The Three Largest Economies in the World: America, China… and Cybercrime

When hackers turned French supermarket freezers into ovens, they exposed a frightening reality: the world’s digital infrastructure is increasingly connected, yet insufficiently protected. Artificial intelligence is making the problem more urgent.

The World’s Third-Largest Economy?

Imagine a country without borders, universities, factories or an elected government.

It manufactures almost nothing, conducts no legitimate scientific research and produces little of value for society.

Yet its economic footprint rivals that of the world’s largest nations.

Its name is Cybercrime.

According to Cybersecurity Ventures, cybercrime was projected to cost the world $10.5 trillion annually by 2025, compared with approximately $3 trillion in 2015.

For perspective, America’s economy produced roughly $31 trillion in 2025. China’s produced approximately $19.5 trillion, measured at prevailing exchange rates.

If cybercrime were a country, and its estimated damages were treated as economic output, it would rank third globally.

There is an important distinction. GDP measures economic production. Cybercrime damages measure estimated losses from fraud, stolen information, disruption and recovery. The $10.5 trillion figure is an industry projection, not an independently audited total or the income earned by criminals.

Nevertheless, the magnitude is alarming.

America creates extraordinary wealth through intellectual capital. China combines industrial scale with increasingly sophisticated technological innovation.

Cybercrime exploits both.

And a recent incident in France demonstrates just how vulnerable our increasingly connected world has become.

1. France: When Hackers Turned Freezers Into Ovens

On 17 October 2026, The Guardian reported an extraordinary cybersecurity incident affecting French supermarkets.

Hackers had remotely manipulated refrigeration systems across as many as 700 stores, including branches of Intermarché, Carrefour, Coopérative U and Monoprix.

Commercial freezers designed to operate at temperatures approaching minus 27°C were reportedly pushed above 50°C. In some locations, temperatures rose even higher.

Frozen food thawed, spoiled and became unsellable. Some stores experienced fires, sprinkler activation and additional damage.

Tonnes of food were discarded.

The estimated losses at Intermarché alone could reach tens of millions of euros, according to its management.

But what makes this incident especially disturbing is how it appears to have happened.

Many refrigeration systems were connected to the internet to enable remote monitoring, maintenance and temperature control.

Investigators and cybersecurity specialists identified exposed management interfaces, outdated firmware, unsupported equipment and potentially unchanged default passwords.

France’s cybersecurity agency, ANSSI, confirmed compromises involving refrigeration controllers from Danfoss, Copeland and Dixell. It urged operators to remove exposed interfaces from the public internet, update equipment and restore remote access through secure connections.

The perpetrators remain unidentified. There is no established evidence that artificial intelligence was responsible or that a particular foreign government directed the attack.

The important point is that an internet connection designed to improve maintenance also created an opportunity to disrupt physical infrastructure.

This was not simply the theft of information.

It was the destruction of real goods through compromised software.

Consider the wider implications.

If hackers can interfere with supermarket refrigeration, what prevents similar attacks against food warehouses, pharmaceutical cold-storage systems, water facilities, manufacturing equipment or poorly secured hospital infrastructure?

These systems differ substantially in their security arrangements, but the underlying concern is shared: software now controls processes upon which ordinary life depends.

A cybersecurity failure can become an economic, environmental or physical safety problem.

The French incident demonstrates that our digital vulnerabilities are no longer confined to computers.

They have entered the infrastructure of everyday life.

2. America, China and the Economics of Knowledge

The United States remains the world’s largest economy by nominal GDP.

Its strength comes from an extraordinary combination of universities, research institutions, financial markets, professional services, technology companies, advanced manufacturing and creative industries.

Its greatest advantage may be intellectual capital.

MIT, Stanford, Harvard, Berkeley and other research institutions attract exceptional talent and connect scientific knowledge to entrepreneurship.

An idea becomes a laboratory experiment. An experiment becomes a prototype. A prototype attracts capital. A successful business can become a global enterprise.

America has developed an unusually effective system for accelerating that process.

Immigration reinforces this advantage.

