OpenAI is looking at data centre partnerships in Canada because of the energy and land available there, its head of countries George Osborne told Bloomberg at Mark Carney’s investment summit in Toronto. OpenAI paused its British project in April, saying it would proceed when regulation and the cost of energy allowed.

OpenAI is looking at data centre partnerships in Canada because of the energy and land available there, its head of countries George Osborne told Bloomberg. He was speaking at Mark Carney’s investment summit in Toronto.

Osborne was Britain’s chancellor from 2010 to 2016. In 2012 he hired Carney, then governor of the Bank of Canada, to run the Bank of England.

He joined OpenAI in December as managing director and head of OpenAI for Countries, the arm that takes the Stargate model abroad. He works from London.

Carney has articulated “one of the clearer plans for AI adoption of a western government“, Osborne said, calling the prime minister’s medium and long-term plan “very impressive“.

The summit ran on 14 and 15 September and brought about 100 of the world’s largest investment firms to Toronto. Carney wants to catalyse a trillion dollars of investment over five years.

Europe got a different answer.

OpenAI paused Stargate UK in April, saying it would move forward when regulation and the cost of energy allowed long-term infrastructure investment. The project was to run 8,000 Nvidia GPUs in the north east of England, scaling to 31,000.

British industrial electricity costs roughly four times what it does in the United States, Finland, Norway and Sweden. Grid connection requests jumped from 41 gigawatts in November 2024 to 125 gigawatts by June 2025.

The announcement did not survive much scrutiny either. OpenAI had never visited the site of its flagship British project, the Guardian found, and the government had publicised a GBP 1.9B contract that was not signed.

The copyright question is still open. A proposed text and data mining exception met opposition from the creative industries, and no law has followed.

Where OpenAI did build in Europe was Norway. Stargate Norway runs on Narvik hydropower, 230 megawatts to start, with 100,000 Nvidia GPUs targeted by the end of this year.

Energy and land, in other words. The same two things Osborne named in Toronto.

The EU is trying to buy its way past the problem, with a gigafactories call that closes to bids on 12 November and expects more than EUR 20B of private investment across up to seven sites. France’s $10B bid is already in.

When we talk about programming in “bare metal,” it basically means writing software that runs right on the hardware with no operating system or abstraction layers in between. This gives the program the most direct possible access to peripherals and memory, with the tradeoff being that you don’t get the protection and ancillary features that come with an OS.

Sylvain Huet came down to Hackaday Europe 2026 to talk about making bare metal easy. Not just by ignoring operating systems and ever-bloating dependencies, but by rethinking the way we approach software development and by building a transparent platform from the ground up.

Down To Brass Tacks

Sylvain begins the talk with a look at where his own computing journey began. Back in 1982, he got his hands on a Thomson TO7, with just 8 kilobytes of user RAM and a 6809 CPU. The best way to have fun with the hardware was to work straight in assembly.  “It was easy to understand everything about your computer,” notes Sylvian of the simplicity of the platform. “There was almost no hidden side in this computer.” Of course, change was fast in that era, and a bit over a decade later, Sylvain was working on a Metaverse-like product called Second World, before moving on to work on Nabaztag in the early 2000s—a charming Wi-Fi enabled rabbit launched just as wireless networking was hitting the mainstream.

The through-line across all these projects was that much of the work was done at the bare metal level—often useful when it’s desirable to work as close as possible to the hardware peripherals or to maximise performance. Sylvain then contrasts this with how things are often done in this modern era. A poignant example was showing pictures from an airport during the CrowdStrike outage of 2024. Where once upon a time a flight schedule display might have been a purpose built device running on very simple hardware, these days it’s common to just kit out flat screen monitors with entire Windows computers behind them. It’s a convenient way to build, but as Sylvain explains, this complexity sometimes comes at a cost. He then shows that such a display can be very easily built with a Raspberry Pi running a bare-metal program with no operating system at all—with no automated security updates enforced by an outside OS provider, or any such heavy-handed management required. Since it’s coded to do one job from the ground up, it’s much less likely that the software falls apart due to some outside update or the collapse of some obscure dependency that nobody on the development team was even aware was included.

