Brussels weighs interoperable social platforms as Europe's fridge hack exposes legacy passwords

The proposal lands as Brussels is still negotiating the Kids Act. The European Commission put the law forward in September. It would bar under-13s outright, admit them gradually after that, and cap screen time at one hour a day until 15, according to El País. The think tanks argue none of it touches the market conditions that produce the harm.

Their answer is interoperability. That would let a user of one platform read and post on another without leaving their own account. The paper came out of three days in Valencia, hosted by Fundación Avanza, which is tied to Spain's PSOE. Counterparts from Germany, France, Italy and Portugal took part. "We want to help with our reflection the parties that generally cannot take the time to debate these issues in depth," Berna León, the foundation's director general, told El País. The group wants to hand the document to sympathetic and unsympathetic MEPs in Brussels before negotiations on the law proper begin. Commission president Ursula von der Leyen, presenting the initiative in Strasbourg, said young Europeans average four to six hours a day on screens. Those who started on social media before 10 average seven to eight.

Several paragraphs of the think tanks' text attack what they call the "asymmetry of power" between large technology firms and institutions. Companies, the document says, have treated fines as one more business cost. Whether interoperability would change that is untested. The paper is a lobbying document rather than a legislative text.

Payments rules draw the same scrutiny

Fintech has its own version of the argument. FinTech Futures reported on 2 November that cloned websites sit inside the EU's draft payment rules and have drawn little public attention. The report does not detail the provision. The framing is familiar: rules written for incumbent institutions meeting actors who can route around them.

Capital keeps moving regardless. Tech.eu's weekly recap, published on 2 November, counted more than 60 funding deals worth over €1.3 billion across Europe in the prior week. AI took €815.6 million, healthtech €121.1 million and fintech €104.1 million. The UK led on €1 billion, ahead of Switzerland on €74.4 million and Spain on €59.5 million.

Smaller rounds filled in the picture. Portuguese startup Granter raised €1.6 million, Tech.eu reported on 3 November. 3XP Global led the round through its Impact Innovation Fund under Portugal's state development bank, Banco Português de Fomento. Granter's platform helps SMEs find public funding and prepare applications, bringing its total raised to €2 million. Its business depends on the complexity of European funding programmes. That is a regulation story as much as a software one.

Cold rooms, default passwords

Then there is the security layer, which is where regulation meets hardware. On Monday, refrigeration systems at supermarkets in Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Ireland and Finland were hit, according to The Guardian. Temperatures in some cases reached 50°C. CNBC reported that Ahold Delhaize had dozens of Delhaize stores affected in Belgium and Luxembourg and discarded food. Carrefour said 15 Belgian stores were attacked and Intermarché 15 of its 153.

Reuters, via CNBC, put Spar owner Colruyt Group at five Belgian stores. IKEA told CNBC a fridge incident hit its Mons store between Sunday and Monday. In the UK, the British Association of Independent Meat Suppliers told the BBC some of its 300-plus members were affected. One firm's cold units reached up to 100°C; the units were empty, so no produce was lost, The Guardian reported.

"There are so many vulnerabilities out there that … you could say are waiting to be exploited," said Richard Horne, chief executive of the NCSC.

The National Cyber Security Centre's Paul Chichester said the attacks were not AI-enabled. They used flaws "out there for a long period of time". Xavier Bellekens of the cyberdefence firm Lupovis told The Guardian his team logged 256 attempted attacks from 91 sources between 20 October and 30 October against honeypot Danfoss controllers. Most used the manufacturer's factory-default credentials. The earlier French attack, Tom's Hardware reported on 2 November, used legacy kit connected to the internet with default passwords. The European Commission said it had convened its interinstitutional task force with ENISA and Europol, CNBC reported.

The lesson travels. A payment terminal or a fridge controller shipped with a default login is the same regulatory gap. Neither the Kids Act nor the payments package in draft closes it by itself.