According to research published by the National Foundation for American Policy in June 2026, immigrants founded or co-founded 455 of America’s 775 privately held billion-dollar startups—approximately 59%.

America’s capacity to bring together diverse intellectual traditions, encourage experimentation and finance new ideas is a formidable economic resource.

China has followed a different development path.

It has created immense manufacturing capacity, integrated supply chains and major strengths in electronics, batteries, electric vehicles, telecommunications and industrial engineering.

China is also increasingly innovative. The World Intellectual Property Organization placed it among the world’s ten leading innovation economies in 2025.

The distinction is therefore not between an innovative America and an uncreative China.

Both innovate, but their economic systems organise knowledge, capital and production differently.

America possesses a particularly strong combination of international talent attraction, entrepreneurship, universities and institutional experience. China possesses enormous industrial capabilities, domestic research talent and manufacturing scale.

I believe America’s intellectual capital, cultural plurality, openness to immigration and ability to commercialise ideas provide a compelling foundation for continued economic leadership, provided these strengths are preserved.

But consider what happens when valuable knowledge, intellectual property and industrial systems become accessible to criminals.

A company can spend billions developing technology only to have its research stolen.

A manufacturer can invest years building production infrastructure only to have operations interrupted through compromised control systems.

Cybercrime does not need to create wealth. It can exploit the weaknesses of those who do.

3. What Actually Constitutes Cybercrime?

Cybercrime is not one industry, and its economic cost cannot be divided into perfectly reliable categories.

The most consequential forms include financial fraud, ransomware, business email compromise, identity theft, intellectual property theft and attacks against infrastructure.

Financial fraud transfers savings from individuals and businesses to criminals through deception.

Ransomware can interrupt hospitals, manufacturers and public services while imposing recovery costs far greater than any ransom demanded.

Business email compromise exploits trusted relationships to redirect legitimate payments.

Intellectual property theft undermines the commercial value of research, designs and proprietary information.

Infrastructure attacks can disrupt physical operations, as illustrated by the French supermarkets.

The FBI’s 2025 Internet Crime Report recorded almost $21 billion in reported American losses. Investment schemes, phishing, impersonation and cryptocurrency-related fraud featured prominently.

These documented complaints represent only a portion of global cybercrime and cannot directly validate the much larger Cybersecurity Ventures projection.

Nevertheless, they establish something beyond doubt: criminals are exploiting digital systems on an enormous scale.

And one of their most effective instruments remains remarkably simple.

Human trust.

4. The Human Factor: Are 95% of Breaches Our Mistakes?

One of the most frequently quoted cybersecurity statistics originates from IBM’s 2014 Cyber Security Intelligence Index.

The research found that human error contributed to more than 95% of the security incidents examined.

However, this is regularly misrepresented.

It does not mean that 95% of all cybercrime is caused exclusively by human mistakes.

A more recent figure comes from Verizon’s 2026 Data Breach Investigations Report.

It found that 62% of breaches involved a human element, compared with 60% in the preceding report.

The human element includes actions such as responding to phishing, credential mishandling and other non-malicious behaviour.

Yet the same report found that exploitation of software vulnerabilities accounted for 31% of initial breach entry points.

These findings illustrate an important distinction.

Not every attack depends on someone clicking a fraudulent link.

The French supermarket incident was principally associated with weaknesses in connected equipment and its management, not a confirmed phishing campaign.

Nevertheless, human decisions were involved in the wider security environment.

Someone selected the equipment. Someone determined how it connected to the internet. Someone was responsible for maintenance, software updates, access controls and replacement schedules.

The human factor extends beyond the person who clicks. It includes the organisations that design, purchase, operate and govern technology.

A system that becomes dangerous because one employee makes a mistake is poorly designed.

A system that remains connected to the internet despite unsupported software is inadequately governed.

The solution cannot simply be to demand that everyone becomes a cybersecurity expert.

5. AI Is Changing Both Cybercrime and Cybersecurity

Artificial intelligence creates a new imbalance between attackers and defenders.