Sylvain talks about a “new minimalism”—where “all you need to understand should fit in your single brain.” It’s not just about working at the bare metal level, but about creating systems where a single developer actually understands the project from top to bottom.  Of course, there are limits to the size of a project any one person can completely understand, but for some applications, this can be a useful guiding principle. The talk also explores how we use things like outside libraries. Sylvain calls this the “low-level paradox”— wherein the more sophisticated a task is, the more we rely on black boxes to do parts of the work for us. It’s a fast way to develop, but quickly adds thousands of lines of code to a project and enables us to avoid understanding some of what’s actually going on under the hood.

To this end, Sylvain has created the Minimacy language. It’s intended to enable development with fewer dependencies, black boxes, and operating systems, while maximising the capacity for understanding. It’s concise, linear, and safe, with strong static typechecking and type inference. You can work with it using the Minimacy virtual machine, which combines an instant compiler and a virtual processor that can run the code. It’s 100% open source, and is written in less than 900 kB of C—both which support the ideal of being within the realms of a developer’s ability to understand the whole stack. Indeed, Sylvain demonstrates just how light it is by running a Minimacy game off a floppy disk on a modern UEFI laptop. The idea is that a Minimacy VM could run on a variety of different hardware, allowing near-bare-metal access for Minimacy code while still maintaining some level of portability across systems.

Sylvain also demonstrates the Minimacy Machine. It’s powered by a Raspberry Pi RP2350, running at 150 MHz, with lots of useful peripherals, including Ethernet connectivity, an OLED display, an SD card reader, and a real time clock. Armed with all that, it’s a platform that can run Minimacy code and allow the development of devices that run without relying on lots of outside dependencies or a heavy OS built for more general purpose tasks. It exists as a transparent software and hardware stack for developers to build upon.

Overall, though, Sylvain’s talk isn’t just about Minimacy or programming in bare metal. It’s about finding simplicity where it makes sense. Working in bare metal isn’t for everything of course, and the vast majority of us will continue to use operating systems across all sorts of applications where they’re necessary and useful. However, in the advanced age we live in, it’s sometimes good to remember that stripping away unnecessary layers of abstraction often makes a lot of sense, because they can distract us from the simple tasks we’re trying to achieve in the first place.

Acronis disclosed a high-severity Linux local privilege escalation vulnerability in its backup plugin for cPanel, WebHost Manager (WHM), and Plesk that may be exploited in the wild.

cPanel & WHM and Plesk are used by web hosting companies and server administrators to manage websites and servers through graphical interfaces.

Acronis’ backup add-ons connect the hosting control panel to the company’s infrastructure, allowing administrators to back up and restore websites, files, databases, mailboxes, and hosting accounts from within the cPanel and Plesk interfaces.

The flaw was published in a brief advisory last weekend, but the technology company issued an update today, identifying it as CVE-2026-87886 and assigning it a severity score of 7.8.

A low-privileged attacker can exploit CVE-2026-87886 to increase their permission level on a vulnerable Linux server, potentially enabling them to access or modify sensitive data and disrupt the system without user interaction.

Further technical details on CVE-2026-87886 have not been published, as the company wants to give system administrators time to apply the available patches before sharing more information.

Acronis says it has detected exploitation of the vulnerability in the wild, “in limited, targeted attacks.”

“Exploitation of this vulnerability has been detected in the wild in limited, targeted attacks against Acronis Backup plugin for cPanel & WHM deployments,” the advisory warns.

In a statement for BleepingComputer, Acronis notes that the assessment is based on a single report from a “potentially affected” customer.

The CVE-2026-87886 vulnerability affects the following product versions:

• Acronis Backup plugin for cPanel & WHM builds earlier than 1.9.3.1021, fixed in version 1.9.3 HF3
• Acronis Backup extension for Plesk builds earlier than 1.8.11.638, fixed in version 1.8.11

The company has identified no specific indicators of compromise and did not disclose when the activity occurred or what attackers achieved beyond the privilege-escalation impact described by the advisory.

