Steven Pinker: As Newport points out, harping on doom for the species changes the subject from immediate and obvious threats from AI, such as enabling bioterrorism, undermining truth-seeking institutions, and breaching cybersecurity.

Roman: “Stop being distracted by catastrophic risk and focus on the real threats, like [most commonly cited vectors for catastrophic risks]” is going to get very tiring, very quickly.

The short version

  • Hackers are increasingly reaching the machines that run the physical world, as well as the computers that hold our data.
  • Much of this equipment is old, was never designed for the adversarial internet, and has been connected to it anyway.
  • “Cyberattack” can undersell what these attacks really are.
  • You yourself can’t patch a supermarket’s fridge, though you can secure your own devices, protect your identity, and plan for services being unavailable for a while.

The fridges

On 2 November, supermarkets in at least seven European countries reported that their fridges and freezers had warmed overnight, some to as high as 50°C. Several confirmed they had been hacked. A sign in a Belgian shop apologised that there would be no products on the refrigerated or freezer shelves, and one shop in Stockholm said that “everything was destroyed”.

This was the second round: in October, hackers took control of cooling units in as many as 700 French supermarkets, with fires and food losses estimated in the tens of millions of euros. Meat suppliers in the UK have since been hit as well. As of 4 November, nobody had demanded a ransom and investigators had not named anyone.

On the night of 1-2 November, attackers went after France’s national blood service through a refrigeration contractor. Cold rooms holding plasma, normally kept at about -30°C, were reportedly set to 110°C at three sites. A technician spotted the rising temperatures, the plasma was moved or secured, and the service says no blood products were lost.

What OT is

Most of us think of hacking as stolen data, which is an attack on information technology (IT), the computers that store and move information.

Operational technology (OT) is the hardware and software that monitors and controls physical machines: power plants, traffic lights, water treatment, refrigeration. An attack on OT changes something in the physical world, so the harm can be spoiled food, dirty water or a stopped factory, whereas the usual harm from an IT breach is exposed information.

The Australian Signals Directorate (ASD) says in its annual threat report that many OT systems “were never designed to withstand cyber threats”. Much of this equipment was installed decades ago and has since been connected to the internet because remote monitoring is convenient. The two worlds also touch: at one Estonian chain, attackers reached the temperature controls through a computer that ran the refrigeration system.

The fridge attacks did not need to be clever. The French attack involved old equipment on the internet with default passwords, the Guardian reports, and the UK’s cyber security agency says the attacks were not AI-enabled and used vulnerabilities that had been known for a long time. France’s own alert reads like basic hygiene: take the controllers off the internet, change default passwords, update the firmware.

Old, but speeding up

In 2000, a disgruntled former employee of a contractor on the Sunshine Coast’s sewage system used a two-way radio, a laptop and a control computer belonging to his former employer to release sewage into local waterways, and was sentenced to two years in prison. Common accounts put the spill at about 800,000 litres. Stuxnet, the worm widely attributed to the US and Israel, destroyed at least 1,000 uranium centrifuges in Iran around 2010. In December 2015, attacks the US attributes to Russia cut power to about 225,000 customers in Ukraine.

The past year’s list is longer. In December 2025, attackers hit more than 30 wind and solar farms and a heat and power plant supplying almost half a million customers in Poland, and at a smaller plant they shut down a steam turbine, though heat supplies to customers were not disrupted. In July, water utilities in at least seven US states reported attacks, with effects including loss of pressure and flooding, and CSIS’s tally reports more than 100 facilities affected and a boil-water advisory in Georgia. A small British power generator was shut down for four days in an attack blamed on Iran-linked hackers, and closer to home a cyberattack, reportedly claimed by a ransomware group, shut down two Mackay Sugar mills in Queensland.

ASD says pro-Russia hacktivists have caused “operational disruptions – including physical damage” in water, food and energy, and a figure in its report is titled “Effective cyber attacks on vital OT and enabling systems could incapacitate Australia”. It also says attackers can use AI to find vulnerabilities and launch attacks at greater scale than ever before.

