CSIRT-CAN – Centro de Respuesta a Incidentes de Seguridad de Canarias

The Year 2038 Problem

News image

The well-known “Year 2038 problem” (Y2K38) is looming as a silent threat to thousands of technological systems worldwide. 

Although the date seems distant, experts warn that critical infrastructure such as payment systems, medical equipment, industrial automation, and IoT devices could be severely affected if timely action is not taken.

Main Risks Associated with Y2K38
Among the most significant impacts this vulnerability could generate are:


1. Disruptions in payment systems, with rejected or incorrectly recorded transactions.
2. Failures in medical equipment, affecting diagnoses, patient records, or the operation of critical devices.
3. Errors in industrial automation, with unexpected shutdowns in factories and production plants.
4. Problems in IoT infrastructure, such as sensors, cameras, and remote control systems.


5. Mismatches in security certificates, which can invalidate authentications and encrypted communications. 

6. Reputational damage and financial losses for unprepared organizations.


Companies with legacy assets and an outdated technology inventory are the most vulnerable. In many cases, these systems operate in the background, making it difficult to detect their vulnerability until a failure occurs.


How to prepare for Y2K38?


Cybersecurity and infrastructure management specialists recommend a preventative strategy based on several pillars:


1. Identify all 32-bit dependent systems, including hardware, software, and embedded devices.
2. Train technical staff to understand the impact of the problem and know how to respond.
3. Migrate to 64-bit architectures whenever possible.
4. Apply patches and temporary solutions to systems that cannot be upgraded.
5. Implement continuous monitoring with Advanced Detection and Response (EDR) tools.    
6. Conduct simulated date tests to evaluate system behavior. 


The clock is ticking, and although 2038 may seem far off, preparation must begin now. Anticipating is the only way to avoid a new technological “apocalypse”.