All affected users of Acronis backup integrations for cPanel & WHM and Plesk are recommended to apply the available updates immediately.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

security

Security firm Infoblox shines light on malicious infrastructure lurking beneath illegal gambling sites

If your employees are visiting Chinese-language gambling or adult sites, they may not just be wasting time and money, but potentially encountering serious malware hidden behind domains that look like mostly harmless entertainment at first glance.

A report from Infoblox urges the security community to pay closer attention to these websites, because some double as command-and-control (C2) infrastructure for espionage and malware distribution.

Zach Edwards, staff threat researcher at Infoblox, suggests security researchers and the media have ignored these sites because the story is complicated and confusing.

Infoblox says it tracks about 1.7 million Chinese-language casino websites that facilitate illegal gambling. These support North Korean money laundering and tax avoidance, among other dubious activities.

And these casino sites can be difficult to distinguish from one another. They tend to use variations of common templates in terms of design and function. Many operate like a legal casino would, just relying on the advantage of house odds to profit.

While these sites provide illegal gambling and adult entertainment for online visitors from China and Asia, some rely on US cloud providers for computing infrastructure.

“Major US hosting companies (Amazon, Microsoft, Cloudflare, and Google) continue to host infrastructure associated with these domains,” the Infoblox report explains. “One likely explanation is account theft at those providers, a practice documented previously as ‘infrastructure laundering.’”

That refers to hosting companies like Funnull that have reportedly rented IP addresses from Amazon Web Services and Microsoft and made those resources available to clients carrying out illegal activities.

According to a July 2026 report from the UN Office on Drugs and Crime (UNODC), disparate crime syndicates increasingly use common infrastructure for cybercrime, while online scams resulted in estimated losses of between $88.3 billion and $114.1 billion in 2025 across East Asia, Southeast Asia, Australia, and New Zealand.

A subset of casino sites offer scam gambling, or “scambling.” Visitors place bets but can’t get their money out if they win.

And then there’s a subset of sites used by China-aligned threat groups.

“China-aligned APT groups have been running the PeckBirdy framework since 2023, hiding their malware C2 domains inside low-quality Chinese-language casino websites,” Infoblox said.

PeckBirdy, as noted by Trend Micro researchers in January, is a script-based framework that attackers can load through compromised websites. In one campaign, attackers injected scripts into gambling sites that loaded PeckBirdy and displayed fake software update pages designed to entice victims to download malware.

The problem is that each of these three types of sites, though they change frequently, looks similar. Infoblox notes that just over 3 percent of its enterprise customers resolved at least one PeckBirdy C2 domain.

“The most important thing for defenders to do is stop ignoring casino domains,” Infoblox argues. “An alert on a Chinese-language casino or adult domain that gets closed as an employee browsing violation is precisely the outcome the PeckBirdy operators are counting on. The decoy works because the dismissal is reasonable – these domains genuinely are, most of the time, exactly what they appear to be.”

Security analysts who review suspicious network contacts are advised to check whether these casino domains include malicious payloads before closing the review ticket. ®

CEDIA Expo 2026 gave us plenty of expensive things to stare at in Denver. Our Best in Show selections included a $215,000 Alcons Audio home theater system with 38,000 watts of amplification, enormous MicroLED displays, premium projectors, new architectural loudspeakers and enough automation technology to make a reasonably well-equipped house feel somewhat inadequate.

The more important story, however, might be what actually pays the bills when nobody is standing in a darkened demonstration room watching explosions.

CEDIA’s newly released 2026 Professional US Smart Home Market Analysis, conducted with The Farnsworth Group, estimates the U.S. professional residential technology integration market at $33.8 billion, spread across approximately 23,000 establishments. And despite all of the attention being paid to AI, video walls and increasingly elaborate home theaters, the three largest categories are considerably less exotic; home networking, distributed audio and lighting/shading.

That is worth paying attention to because the numbers offer a much clearer picture of what the custom installation business actually looks like when you step away from the show floor.

Related Reading:

How Did CEDIA Arrive at $33.8 Billion?

