The AI-Hack Era: You Do Not Just Need Software. You Need Secure Software.

An attack on French blood cold storage shows what changed: the payload was not data, it was temperature. In the AI-hack era, software failures leave the screen and enter the physical world. Here is what that means for anyone buying software, and how ABN Asia builds for it.

In early November, someone reprogrammed the cold storage units holding blood samples for France's national blood service. The units were supposed to sit at minus thirty degrees Celsius. They were set to reach plus one hundred and ten.

A rise in temperature was noticed overnight by a technician on duty. France's Health Ministry said the incident had no operational consequences, because it was caught. The details come from the French weekly Le Canard enchaine, reported by Anadolu Agency.

Read that story twice, because almost nothing in it matches the mental model most businesses still carry about cyberattacks.

Nobody ransomed a database. Nobody exfiltrated records. The attackers did not want anything the organisation owned — they wanted the organisation to lose something it could not replace. The payload was temperature. The target was a freezer. The blast radius was physical.

What actually changed

For twenty years, the security conversation was about information: confidentiality, records, customer data, intellectual property. That model still matters, but it is no longer the whole picture, and it is no longer the worst case.

Three shifts have moved underneath us.

The cost of attacking has collapsed. Finding a vulnerability used to be specialist work: reading code, probing endpoints, understanding a stack deeply enough to know where it would break. AI tools now do a large part of that reconnaissance and exploit drafting, faster and more cheaply than a junior attacker could a few years ago. The economics of defence used to rely on attack being expensive. That assumption is gone. When offence gets cheap, the only durable answer is that defence stops depending on obscurity, luck, or the attacker's patience.

The blast radius is now physical. Software no longer sits politely inside a browser tab. It opens doors, dispenses medicine, moves money, controls warehouse robots, and yes, cools blood. Every one of those connections is a path from a network into something real. When we audit a system, the first question is no longer only "what data can be taken?" but "what can be made to happen?" A system that cannot be made to do something dangerous is a different class of system than one that can.

Your vendor's vendor is your attack surface. In the French case, the link was a maintenance contractor responsible for the storage containers. Nobody had to break into the blood service directly. They only had to reach a party that already had legitimate remote access. This is the uncomfortable arithmetic of modern supply chains: your security is the product of every party who can reach you, including the ones you never meet and the ones your supplier never mentions.

The uncomfortable part: detection was a person

The reason this story did not become a catastrophe is that a technician was on duty and noticed the temperature climbing.

That is not a triumph of automation. It is a reminder of where the last line of defence actually sits. Alarms, dashboards, thresholds and anomaly detection are all necessary, and all of them ultimately terminate in a human being deciding whether to act at two in the morning.

Most organisations discover this too late. They invest in prevention, buy tools that promise to stop attacks, and then leave the response to whoever happens to be awake. A security programme that cannot answer three questions is not a programme:

Who is watching, right now, and what are they authorised to do without asking?
How long would it take us to notice that something is behaving abnormally?
What is our honest containment plan when the answer is "we do not know yet"?

Why rented software concentrates the risk

None of this is an argument against SaaS as a category. Shared infrastructure is often more secure than a bespoke system nobody maintains.

But there is a real asymmetry worth naming. When you rent, you inherit the vendor's security posture, their supply chain, their patch cadence, and their incident disclosure habits. You also inherit their dependencies, which you cannot see and cannot audit. And when several hundred companies run on the same platform, one failure is not one failure. It is a correlated failure, all at once, in the same afternoon.

That is the honest trade. You get operational maturity in exchange for control. What you should not accept is losing visibility along with it.

What "secure software" actually has to mean

The phrase is nearly meaningless as marketing. It has to resolve into practices you can inspect. When we assess or build a system, these are the questions we insist on answering in writing:

A threat model, before the first line of code. What are we protecting, from whom, and what happens to the business if each asset is lost or made to misbehave? A system designed without this document is guessing.

Least privilege, enforced, not documented. Every service, integration and third-party integration gets the minimum access it needs, scoped, rotated, and revocable. Contractor access is access: it belongs on the same inventory as everything else.

Tenant and data isolation that is tested, not assumed. Especially where one instance serves many customers, isolation is a property you verify with tests, not a claim in a brochure.

Supply chain discipline. Dependencies pinned, updates reviewed, and an honest inventory of what your software pulls in. Most breaches arrive through a component nobody chose deliberately.

Secrets that are never in the repository, the logs, or a chat message. Credentials live in a managed store, rotate on a schedule, and are never echoed into a pipeline log for convenience.

Detection with an owner. Monitoring that produces alerts that reach a named human with authority to act. If nobody owns the alarm, the alarm is decoration.

A written incident response, rehearsed. What we do in the first hour, who speaks to whom, what we tell customers, and how we tell the truth quickly.

Honest disclosure. When something goes wrong, the report arrives before the rumour does.

None of these are exotic. All of them are routinely skipped, because they do not demo well and because the cost of skipping them is paid later, by someone else, in a bad week.

You not only get software. You get secure software.

ABN Asia builds software for organisations that cannot afford to be the case study.

We are engineers, not resellers, so security is not a product we attach at the end of a project. It is the way the work is done: threat modelling before design, least privilege in every integration, secrets in a managed store rather than in a repository, tests that prove isolation instead of assuming it, monitoring with a name attached to every alert, and a written response plan for the day something actually goes wrong.

We also tell clients what we cannot protect them from. If a system carries physical risk, we say so plainly, because a partner who only describes the upside is not being a partner.

That is the difference we are selling, and it is the only one that matters in this decade: you not only get software, you get secure software.

If you are commissioning a system that touches money, health, logistics, or anything that exists in the real world, we would like to see it before it is built, not after it has failed.

About ABN Asia

AI. Banking. Network Security. ABN Asia was founded by people with deep academic roots and professional experience across the United States, the Netherlands, Hungary, Japan, South Korea, Singapore and Vietnam. We are where academia and technology meet the opportunity. With advanced solutions and capable software development services, we help organisations grow and hold their ground on the world stage. Our commitment: faster, better, more reliable, and in most cases less expensive too.

If you need IT services, digital advice, ready-to-use software solutions, or simply want to send us a request for proposal, write to [email protected].

Source: Anadolu Agency, reporting on Le Canard enchaine, 4 November 2026.

Author

Ai-Banking-NetworkSecurity (ABN), ABN ASIA was founded by people with deep roots in academia, with work experience in the US, Holland, Hungary, Japan, South Korea, Singapore, and Vietnam. ABN Asia is where academia and technology meet opportunity. With our cutting-edge solutions and competent software development services, we're helping businesses level up and take on the global scene. Our commitment: Faster. Better. More reliable. In most cases: Cheaper as well.

Feel free to reach out to us whenever you require IT services, digital consulting, off-the-shelf software solutions, or if you'd like to send us requests for proposals (RFPs). You can contact us at [email protected]. We're ready to assist you with all your technology needs.