I found no report of an Australian retailer being hit as of 4 November. Woolworths says its store refrigeration controllers don’t connect to external networks, Aldi says it doesn’t use external networks to manage its refrigeration, and Coles declined to comment. Smaller businesses are the bigger worry: the same article quotes one security executive saying that companies “below the cyber poverty line” are sold on managing this equipment remotely over the internet.

More than “just a cyberattack”

A friend’s reaction to the fridges was that they are a cyberattack, but more fundamentally biological terrorism. That sounded a bit dramatic to me, and strictly nothing biological was released, though when I thought about it I came around to the underlying point: many events may get labelled, almost dismissed, as “just” a cyberattack, even acts of terrorism or war. If people walked into 700 supermarkets and destroyed the food, we would call it sabotage or terrorism.

There is also a huge asymmetry, a bit like the new drone warfare. An adversary willing to fight dirty has an enormous attack surface to work with, whereas Western governments aren’t willing to cut off supermarket refrigerators to Iranian or Russian civilians.

What you can do

1. Patch and secure your own devices. Attackers go after what is exposed and neglected, and yours is the part you control. Turn on automatic updates, replace devices that no longer receive them, and work through my starter guide, which takes an afternoon. Connected appliances count: Rachel Noble, a former head of ASD, gives the same advice for them, a strong passphrase and keeping the device patched. If you use Claude Cowork or ChatGPT Work, ask it to do a security audit of your computer.

2. If you run a business, check what is connected. Anything that relies on staying cold, or on a controller a vendor can reach remotely, deserves a look. Ask your supplier whether it is reachable from the internet, and apply France’s advice above, with access running only through a VPN or protected network.

3. Protect your identity. Use unique passwords and passkeys, and add hardware keys for your main accounts, two of them, following the starter guide’s recovery steps so that a lost key can’t lock you out. Telcos must use two or more proofs of identity before moving your number or swapping your SIM, and it’s worth asking yours what extra protections it offers. If you have been, or are likely to be, a victim of fraud, you can request a free credit ban, which lasts 21 days and can be extended.

4. Plan for things being offline. The government has urged organisations to prioritise security over service availability, which means more services may go down on purpose while they’re secured. Get Ready Queensland has a sensible kit list, starting from three days of supplies and at least 10 litres of drinking water per person.

5. Keep important references offline, and check them yourself. The simple version is to save or print the guidance you would need and check that you can open it without internet access. For a bigger library, Survival LLM and Project NOMAD are free apps that put an AI model and a large offline library on your computer. Survival LLM needs an Apple Silicon Mac or a 64-bit Windows PC with at least 16 GB of memory, whereas Project NOMAD is mainly a Linux server install for the technically inclined.

I had both set up on my laptop, and with internet access blocked the libraries worked well, including Survival LLM’s 1.5 million articles, whereas the generated advice was unreliable. One model in my tests gave steps for running a generator in a garage, which the CDC prohibits even with doors and windows open, and another underdosed bleach about fourfold. My test was small and used my own model files and patches, so it says little about the apps as shipped, though Survival LLM’s own page also warns that it can be wrong. For anything consequential, open the source article and read it.

The year to come

ASD has warned Australians to prepare for more basic and important online services to go offline unexpectedly, saying that “system security must be prioritised over system availability”. It also wants operators of critical infrastructure to be able to cut their vital systems off from the internet for three months and keep running. I think it’s reasonable to prepare for significant disruptions to infrastructure and communications for a few days.

The technology I worry about most is the software in cars. Modern cars are connected and updated over the air, so a malicious update could pass as an ordinary bug, whereas a fridge set to 50°C is plainly an attack. Researchers remotely took control of a Jeep in 2015, prompting a recall of about 1.4 million vehicles, and the US is banning certain Chinese and Russian-linked connected-car software from model year 2027.

A friend got me to watch Leave the World Behind a while ago, which I think is prescient.