The new study is based on 287 completed interviews conducted between May 26 and June 30, 2026, covering custom electronics integrators, security and alarm installers, home networking and IT professionals, electrical contractors, remodelers and general contractors involved in residential technology.

Respondents had to meet specific qualification requirements, including having influence over purchasing or installation decisions, spending at least half of their time working with A/V, networking or security, generating at least 21% of their business from residential projects and completing at least three residential technology installations during the previous year.

CEDIA and The Farnsworth Group then used reported residential revenue across 13 categories, weighting the results according to company size before scaling them against the estimated population of U.S. firms. Small companies were defined as having one to five employees, medium firms six to 20 employees and large firms more than 20.

That methodology is important.

CEDIA’s 2023 Professional Smart Home Market Analysis estimated the U.S. market at approximately $29 billion and roughly 20,000 integrators, but the earlier research used a different methodology that incorporated more than 1,000 integrators along with specification and sales pipeline data from D-Tools, Portal, manufacturers and distributors. Consequently, it would be misleading to simply subtract $29 billion from $33.8 billion and declare that the professional smart home industry grew by that amount over three years.

The new figure is better treated as a fresh benchmark.

Networking Is the Biggest Business

Home networking represents approximately 15% of the market, or $5.2 billion, making it the largest category measured in the study. Distributed audio follows at 11%, or $3.8 billion, while lighting and shading account for another 11%, or approximately $3.7 billion.

There is something wonderfully unglamorous about that.

A 20-foot MicroLED wall makes a much better photograph from CEDIA Expo than an equipment rack full of network switches, access points and Cat 6 cable, but the network has become the foundation underneath almost everything else in a modern connected home. Streaming audio, video distribution, lighting, security, automation, HVAC integration and increasingly AI-driven services become considerably less impressive when the network falls over during dinner.

The study reinforces that reality from another direction. Eighty-eight percent of firms reported installing home networking during the previous year, compared with 77% for integrated control systems and media rooms, 76% for distributed audio, 72% for security systems and 70% each for outdoor A/V and lighting/shading.

In other words, networking is no longer the plumbing sitting behind the exciting part of the installation.

It is the exciting part if you happen to be the person getting paid to install it.

Distributed Audio Is Still a $3.8 Billion Business

We spend a lot of time talking about two-channel high-end audio, active wireless loudspeakers, Dolby Atmos, soundbars and increasingly sophisticated home theater systems, but CEDIA’s research provides a useful reminder that distributed audio remains one of the largest segments of the professional residential technology market.

At approximately $3.8 billion, it trails only networking among the individual categories identified in the research. Whole-home integration projects also continue to revolve heavily around audio, networking and video, which CEDIA found were “always” or “frequently” included in the vast majority of projects regardless of company size, type or geographic region.

That also helps explain a lot of what we saw at CEDIA Expo 2026.

KEF expanded aggressively into outdoor audio, James by Sonance introduced loudspeakers designed to visually integrate with Samsung’s Frame televisions, Coastal Source continued combining outdoor sound and lighting, and Theory Audio Design demonstrated how the same core loudspeaker platform can be deployed across in-wall, in-ceiling, pendant, surface-mount and outdoor installations.

The market is not moving away from audio. Audio is simply appearing in more places and increasingly becoming part of a larger integrated system rather than a collection of black boxes occupying one corner of the living room.

Lighting Is No Longer the Side Business

Lighting and shading now represent approximately $3.7 billion of the market, virtually level with distributed audio, and integrators identified lighting as their largest business opportunity for the coming year.

That was impossible to miss in Denver. CEDIA added a dedicated lighting education track for 2026, and lighting, shading and control companies occupied considerably more oxygen at the show than they did a decade ago. CEDIA had already identified lighting as an expanding opportunity before the show, with education focused on system design, deployment, troubleshooting and building a profitable lighting practice.

For A/V dealers who still regard lighting as something electricians handle before they arrive with the speakers, the revenue numbers suggest it might be time to reconsider that division of labor.