Historically, phishing emails often contained obvious spelling mistakes, unusual language and suspicious formatting.

Generative AI can produce persuasive messages, translate them into different languages, imitate professional communication and personalise deception using information gathered online.

AI-generated voices and video can also make impersonation more convincing.

A criminal might previously have needed considerable skill to create a plausible fraudulent campaign.

AI can reduce the cost and effort involved.

But the transformation extends beyond phishing.

AI can assist attackers in identifying vulnerable software, analysing compromised information and automating parts of their operations.

Britain’s National Cyber Security Centre has warned that AI will almost certainly increase the effectiveness and efficiency of elements of cyber intrusion, creating more frequent and intense threats through 2027.

IBM’s 2026 Cost of a Data Breach Report provides further evidence.

Among the malicious breaches in its research, approximately one in four were AI-enabled, representing a 56% increase from the previous year. The global average breach cost reached $4.99 million.

These findings concern IBM’s studied organisations; they should not be interpreted as a census of every cyberattack worldwide.

Artificial intelligence has not invented deception, extortion or software vulnerabilities.

It is accelerating existing methods.

However, the same technology can strengthen defence.

AI systems can monitor unusual behaviour, identify fraudulent communications, detect compromised accounts, prioritise vulnerabilities and help security teams respond more quickly.

IBM’s 2026 findings also associated extensive use of AI and security automation with approximately $1.93 million lower average breach costs compared with organisations using neither.

That is an observed association, not proof that AI alone produced the savings.

But it suggests that automated protection has considerable potential.

The question is whether we can deploy defensive intelligence faster and more reliably than criminals can exploit offensive capabilities.

6. Why Can’t AI Protect Us From Phishing?

Consider an intelligent security assistant operating across email, messaging applications, web browsers and financial transactions.

When an apparent bank message arrives, it checks whether the sender and destination are associated with the genuine institution.

When somebody requests payment to a new supplier account, it identifies the unusual instruction and requires independent verification.

When a video call appears to contain a senior executive requesting an urgent transfer, the system does not assume that a familiar face or voice proves identity.

It requires verification through a separate trusted channel.

This is a practical direction for AI-enabled cybersecurity.

But it must be supported by reliable technical controls.

AI can make mistakes. It can miss malicious content, produce false alarms and be manipulated by attackers.

A convincing explanation from an AI system is not equivalent to proof.

For high-risk actions, systems should rely on authenticated identities, verified transaction details, restricted permissions and independent checks.

The objective should not be to make every human perfectly suspicious.

It should be to make harmful consequences difficult even when people are deceived.

This is consistent with the UK National Cyber Security Centre’s guidance, which explicitly discourages relying excessively on employees to recognise every phishing attempt.

Good security uses multiple defensive layers.

7. What Individuals and Organisations Must Do

For individuals, several habits make a meaningful difference:

• Use passkeys or phishing-resistant multifactor authentication wherever possible.
• Keep devices, applications and routers updated.
• Verify unexpected financial requests through independently trusted contact details.
• Avoid opening unknown links when the same service can be accessed through its official application.
• Treat urgent requests for money, passwords or confidential information as requiring additional verification.

But society cannot place the entire burden on individuals.

Organisations should adopt secure-by-default systems, limit privileged access, independently verify important payments and maintain tested recovery procedures.

They should also inventory connected equipment, remove unnecessary internet exposure and replace devices that can no longer receive security updates.

The French incident demands additional safeguards for physical infrastructure.

Temperature-sensitive facilities should use independent monitoring, resilient alarms and controls that prevent unsafe operating conditions even when remote management is compromised.

Manufacturers, maintenance contractors and equipment owners need clearly assigned security responsibilities throughout the equipment’s operational life.

As autonomous AI agents become more common, similar principles should apply to digital workers.

Every agent should have a verifiable identity, defined permissions, activity logs and an effective means of revoking access.

No AI agent should be allowed to move money, expose confidential information or alter critical infrastructure without appropriate safeguards.

