The Machine Outlives Its Brain

Written By Margaret Budnik

By Chris Budnik

The press that never dies, and the brain that does

A well-built binary hydraulic press will run for 30 or 40 years. Rebuild the seals, replace a pump, rewire a panel, and it keeps stamping parts long after the engineers who specified it have retired. For most of industrial history, the useful life of a machine was decided by the quality of its iron and the people who ran it.

That is no longer true. The press is now wrapped in a controller, a network card, a vendor portal and a cloud dashboard. The steel will last decades. The software that tells the steel what to do may be unsupported in five.

That gap is the quiet risk sitting on almost every plant floor, warehouse and store in the country. Equipment effectiveness is no longer set by build quality. It is set by how long a control-module vendor is willing to keep shipping firmware, patches and firewall rules for a product it would rather replace.

France, one night in October

We just watched this risk turn into spoiled food. On the night of October 11, attackers took remote control of the refrigeration controllers in hundreds of French supermarkets and pushed fridges and freezers into defrost, heating some to as much as 50°C (122°F). Stock was thrown out, and at several stores the overheating equipment began to catch fire. The Hacker News

It was not one chain. It was most of French grocery:

Retailer Stores reported hit
Intermarché and Netto (Les Mousquetaires) At least 300, per AFP
Coopérative U 80 to 100+
Carrefour 80
Monoprix About 30
E.Leclerc Several

The head of Les Mousquetaires told BFMTV he expected losses in the tens of millions of euros. Analysts at Sekoia told Reuters that Spain, Portugal, Poland, Germany and Belgium were also affected. The Hacker News

Here is the detail that matters for this argument. The equipment that was hit was a single store controller made by Danfoss, the device that runs every fridge and freezer in a building and that maintenance contractors manage remotely. Danfoss said most of the units hit were legacy models with outdated firmware that it no longer updates. The AK-SM 800 was declared end-of-life in May 2021; the AK-SC 355 was phased out in 2016. Al Jazeera

The compressors, evaporators and cases were fine. The cold chain failed because the brain bolted on top of it had been orphaned by its maker, and nobody had replaced or isolated it. France's cyber agency, ANSSI, told operators to disconnect the controllers from the internet or filter access tightly. For the two older models, the usual remedy of "apply all available fixes" offers nothing: there are no fixes left to apply.

The Coopérative U stores did not even buy from Danfoss directly. They bought refrigeration from contractors who supplied the Danfoss system. That is the modern supply chain in one sentence: the retailer owns the asset, the contractor owns the access, and the vendor owns the clock.

How we traded durability for visibility

Nobody walked into this by accident. Most of us who spent careers inside vertically integrated operations helped build it, and for good reasons.

Modular controls gave us things the old relay panel never could. One dashboard across 200 sites. Remote diagnostics so a technician did not have to drive four hours to read a fault code. Energy optimization, predictive maintenance, inventory tied to temperature logs, audit trails for food-safety compliance. When you are standardizing a group of acquired businesses under a parent entity, that kind of uniform, remotely managed control layer is exactly what makes integration possible.

The bargain had a hidden term. Every module we added came with a support lifecycle measured in years, not decades. A hydraulic frame is depreciated over 30 years. The PLC, HMI, gateway and cloud agent sitting on it are on a five-to-ten-year product cycle, set by a vendor whose business model rewards replacement. When that vendor declares end-of-life, the asset does not stop working. It just quietly becomes a door that no one is allowed to lock anymore.

Three things turned that from a nuisance into a crisis:

  • Connectivity became the default. Controllers that once sat on an isolated panel now ship with web interfaces, and contractors expose them to the internet because it saves a truck roll.

  • Access fragmented. The owner, the integrator, the maintenance contractor and the OEM each hold a key. No one owns the whole lock.

  • Patching moved off the plant floor. Whether a machine stays safe now depends on a release schedule in another company, often another country.

Seeing it from both chairs

I hold cybersecurity certifications, and I have spent years in the private sector running programs, processes and automation for operating companies under larger parents. I can argue both sides of this, and both sides are right.

The security view. Vendors cannot support every product forever. Danfoss announced the end of life for the AK-SM 800 five years ago and urged customers to plan replacements. Its own guidance says to keep controllers off the internet, change default passwords at install, and route remote access through a single managed entry point. Most of what happened in France was preventable with segmentation and an asset register. From this chair, the failure is the owner's.

The operator's view. The owner bought a refrigeration system, not a software subscription. The cases still hold temperature. Ripping out a working controller across hundreds of stores is a capital project that competes with every other priority on a thin-margin P&L, and the end-of-life notice landed in a newsletter that went to a contractor, not to the CFO. From this chair, the failure is a market that sells 30-year assets with 5-year brains and calls it progress.

The honest answer is that both are describing the same gap from opposite ends. Lifecycle risk sits between the balance sheet and the security program, and in most companies nobody is assigned to it.

What the AI era will reveal

Which brings me to the bigger question. Is the United States still fertile ground for industry, for diagnosing problems like this one, and for changing direction once we see them?

AI shortens every clock in this story. Attackers already use automation to find exposed devices and chain known flaws at a speed no human team matches. The gap between "vendor stops patching" and "someone weaponizes it" used to be measured in years. It is now measured in weeks. A country running decades-old iron on orphaned controllers is not sitting on durable assets; it is sitting on an expanding attack surface.

There is a pessimistic reading. We offshored much of the know-how to build and repair the machines, then outsourced the controls to a handful of foreign and domestic OEMs, then outsourced the maintenance access to contractors. Each step made sense locally. Together they leave many operators unable to diagnose their own equipment, let alone redirect it. If AI widens that dependence, with black-box models layered on black-box firmware, we risk owning factories we cannot actually run on our own.

There is also a hopeful reading, and I think it is the more useful one. The same tools that speed up attackers can speed up diagnosis: inventorying every controller on a network, reading firmware, flagging end-of-life parts, and drafting the segmentation plan in days instead of quarters. The US still has deep pools of controls engineers, integrators and security talent. What it lacks is the incentive structure that makes lifecycle ownership someone's job.

So my answer is: not barren, but drifting. The ground is still fertile. Whether it stays that way depends on whether operators insist on owning the brains of their machines, not just the steel.

What leaders should do this quarter

  1. Build a controller register, not just an asset register. For every machine, list the control module, firmware version, vendor end-of-life date, and who holds remote access.

  2. Get controllers off the open internet. Segment OT from IT and from guest networks. Route all vendor and contractor access through one managed, logged entry point. This is the step that would have stopped most of what hit France.

  3. Put support lifecycle into the purchase contract. Require a minimum security-update period, advance end-of-life notice to the owner (not just the installer), and a documented migration path.

  4. Fund replacement as maintenance, not as a project. A controller past end-of-life is a worn part. Budget for it the way you budget for seals and bearings.

  5. Keep a manual fallback. Every critical process should have a local, non-networked way to run safely. If a store cannot hold temperature with the internet unplugged, that is a design flaw.

  6. Make lifecycle risk someone's job. Name an owner who sits between operations, finance and security, and give them the authority to retire hardware.

The steel was never the problem

The French freezers did not fail because they were poorly built. They failed because the part of them that thinks had been abandoned, and the part of the business that owns them did not know.

The next decade of industrial competitiveness will not be won by whoever builds the toughest machine. It will be won by whoever can still diagnose, secure and redirect their machines when the vendor moves on. That is a capability we can choose to rebuild. The question is whether we do it before the next night like October 11, or after.

Sources

Margaret Budnik