AI Is Growing but Skilled Humans Remain the Bigger Problem

Artificial intelligence was attached to almost everything at CEDIA Expo this year, occasionally with good reason and occasionally because apparently every product announcement in 2026 requires an AI garnish.

The research suggests there is substance underneath some of the marketing. Seventy-nine percent of firms reported increased use of AI in their own business operations during the past year, while 58% reported an increase in customer requests for AI-related products or features. Larger firms and companies outside the traditional integrator category were more likely to report increasing customer demand.

But CEDIA also identified a considerably less futuristic problem that the industry has been struggling with for years.

Finding skilled employees was cited by 27% of respondents as their biggest business challenge, almost three times the percentage who selected either finding new clients or keeping current with technology, which were tied at 8%. CEDIA has been expanding its workforce development efforts for precisely that reason, including programs designed to connect the industry with technical schools and younger workers entering skilled trades.

AI might help an integrator write a proposal faster.

It still cannot crawl through an attic in July and terminate 40 network cables correctly.

Integrators Are Surprisingly Optimistic

The broader economic environment is hardly perfect. Housing activity has softened, construction material costs have increased and tariffs continue to affect the cost of some building materials and components.

Despite those pressures, nearly 78% of firms surveyed expect their revenue to increase during the next 12 months, while only 4% anticipate a decline. Companies expecting growth most commonly cited increased customer demand, followed by homeowners adding more technology and businesses expanding the products and services they offer.

How those customers arrive is equally revealing.

Direct client referrals remain the largest source of new business, cited by 76% of firms, followed by general contractors at 55%, interior designers at 25% and architects at 16%. For all of the money being spent on marketing platforms, social media and increasingly sophisticated lead generation, somebody telling their neighbor that the installer actually showed up on time and made everything work remains remarkably effective.

Technology may change quickly.

Human beings apparently still ask their friends who wired the house.

The Bottom Line

CEDIA Expo naturally directs attention toward the biggest screens, most elaborate theaters and newest automation platforms because those are the products people travel to Denver to see. CEDIA’s $33.8 billion market estimate tells a more useful story about where the business actually lives.

Networking has become the foundation of the modern connected home, distributed audio remains an enormous category, and lighting is now too large for traditional A/V integrators to treat as somebody else’s business. AI will increasingly influence both the products being installed and the companies installing them, but finding qualified people to design, install and support these systems remains a more immediate problem.

The six-figure video walls will continue getting the photographs.

The network rack, loudspeakers, lighting system and technician who knows how to make all of it work are still paying the bills.

Related Reading:

Kash Patel, director of the Federal Bureau of Investigation, told confused members of the Senate judiciary committee on Tuesday that new FBI hiring standards are aimed at protecting “victims of bestiality.”

Prior to the current administration, FBI policy was to bar applicants who had, among other things, hired sex workers, stolen from an employer, or engaged in bestiality. In August, CBS News reported that these standards had been relaxed and that multiple sources claimed “the FBI did so to facilitate hiring in some cases.”

According to a letter from Senate Democrats to Patel, new standards appear to have been quietly enacted as early as February 2025. They now allow for the hiring of someone who, for example, stole from an employer more than three years ago, or “paid for sex fewer than three times more than 10 years ago”—traditionally disqualifying because it carries blackmail risk—as long as they weren’t in a position of “public trust.”

But one change has captured more attention than the rest: A “history of bestiality or animal cruelty,” according to the letter, “is not automatically disqualifying under this new policy either, so long as the conduct occurred before the applicant turned 18.”

“You dropped automatic disqualification for applicants who have been engaged in bestiality,” said Senator Dick Durbin, an Illinois Democrat, during an oversight hearing Tuesday. “Not victims of bestiality, applicants who have been engaged. Do you disagree with that?”

“Applicants who have engaged in bestiality means they were victims of bestiality because they were forced to do so,” replied Patel. “At this FBI we are not going to criminalize and prevent victims from serving.”

In a further exchange, Patel explained to Senator John Kennedy, the Louisiana Republican, that previously, regulations had barred anyone who engaged in bestiality “on either side of it.”

