October 30, 2026

Preparing for the Attack We Don’t Know About Yet

Mike York Raymond Tec Insights, Security & Maintenance Backups, Critical Infrastructure, Cyberattack, IoT, The Infrastructure We Trust, Zero-Day Vulnerabilities

There’s a temptation, when several bad things happen close together, to decide they must be part of one plan. Wars disrupt energy markets. People protest rising costs and failing public services. Cyberattacks hit grocery stores, water systems, and power infrastructure. An organizer’s social media account disappears in the middle of a demonstration. You can draw a line through all those events and end up with a story that makes a certain kind of sense.

The hard part is proving the line belongs there. And even if we never identify the people responsible for a particular attack, we still have to keep the lights on, the orders moving, and the data recoverable. That’s where I want to end this four-part series, The Infrastructure We Trust. We need enough skepticism to investigate the uncomfortable possibilities, and enough practicality to do something useful before the next headline.

Several protest movements, several reasons to be angry

France’s October 17 demonstrations brought together students, trade union members, and people associated with the Yellow Vest movement. Reuters reported grievances over rising living costs, inadequate school resources, inequality, and public services. Most protesters marched peacefully, while serious violence and destruction occurred in several cities. Neither reality erases the other.

The rest of Europe wasn’t simply copying France. Tens of thousands protested across Spain on October 3 over housing costs and access to housing. Italian demonstrations on October 17 focused on the cost of living, with confrontations in Milan and Bologna. Belgium and Portugal saw demonstrations over wages, austerity measures, housing, and public services. There are overlapping pressures, but the causes and organizers aren’t identical.

In the United States, the October 17 No Kings events focused on early voting and opposition to a range of Trump administration policies. That is a different political context from a Spanish housing protest or a French school demonstration. And when the No Kings coalition temporarily lost access to its Instagram account, Meta attributed the disruption to a mistaken automated security decision, not a government directive. The account outage was real; the theory of deliberate state interference remains unproven.

I don’t think treating all these people as pieces on one conspiracy board helps us understand why they’re in the streets. The actual grievances matter. So does the question of whether anyone is exploiting that anger for purposes of their own.

The rules around technology matter too

Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.

Who could be behind infrastructure sabotage? More than one kind of actor

We’ve looked at remotely controlled French supermarket refrigerators, malicious activity in Ahold Delhaize’s networks, and attacks involving U.S. water systems. Not every incident has a publicly identified perpetrator, and a shared target category isn’t forensic evidence of a shared attacker. The French refrigeration investigation, for example, points to exposed management systems and weak passwords, not to a named intelligence agency.

Some infrastructure operations are linked by investigators to state-aligned actors. Polish authorities documented coordinated destructive attacks within their own energy sector. Researchers have attributed separate destructive activity against a Ukrainian grain-logistics business to Russia-linked hackers. Those findings demonstrate capability and particular campaigns. They don’t establish responsibility for the French grocery attacks or a hidden organizer behind European demonstrations.

Could a criminal group or an individual looking for money attack an ordinary business? Absolutely. Could an ideologically motivated group or a for-hire operative be involved in sabotage? Those are real threat categories too. OCCRP journalists documented recruitment through Telegram for destructive acts in Europe, including offers of payment. Their investigation even found fake videos used to claim sabotage that hadn’t happened. That’s a useful warning not to accept every anonymous claim of responsibility at face value.

The responsible answer is uncomfortable: for several of the incidents in this series, we cannot rule out all of those classes of attacker based on the public evidence. That is not the same as saying each possibility is equally supported. It means investigators need logs, recovered tools, infrastructure records, authenticated communications, and financial evidence before they can credibly identify an operator and a motive.

Security doesn’t get to wait for the trial verdict. A business has to defend against a stolen password whether it was stolen by an amateur, bought by a criminal organization, or used by an intelligence service. The refrigerator still has to keep food cold.

Compromised website help

Sometimes maintenance starts after the damage is done. Raymond Tec can investigate compromised sites, clean up access, recover what can be recovered, and patch the original problem — then help make the next incident considerably less exciting.

What do we do about an attack we don’t know exists yet?

A zero-day vulnerability is a flaw defenders have had no opportunity to patch before it is exploited or publicly disclosed. You cannot install a patch that doesn’t exist. You can, however, make it harder for that flaw to become a catastrophe.

That’s the real purpose of defense in depth: independent controls so a failure in one place doesn’t give an intruder everything.

