Gemini 📕 To cut to the chase, there are still locations where Windows XP continues to operate as a core system in critical infrastructure—such as water, electricity, gas, railways, and telecommunications. Even though official announcements claim “migration completed following end of support,” XP still runs many systems out of public view—in factory control rooms, plant machinery rooms, and dedicated backend terminals. Here’s why and where it’s still in use: 1. Actual locations where XP is still in use (and persists) - Control PCs for factory production lines and industrial robots - Monitoring and control systems (or parts thereof) at power plants, water treatment facilities - Management systems behind railway signaling and station ticket machines or automated turnstiles - Control PCs for large medical imaging equipment (e.g., MRI, CT scanners) 2. Why does XP persist at the core of infrastructure? Infrastructure systems operate under entirely different conditions than the personal computers we use daily. 🟧 “Air-gapped (isolated network)” = deemed secure Most core infrastructure systems are built on completely isolated networks with no connection to the internet. Since they are not exposed to external cyber threats, organizations often conclude: “Even without security updates, it’s safe enough to keep running.” 🟧 Tied directly to investments of hundreds of millions to billions of yen Factory manufacturing equipment and plant control devices were developed with proprietary hardware boards and applications that only run on Windows XP. Upgrading to Windows 11 would require not just rewriting the software, but replacing the entire connected machinery—resulting in prohibitively high costs. 🟧 “Never touch a system that’s working”—a strict rule For infrastructure systems that must run 24/7/365 without interruption, the risk of introducing unforeseen failures by upgrading the OS—potentially paralyzing society—is unacceptable. The conservative philosophy of “if it ain’t broke, don’t fix it” has prolonged XP’s lifespan. KG 🧙‍♀️ What about the EU refrigerator temperature attack or the Spanish train collision? You’re right—the recent news about the “EU refrigerator temperature attack” is a textbook example of cyberattacks exploiting system vulnerabilities and operational gaps. However, the “Spanish train collision” was not caused by a vulnerability or hacking; it resulted from system malfunctions and human error. In supermarkets across Europe (France, Belgium, Sweden, and over nine other countries), commercial refrigeration and freezer management systems were hacked. Attackers remotely raised temperature settings to nearly 50°C, causing massive food spoilage and waste. Where did the vulnerability lie? The target was remote monitoring and maintenance software connected to the internet—software used to adjust temperatures and perform upkeep. Connection to the XP story above: Many stores continued using outdated cooling equipment whose manufacturer support had long expired—or they ignored available security patches. This is a classic case of the very vulnerability we described earlier: keeping old systems running while leaving them exposed to the internet. Spain: A high-speed train traveling from Madrid to Seville collided with another train, killing 69 people. No evidence of a cyberattack has been found. The incident occurred because an automatic signaling system experienced a computer malfunction (system crash), causing trains to stop temporarily. Then, control center operators—failing to fully understand the situation—incorrectly instructed the driver to proceed at normal speed (human error and operational confusion). This was the direct cause. About a month before the accident, Spanish national railway operator Renfe suffered a separate cyberattack involving AI-based intrusion that led to customer data leakage. This fueled rumors that the train collision was also a cyberattack—but the crash itself was purely an accident caused by aging infrastructure and operational mismanagement. As you’ve noted, the EU refrigerator incident was a major event caused by two critical failures: neglecting expired support for legacy equipment, and leaving that equipment connected to the internet for remote maintenance. Hackers targeting infrastructure and commercial facilities are constantly searching for vulnerabilities in these newly internet-connected legacy systems. In this EU refrigerator case, speculation has also emerged regarding state-sponsored involvement (e.g., Russian ties).