“Either side of what, the bestiality?” asked Kennedy. “So you disqualified the animal?”

“We have great canines, but we’re not going to disqualify them,” said Patel.

Kennedy said that the change in standards had “really hurt the FBI.”

“Why would you even get into bestiality?” he asked.

“We’re not into bestiality,” said Patel.

In a response to a request for clarification from WIRED, the FBI sent a statement that suggests multiple individuals have been disqualified from applying for the agency because they were victims of human-trafficking-related bestiality.

“The FBI has and always will maintain the highest suitability standards for its applicants and employees in the US Government,” the FBI’s national press office said. “The changes you reference allow the FBI to consider applicants and consider the whole of a person in certain circumstances. For example, the FBI has had a number of applicants in previous years who suffered sexual abuse in their past, causing questions about prostitution, bestiality, or other similar issues to affect their background check process through zero fault of their own. Previously, those applicants would be barred from consideration. Now they can be considered. It is false to suggest criminal behavior like this is no longer disqualifying at the FBI—any applicant who has engaged in criminal sexual acts like those referenced would of course not be eligible for employment, and it is ridiculous to suggest otherwise.”

Under President Donald Trump, the FBI has lost a huge number of experienced personnel. The letter from Senate Democrats asserted that since the beginning of Trump’s second term, a “purge” carried out by Patel has led to the departure of “over 5,000 nonpartisan career personnel, all six former Executive Assistant Directors, and at least 18 Special Agents in Charge,” as well as more than a thousand special agents.

ai and ml

Pizza Bot runs locally and lets users interact with AI agents in an email-like interface. Perfect for blowing them off just like your human colleagues!

AWS engineers have published an open-source AI agent management tool that treats tasks and permission requests just like emails that fill up an inbox. 

Pizza Bot was announced on AWS’ open-source blog last week, where it was billed by its developers as a way to more easily manage agent tasks without having to constantly check a chat window to see if a task was completed or on hold because more permission was needed. 

“You don’t send an email and then sit watching the outbox until the reply lands,” the Pizza Bot team wrote. “Pizza Bot is shaped like an email client for the same reason: a thread is a unit of work you come back to rather than a session you have to attend.” 

Like the modern email services it mimics, Pizza Bot organizes communications with AI agents into message threads. Finished tasks, along with detailed result writeups you’d expect from a colleague you’ve delegated your work to, end up in the Unread category, while anything you need to make a decision on is shunted to the Action category. 

Asynchronous agent communication is likely to be a godsend for those balancing multiple tasks assigned to digital delegees, as the Pizza Bot team describes it. 

“Live chat assumes both parties are present, which holds for a quick exchange and breaks the moment a task takes several minutes,” the Pizza Bot maintainers wrote. Just like you don’t want to stare over the shoulder of the poor IT sod you sent off to do a task while you watch YouTube videos, no one wants to sit there and watch an AI agent do web research, or whatever.

“Pizza Bot treats an agent the way you’d treat a colleague who has gone off to do the work: it comes back when there’s something to read, or something only you can decide,” the PB team added. 

Internal tool goes open source

Pizza Bot, named for Amazon’s “two-pizza team” model (i.e., small, autonomous teams small enough to be fed by two pizzas), began life inside Amazon as an internal tool for AI agent uses other than software development.

According to its developers, non-coding uses they were exploring internally continually had the same requirements, namely working in the background autonomously and only bugging their user when they were done or had a question.

“None of those describe how anyone uses a chat window,” the Pizza Bot team explained. “They describe how people already work with each other.” Email, they added, was the perfect design paradigm for internal use, and seeing whether it would work for everyone else meant opening the project to open source contributions.

As mentioned, Pizza Bot is open source – you can snag a copy for Windows, macOS, and Linux from its GitHub repo. It runs on-device, stores all its communication threads locally in SQLite files, and doesn’t transmit anything off device unless you grant permission for it to do so. 

Prompts and attachments are sent to model providers, naturally, but even that’s not necessary: Pizza Bot also supports Ollama, allowing users to run compatible open-weight AI models locally. 