Ultimately, the human should retain meaningful authority without becoming the sole technical barrier preventing disaster.

8. We Are Still Not Secure Enough

This brings us to the political and institutional question.

Governments spend enormous resources supporting technological innovation and protecting national security.

Yet digital security frequently remains an afterthought in the systems that sustain ordinary life.

The UK’s Cyber Security Breaches Survey 2025/2026 found that 43% of businesses had identified a cybersecurity breach or attack during the previous year.

Phishing affected 38%.

Only 25% of businesses had a formal incident-response plan.

These numbers suggest a substantial preparedness problem, particularly among smaller organisations.

The European Union has introduced its Cyber Resilience Act to improve the security of connected products. Reporting obligations began in September 2026, but the principal product-security requirements will not apply fully until December 2027.

Regulation is progressing, but implementation takes time.

And criminals do not wait for legislation to mature.

Cybersecurity should therefore be treated as economic infrastructure, comparable in importance to reliable electricity, transport and financial systems.

Governments should require sensible security standards for connected equipment, encourage independent testing, strengthen cross-border criminal investigations and invest in AI-assisted defensive capabilities.

Companies should be accountable for foreseeable vulnerabilities rather than relying exclusively on warnings that users may never read.

Security must become an engineering requirement, not an optional feature.

9. The Real Economic Competition

The United States possesses extraordinary intellectual capital. China’s industrial scale and technological capabilities are equally consequential to the global economy.

Both countries will continue investing in artificial intelligence, computing, biotechnology and advanced manufacturing.

But there is another economic competition taking place beneath their rivalry.

It is between those who create value and those who exploit the systems that sustain it.

The French supermarket attack makes the consequences visible.

Cybercrime is not simply a hacker stealing a password or emptying a bank account.

It can mean destroyed food, disrupted supply chains, compromised hospitals and damaged public infrastructure.

Artificial intelligence may make attacks more scalable, but it also offers the tools to make defence more intelligent.

We should use those tools to create systems that verify identities, protect transactions, detect abnormal behaviour and prevent failures before they become catastrophes.

Human beings will continue making mistakes.

We become tired. We trust the wrong people. We overlook warnings. Organisations postpone upgrades and underestimate risks.

It is unrealistic to build cybersecurity around the assumption that these behaviours will disappear.

The real responsibility belongs to the designers, operators, manufacturers and governments responsible for creating resilient systems.

America creates wealth through ideas. China creates wealth through industry and innovation. Cybercrime exploits the weaknesses of both.

And perhaps the most important lesson of the French incident is that digital security is now inseparable from physical security.

The next great technological advance should not merely make artificial intelligence more capable.

It should make the systems upon which humanity depends substantially safer.

Because the challenge is not to eliminate human error.

It is to ensure that a human mistake, an insecure device or a neglected software update cannot become a national catastrophe.

References

1. Cybersecurity Ventures (2025). Official Cybercrime Report: Global Cost Projections.
2. Willsher, K. (17 October 2026). Not cool: who hacked France’s supermarket fridges? The Guardian.
3. ANSSI / CERT-FR (12–16 October 2026). Security incident targeting remote refrigeration controllers, CERTFR-2026-ALE-012.
4. US Bureau of Economic Analysis (2026). Gross Domestic Product; National Bureau of Statistics of China (2026). 2025 Statistical Communiqué.
5. National Foundation for American Policy (2026). Immigrants and U.S. Billion-Dollar Companies.
6. World Intellectual Property Organization (2025). Global Innovation Index 2025.
7. FBI Internet Crime Complaint Center (2026). 2025 Internet Crime Report: Key Findings.
8. Verizon (2026). Data Breach Investigations Report: Executive Summary.
9. IBM (2026). Cost of a Data Breach Report.
10. UK National Cyber Security Centre. Impact of AI on Cyber Threat Through 2027; Phishing Defence Guidance.
11. UK Department for Science, Innovation and Technology (2026). Cyber Security Breaches Survey 2025/2026.
12. European Commission (2026). Cyber Resilience Act: Implementation and Application Dates.