. On April 28, 2025, the power grid on the Iberian Peninsula collapsed; within seconds, Spain and Portugal were plunged into darkness, and along with the power, cell service, card payments, and train signals disappeared. No hacker was involved—just the physics of an overburdened grid. In July 2024, a faulty update from the security firm CrowdStrike crippled some 8.5 million Windows computers, including those at airports, hospitals, and banks—ironically, a security program was the cause. And lying beneath the oceans are the cables through which about 99 percent of intercontinental data traffic flows; the fact that cables in the Baltic Sea have been repeatedly damaged by dragging anchors since 2023 has put security authorities in all neighboring countries on high alert.
The French philosopher Paul Virilio summed up this structure in a single phrase: Whoever invents the ship invents the shipwreck; whoever invents the airplane invents the crash. Every technology gives rise to its own accident, and the more interconnected it is, the more its accident becomes an “integral,” omnipresent event. The Grand-Couronne freezer is one such integral accident on a small scale. It was networked so that the refrigeration technician could check on it remotely at night—and that is precisely why someone was able to cause harm remotely at night. Convenience and vulnerability run through one and the same line.
The Return of the Pantry
Against this backdrop, a trend that would have been met with derision just a few years ago takes on a different meaning: Governments across Europe are once again advising their citizens to stock up on supplies. Not in a hysterical way, but in the tone of informational bulletins. According to a tally by Newsweek magazine, 33 countries worldwide are now doing so, and among the scenarios they explicitly cite—alongside war and natural disasters—is a large-scale cyberattack on critical infrastructure.
The recommendations differ primarily in terms of duration. In March 2025, the European Union set 72 hours as a common minimum in its “Preparedness Union Strategy.” France, Belgium, Luxembourg, Finland, Denmark, Lithuania (with its “LT72” campaign), the United Kingdom, and the Netherlands—as well as Canada and the United States across the Atlantic—also recommend a three-day supply. Sweden—whose brochure “When Crisis or War Strikes” was distributed to millions of mailboxes—as well as Norway and Estonia, require one week. Germany goes further: The Federal Office for Civil Protection advises people to be able to support themselves for ten days if possible, and adds reassuringly that even three days would help a great deal. Singapore recommends two weeks; according to a country overview, Slovenia even recommends thirty days.
And Switzerland? As is so often the case, it has the oldest and most down-to-earth answer. Under the straightforward slogan “Smart Advice – Emergency Supplies,” the Federal Office for National Economic Supply recommends food for about one week and nine liters of water per person—a six-pack, intended to last three days—along with essential medications, a battery-powered radio, a flashlight, and some cash. From the fourth day onward, the logic goes, water utilities are obligated to resume supplying a minimum amount. What is hailed elsewhere as a new era has been a living tradition here since the “Agricultural Battle” of World War II. A country that has never abolished its bomb shelters views emergency stockpiles not as panic, but as sound household management.
It is remarkable what is included in all these lists—and what is missing from them. They contain canned goods, candles, hand-crank radios, and batteries—all items that work without electricity. There is no expectation that the government could be there for everyone at once in the first few days of a crisis. The 72 hours are not a prediction of how long a crisis will last, but rather the window of time during which emergency responders are supposed to care for the most vulnerable, while the rest must fend for themselves. The supplies in the pantry are thus also a gesture of solidarity: those who provide for themselves take the burden off their neighbors.
Shipwreck with a Spectator
In a slim yet profound book, Hans Blumenberg described the figure of the spectator who, from the safety of the shore, watches the shipwreck of others. Blumenberg’s point is that this shore no longer exists. As Pascal already knew, we have long since set sail. This applies to the digital world to an even greater extent. Anyone reading today’s news about overheating freezers and looted banks is doing so on a device connected to the same network as the freezer and the bank.
Out of professional skepticism and a personal love of tinkering, I myself have a small solar-powered radio node in my office that relays short messages via a self-organizing network—without the internet, without an ISP, without a data center. It’s a toy, to be sure. But it reminds me every day that a network’s robustness doesn’t come from its size, but from its decentralization. And that resilience, in the end, is a matter of people who care: who install the update, change the factory password, and report the vulnerability instead of selling it.
So, are we facing the shutdown of the Internet? There is no big switch, and no one is going to flip it. What threatens us is more subtle and therefore more dangerous—the creeping warmth that the Grand-Couronne freezers so vividly demonstrated. Not the bang, but the prolonged defrost cycle that delays the alarm until the goods have spoiled. No bunker can protect against this kind of threat. What helps is vigilance, maintenance, and a six-pack of water in the basement. And perhaps, on a Friday night, the composure to turn off the appliance for a change—voluntarily, of course, and only for a little while.
Sapere aude!
S.
Your support keeps ideas alive — and stories in motion. 👉 https://www.paypal.com/donate/?hosted_button_id=5NGG6XB67BZ4N 🙏
🇩🇪 My lyrical thoughts between two book covers: blau pause zimmerlautstärke - lyrik über die zeit - zurzeit
BoD Bookshop: https://buchshop.bod.de/blau-pause-zimmerlautstaerke-stefan-noir-9783695118779
Amazon-Shop: https://amzn.eu/d/1TvOBUO
🇺🇸 / 🏴 / 🏴 My lyrical thoughts between two book covers: blue pause room volume: poetry about time – currently
Amazon (English edition): https://amzn.eu/d/3b3GUF4
Comments