Pizza Bot doesn’t ship with a lot of capabilities, as its maintainers noted that Amazon-specific skills and MCP servers were left out when they rebuilt it as an open source project for public release. Out of the box, however, it can list, read, write, edit, and search files, delegate tasks to specialist agents, and run a sandboxed JavaScript interpreter. It also ships with a browser automation skill and a guide skill that lets users ask about Pizza Bot’s capabilities.

Claude Code-compatible .mcp.json files are supported and can be dropped straight in, as can skills, the team noted.

One word of caution to anyone who wants to try it: The devs make clear this is a piece of open source software, not an officially supported AWS product. “There’s no AWS support or service-level agreement behind it,” they note. If you’re gonna bake a pie with this bot, you’ve been warned. ®

3 business lessons from Tommy Pang’s F&B rollercoaster

You may know Tommy Pang, 29, as the second-gen owner of hawker brand Bai Nian, who has never been shy about airing his family’s business struggles on Instagram.

His parents started the original Bai Nian Niang Dou Fu yong tau fu stall in 2013. In 2017, the family expanded into Bai Nian Food Court, an eight-stall food court at ESR BizPark @ Chai Chee, which Tommy now runs alongside his sister as a challenge set by their parents.

It bled out about S$250,000 in seven months, but the family’s business woes have not been confined to the food court. His previous venture, pork leg rice chain Shi Nian, also lost S$500,000 after expanding rapidly, while his Cantonese restaurant Dudu was forced to shut its Eunos outlet just seven months after opening.

Unlike many founders who go quiet when business goes south, Tommy has been documenting it on Instagram—from losses to the day-to-day struggles of keeping the business afloat.

Here’s what business owners can take away from them.

1.  Growth without structure can backfire

Before the food court, there was Shi Nian, which opened at Albert Centre Market in 2019 and expanded rapidly to 30 outlets in just two years through franchising.

It’s the business Tommy was reflective about in an Instagram post in Sept 2025, where he revealed Shi Nian had lost half a million dollars in just six months. The post drew comments from customers pointing to shrinking portions as part of the problem, prompting Tommy to address the quality complaints publicly.

The problem, however, went beyond rapid expansion. It came down to a lack of systems and structure.

Tommy said his intention was to bring young blood into an ageing hawker trade and give first-time operators a foothold in the business.

But partnering with people who had never run a food stall before came with a major challenge: quality control. In 2025, about 20% of Shi Nian’s outlets were franchised, while the rest were self-operated, which made it harder to maintain consistent standards across the chain.

As outlets multiplied, standards slipped. When partners were unable to catch these issues, Tommy was left absorbing the losses.

“It was a hard lesson, but ultimately, my mistake. I could’ve created a better system,” he admitted.

For anyone looking to scale through franchising or partnerships, the lesson is simple: having the capital to open more outlets is not the same as having the systems to run them. Tommy eventually shut nearly 20 stores “overnight” after expanding without “a system, structure or strategy”.

2. Don’t let one location become too big a risk

Just seven months after opening, Dudu Cantonese Cuisine—a collaboration between Tommy and popular Guangzhou restaurant Zi Zhe Shi Tang—was forced to shut its Eunos outlet after the coffee shop operator decided not to renew its lease.

The concept was a new venture for Tommy, who had partnered with the restaurant to bring its Cantonese-style dishes to Singapore. But despite the relatively new outlet, the business had already committed significant capital to the space.

It had leased three adjoining stalls until 2028 at about S$10,000 a month and spent more than S$100,000 fitting out the premises, including installing a large industrial fan because the space suited the restaurant’s kitchen needs long-term. 

However, none of that mattered soon after, when the coffee shop’s own operator decided to stop running the premises altogether, and gave all seven tenants notice on Jun 21 that they had to vacate by the end of Jul, citing rising rental costs and declining footfall.

“I was completely stunned and could not react at all,” Tommy said. The business had been open barely six months, and more than 10 employees’ jobs were suddenly at risk.

