01Eight things that matter
| Do this | Because of |
|---|---|
| Take management interfaces off the public internet | France's CERT-FR said exposing a refrigeration controller's interface was against best practice. Fridge attacks |
| Know what you own, then patch or replace it | Danfoss said the affected French units ran outdated firmware. IoT and OT |
| Require multi-factor sign-in everywhere that matters | Colonial Pipeline reportedly lacked it on the account used. Infrastructure |
| Verify payments out of band, with two approvers | Arup lost HK$200m to a fake video call. Deepfakes |
| Tighten the help desk and password reset process | M&S's chairman said attackers impersonated an employee to get a help-desk password reset. Retail |
| Keep offline, tested backups and a manual fallback | Downtime, not the ransom, is the main cost. Ransomware |
| Map and limit your suppliers' access | Third-party involvement doubled to 30% in Verizon's report. Concentration |
| Alert on physical reality, not just IT | Attackers reportedly stretched freezer defrost cycles from one hour to eight to delay alarms. A temperature alert that does not depend on the controller cannot be silenced by it. |
02Close the gap faster than AI can open it
CrowdStrike's data puts average time from first access to lateral movement at 29 minutes, and Belgium's cyber centre says AI can now be used to exploit weaknesses. The practical consequence is to treat time to patch and time to detect as the numbers you manage. Anything that does not need to be on the internet, remove; anything that must be, update first. See how AI is making attacks faster.
03If you take or send payments
- Use a dedicated, least-privilege API key per integration, and rotate it when staff leave.
- Sign every API request. Payaries requests are signed with HMAC-SHA256, so a forged request without the secret is rejected.
- Verify the signature on every incoming webhook before you mark an order paid; never trust a redirect alone.
- Set withdrawal limits and require human approval above a threshold, particularly if an AI agent is involved: see AI agents and Payaries.
- Reconcile invoices against your own records daily.
None of this makes a business attack-proof, and Payaries is a payment gateway rather than a security product. It narrows the one slice of exposure that a payment integration controls.
04The larger point
Technology is not turning on civilisation; people are using powerful, cheap and widely shared tools against systems that were built for efficiency before safety. The answer is not less technology but the unglamorous discipline we expect elsewhere: inspection, maintenance, redundancy and checking who you are dealing with. A freezer controller is now critical infrastructure, and it should be treated like it.
Questions
- What is the most effective defence against cyberattacks?
- No single control, but the common causes in recent incidents are exposed management interfaces, unpatched or unsupported devices, missing multi-factor authentication, and payments approved on an unverified request. Fixing those covers a large share of real incidents.
- How can a small business protect itself?
- Turn on multi-factor authentication, keep software and devices updated, back up offline and test the restore, verify payment changes by calling back on a known number, and keep a list of the suppliers you depend on.
- How do I secure a crypto payment integration?
- Use least-privilege API keys, sign requests, verify webhook signatures before fulfilling an order, set withdrawal limits with human approval, and reconcile regularly.
Keep reading
- Someone is hacking supermarket fridges: what we know about the attacks across EuropeHackers pushed supermarket fridges and freezers to 50°C in France in October and across Belgium, Sweden, Ireland and Estonia on 2 November 2026. What happened, how, and why it matters.
- How to sign crypto payment API requests (HMAC-SHA256)How to sign Payaries API requests with HMAC-SHA256, with working Node.js, Python, Go and shell code and published test vectors to check your implementation against.
- How to verify crypto payment webhook signaturesVerify a crypto payment webhook's HMAC-SHA256 signature against the raw body, guard against replays, dedupe retries and acknowledge fast — with working Node.js code.
- Why everything with a network cable ends up hacked: IoT and OT explainedWhy fridges, cameras and factory controllers keep getting hacked: they were built to work, not to be attacked. Mirai, exposed controllers and edge devices, explained.
- Deepfake fraud: what happens when a video call can be fakedHow deepfake video and voice cloning are used to steal money, from Arup's $25 million Hong Kong video-call fraud to cloned voices. How it works and how to verify.
- How AI is making cyberattacks faster, cheaper and harder to spotAI is speeding up phishing, reconnaissance and exploitation. What CrowdStrike's 2026 report and Anthropic's disclosed AI-run espionage campaign actually show, and what is hype.
- Shelves, showrooms and assembly lines: what the M&S, Co-op and Jaguar Land Rover attacks taught usHow the 2025 cyberattacks on Marks & Spencer, Co-op and Jaguar Land Rover show that modern business depends on a few fragile systems, with costs of £80m to about £1.9bn.