Nobody Applauds the One Who Changes the Oil

Originally published in Spanish in El Español - QuinceMil (07/11/2026)

Fifteen days ago I told you in this column about the camembert that melted in France. This week it was half of Europe’s turn. And the lock was the same: the password that came from the factory and firmware from ten years ago. We keep writing the same column.

To hack the fridges of half of Europe this week, nobody needed a Russian group named after a constellation. It was enough to read the sticker on the plug. The very one where the manufacturer prints the default password; the one you have seen a hundred times without noticing on routers, printers, coffee machines and thermostats. In Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia, supermarkets woke up with the fish at fifty degrees and the camembert dripping off the shelves. The report from the Belgian cybersecurity centre tells it without drama: the cabinets that control the cold (from a Danish manufacturer called Danfoss, which the reader has no reason to know) were cheerfully peeking out onto the internet, with firmware not updated in years and with the password, I insist, printed on the sticker on the plug.

The lock open; the key under the doormat; the welcome sign in three languages.

I warned about this in this column fifteen days ago, citing the report I co-signed in 2018 on petrol station pumps. That is exactly what we were warning about: not the brilliant attack, but the door nobody had ever closed. Picture the scene and tremble a little: some three hundred devices from that same manufacturer exposed in Spain alone, according to Censys. They are not three hundred traffic lights or three hundred grandma’s computers. They are three hundred industrial refrigerators in supermarkets, hospital cold rooms, medicine cold chains, and so on.

The Project Manager syndrome

I call this the Project Manager syndrome. It is something I have been defining over the years, from what I have seen in large and small companies, in public administration and in forums with many of my colleagues. It goes like this: every new toy earns a press release, scissors, ribbon and a LinkedIn photo with a dentist’s smile; maintenance does not. Nobody has ever posted on social media about an update applied on a Tuesday at eleven at night. A new project, on the other hand, gets a name, a logo and a director general; maintenance gets overtime. And that is how we end up where we are.

In plain words: new things earn medals, old things bring trouble. And every device we plug in and then forget is one more door. Count them yourselves, if you have a moment: the building’s router, the smart plug, the mandatory e-invoicing now imposed on freelancers and small businesses, the lift with remote maintenance, the traffic light connected to the mobility centre, the water pump on the fifth floor, the living-room thermostat, the intercom camera, my father’s pacemaker, and so on. All digitised. All, therefore, with a silent expiry date. What is not maintained does not stand still: it rots. And while it rots, others use it.

It is also worth adding that cybercriminals have shifted gear. With the arrival of artificial intelligence, the number of vulnerabilities is growing exponentially: AI lets them search for, test and chain flaws at a speed we did not dream of five years ago. What used to take an expert a week, a laptop now gets through in an afternoon. Every day there is more danger for everyone: for the bank, the hospital, the town hall, the small business, the lady who pays her property tax from her phone. And, as usual, down here we keep ourselves busy debating how to regulate artificial intelligence, at conferences with cocktails, instead of how to develop it; meanwhile, cybercriminals are using it on the night shift.

For years, public money has rained down to digitise. Grants, kits, European funds, calls for proposals with the haste of someone who has to spend before the budget line expires. The tender specifications (almost always designed so that the same four big players end up winning them) already require maintenance, of course they do. The thing is, signing it is one thing and honouring it for five years in a row is another; the minister changes, the budget gets cut and the gadget stays there, switched on and alone.

Remember MeToca, the app with which Spain’s Ministry of Equality was going to share out household chores: it cost 211,750 euros, hardly anyone downloaded it, and it was withdrawn for lack of use. You have to grant it a merit others lack: it was deleted. A dead app is not a danger. The danger is what stays switched on with nobody watching it.

Observatories, on the other hand, we have plenty of

Observatories, on the other hand, we have plenty of. You could cross Spain from observatory to observatory without touching the ground, like someone crossing a puddle on stepping stones: an observatory of this, of that and of the other, each with its director, its logo and its annual 180-page report that not even the speaker’s mother reads. Tinsel sinecures and grandiose titles. I have yet to find the Observatory of the Pending Patch. That one is not worth inaugurating.

And what is on its way is, naturally, one more body: the brand-new National Cybersecurity Centre. It is born from the law that was supposed to transpose NIS2, the European rule that requires critical and essential sectors (energy, transport, healthcare, banking, water, public administration) and those in their supply chain to protect themselves seriously and to report their incidents. Spain should have passed it before 17 October 2024. Two years later we still do not have it, and in July the European Commission took us to the Court of Justice, asking for a lump-sum fine and another for every day of delay. You and I will pay it.

One cannot help suspecting that part of the hold-up lies in the organisation chart: who is in charge, who reports to whom, how many offices they get. Because we do have benchmarks. The CCN has been protecting the public administration for twenty-four years, and INCIBE serves companies and citizens from León with a solvency recognised across half of Europe. But inaugurating what already exists does not make headlines. A new centre does: plaque, director general and photo. The Project Manager syndrome, official gazette edition.

And then there are matters one does not joke about. On 28 October, in Urda, an AVE high-speed train struck a stationary Iryo train after the LZB failed, the signalling system that has protected the Madrid-Seville line since 1992. Sixty-nine dead. The investigation is open and I will not be the one to pre-empt it. But one question is fair, with all due respect: has that LZB been maintained as the trade requires, or have we been propping it up with patches and goodwill? Because it is one thing for a system to be old (so many are) and quite another to let something lives depend on age without care. And I fear that difference describes half of Spain.

Because if anything still works in this country (and it does, make no mistake) it is thanks to people who never appear in any photo. We saw it during Covid: systems technicians working entire nights so that hospitals, banks, schools and administrations stayed standing when the world went home. They did far more than their contracts asked of them.

They had no observatory. They had no plaque. Some did not even get a thank-you.

I am not asking for less innovation. I am asking, ladies and gentlemen, that every euro spent on launching something come with another beside it to change its oil. I am asking that no project, public or private, be approved without a lifecycle plan that answers three kindergarten questions: who updates it, who monitors it, when it gets switched off. NIS2 (yes, the one we have not yet transposed) already requires this in its Article 21, which speaks in so many words of security in the acquisition, development and maintenance of systems. The Cyber Resilience Act will require manufacturers to state in writing how many years of support they will give what they sell. I am asking, in short, that we reward the one who maintains as much as the one who inaugurates. Anything else is a toast to the sun.

Inaugurating is nice; maintaining, less so. Nobody applauds the one who changes the oil, that is true. But the one who does not change it gets an audience all on his own: the cybercriminal, who does not attack what we launch, because there is no need; he attacks what we forget, because we make it easy for him.

---

Also in my LinkedIn newsletter El Futuro es Hoy (in Spanish).