Start by reducing exposure.

An administrative dashboard that isn’t reachable from the public Internet can’t be attacked by an anonymous visitor through that route. A service that was retired and actually removed can’t be compromised next Tuesday. Inventorying old apps, vendor access, management panels, test installations, and connected devices may be less exciting than installing another security product, but it removes paths a scanner would otherwise find.

Then limit what a compromised account can do.

Give people and service integrations only the permissions they need:

Use unique passwords stored in a manager.
Use phishing-resistant multi-factor authentication or passkeys where available.
Separate administrator identities from everyday browsing and email.

Assume that a password might be disclosed without your knowledge. A second authentication factor doesn’t fix a vulnerable server, but it can block many uses of a stolen password.

Segment networks.

An online store’s database doesn’t need to be reachable from an employee’s guest Wi-Fi. A building-control device doesn’t belong on the same unrestricted network as business accounting systems. Monitor important authentication and configuration events somewhere an attacker on the primary machine cannot casually erase them. Keep tested backups with separate credentials and at least one recovery path that doesn’t depend on the same compromised service.

None of that eliminates zero-days.

It changes how far someone can get after exploiting one.

Yes, even the washing machine

I know. We started with wars and political unrest, and now we’re discussing the washing machine. Welcome to modern technology.

A connected appliance may have a mobile app, a vendor cloud service, an update mechanism, and credentials that outlive the original owner of the house. Those are software dependencies, even if the only feature you wanted was a notification when the towels were finished.

For home devices, use a strong router password, current router firmware, and a separate guest or IoT network where the equipment supports proper isolation.

Change default credentials.
Turn off remote access you don’t use.
Check whether the manufacturer still provides security updates, and think twice before keeping an abandoned device connected.

CISA’s Internet exposure guidance applies to industrial equipment, but its central lesson works at home: services with no reason to be publicly reachable shouldn’t be.

A separate Wi-Fi network isn’t magic. Some routers use “guest” to mean isolation; others offer options that still permit local access.

Read the settings. And don’t interrupt a safety-critical industrial controller to experiment with network segmentation without planning and testing with its operator. Safety and uptime are part of security.

Backups & recovery

Backups are comforting right up until you need one. Raymond Tec helps small businesses build practical backup and recovery plans — including the decidedly unglamorous part where we make sure the thing can actually be restored.

The recovery plan is where the theory meets reality

For a business website, that means:

A known-good restore
Clear ownership of domain and hosting accounts
Recent order records
An alternate way to reach customers
A tested way to take the site offline safely if necessary

For a social media account, it means:

Multiple authorized administrators.
Phishing-resistant authentication.
Recovery codes stored securely.
Ownership records.
And a way to publish important updates without relying on one platform.

For equipment that controls a physical process, include safe manual operation and people who understand the equipment.

The Minnesota water-system guidance calls for inventories, separation of operational and administrative networks, secure remote access, offline backups, and tested incident-response plans. Those principles scale down surprisingly well to small businesses, even if you don’t have a pump or turbine anywhere on the premises.

Before a crisis, test one thing. Restore a copy of a database into a safe environment. Recover a social account using its documented procedure. Run a checkout using a fallback process. Check which employee or contractor has the right number to call. A plan that depends on remembering who set something up three years ago isn’t much of a plan.

Uncertainty should make us better investigators, not helpless spectators

I started this conversation wondering whether the infrastructure attacks and protests were connected. I still want to know who is responsible for the unattributed incidents, whether anyone deliberately targeted dates or locations, and whether any powerful interests benefited by design rather than coincidence. Those questions deserve documents, technical findings, and sustained reporting.

But they don’t have to be answered before we protect the parts of our own lives we can control. The objective isn’t to build an invulnerable business or home. That’s not available at any price. It’s to know what matters, make the easy intrusions harder, limit the damage from the ones we miss, and have a credible way back.

When the next headline says something essential has been hacked, the first question can be “Who did it?” The more useful immediate question may be “If that was one of the systems I depend on, would I know and what would I do?”

Keeping a website running is its own job. Raymond Tec provides website security and maintenance, including updates, backups, monitoring, access cleanup, recovery planning, and help when something has already gone sideways.

Sources and further reading

Featured photo: Asep Saeful Bahri via Pexels, used under the Pexels License. The image is illustrative and does not depict a facility or event discussed in this article.