Dudu eventually relocated to an industrial unit in Marsiling, reportedly spending around S$40,000 on the move, and used the relaunch to introduce new dishes alongside the existing menu. So far, it has kept things fresh with three menu changes in the last 10 months.

There was little Tommy could have done to prevent the closure. The lease, the money already spent and the plans for the space became irrelevant once the operator decided to shut the coffee shop.

But the experience highlights a different risk in F&B: how much of your business is tied to one location that you don’t control?

Due diligence can help you avoid a bad location or an unfavourable lease, but it cannot eliminate risks outside your control. What you can control is how much capital you put into a single site, how much time you need to relocate, and whether the business can survive the disruption.

For F&B operators, the ability to move quickly may be just as important as choosing the right location in the first place.

3. When the location can’t sell itself, marketing has to

Bai Nian Food Court had lost about S$250,000 in seven months, with one of its biggest problems being the lack of customers.

Footfall at ESR BizPark, where the food court is located, never fully recovered after the pandemic pushed office workers into remote work. Even after offices reopened, fewer workers returned to the area, leaving weekday lunchtime occupancy at the food court’s 400-to-500-seat space at just 10–20%.

This was enough to scare off prospective tenants before they’d sign a lease with Bai Nian Food Court.

When a Western food stall abruptly pulled out and forfeited its deposit, the Pang family tried but failed to bring in an Indian food operator to replace it. With no time left to properly research and develop a new concept, they scrambled to open a fried chicken cutlet rice stall themselves just to fill the space in the meantime, but it was short-lived, and the unit returned to being empty again. 

The family could not control the footfall around the business park, but they could try to make the food court more visible.

So Tommy leaned into social media as a lever. He started posting more regularly to promote the food court and reach customers who might not otherwise have a reason to visit. Tommy believed that sharing the story behind the food court helps create a connection with customers and build trust.

The food court also launched a free hot drink promo running through the end of Sept with any main dish purchase—kopi, tea, or yuan yang—with a S$0.50 top-up for iced versions.

Neither move is likely to transform footfall overnight. But when a location can’t provide enough organic traffic, marketing becomes less about simply promoting what’s there and more about giving people a reason to come.

For a struggling F&B business, that could mean telling a story customers want to follow, creating an offer worth travelling for, or consistently reminding people that you exist. The point is to create demand rather than wait for footfall to return on its own.

• Read other articles we’ve written on Singaporean businesses here.

Featured Image Credit: SG Food on Foot, Bai Nian Food Court via Instagram

The law will apply to social media and video sharing platforms, online games and AI chatbots.

The EU is set to unveil rules restricting social media for children under 15 as part of a new EU Kids Act.

The legislative proposal will be brought to the table this Thursday (17 September), a spokesperson for the European Commission confirmed.

Multiple news publications that viewed preparatory documents have reported that the Kids Act will apply to so-called “high-risk” social media and video sharing platforms, online games and AI chatbots. Educational tools would be excluded.

It intends to create a tiered system for under-15s on these platforms – with fully guardian-monitored accounts for children under 13, and moderate parental control and limits on screen time for children between 13 and 15.

Children older than 15 can set up their own accounts, according to the new law, which will also propose measures to educate parents, kids and guardians, the documents showed.

Child safety on social media has been hotly debated in recent years, as parents and lawmakers move to shield minors from the provable harms posed online by popular platforms.

Various EU countries – including France, Greece, Spain and Germany – are considering legislating on the topic, but the bloc hopes to address it at the highest level to avoid fragmenting rules in the single market and to standardise the level of access children enjoy across the region.

Earlier this year, a special EU panel on child safety suggested restricting social media for those under 13 until platforms demonstrate that their services are safe by design. The European Parliament, late last year, called for a harmonised EU digital minimum age of 16, and suggested parental consent be required for those between 13 and 16.

The upcoming Kids Act legislation is also expected to enforce its rules in a similar way to the bloc’s Digital Services Act (DSA), which utilises large financial penalties for non-compliant tech companies and oversight roles for national regulators. The DSA currently regulates issues around online platform safety and transparency in the bloc.

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.