Who checked your fridges last weekend?

On the night of October 11–12, attackers got into the refrigeration controllers at hundreds of French supermarkets. They switched units into defrost mode, and temperatures reportedly reached as high as 50°C (AP, CBS News). Le Monde reported that attackers also extended some defrost cycles from one hour to eight, delaying alarms that would normally alert staff (TIME).

By morning, stores were throwing out stock. Some reported fires. Early estimates put losses in the millions of euros, and investigators are still working out who was responsible.

It started as a cyberattack. It ended in cold rooms on a weekend.

So here’s the question: if a critical system on your sites failed tonight, who would know, and what would happen next?

The convergence gap

Responsibility for connected equipment can span cybersecurity, facilities and physical security. The risk is in the handoffs: who receives an alert, who checks the asset and who owns the response?

The attack highlights why those teams need to evaluate the risk together. A digital compromise can produce physical damage, and the response needs to connect what the systems report with what people can verify on site.

The most complete strategies are closing that gap with technology plus human oversight: digital sensors to detect, and people on the ground to verify, act and document.

Sensors detect. People verify.

Here’s what that looks like in practice:

1. A sensor detects a problem. An IoT temperature, power or leak sensor sends an alert to the security operations center (SOC).
2. The SOC dispatches someone. A patrol officer or on-site staff member is sent to the asset.
3. They verify and act. They check the conditions in person, follow the site procedure and escalate to the right owner.
4. Everything is documented. The alert, the response, the reading and the outcome sit in one record.

When an alert doesn’t arrive, because monitoring fails, settings are manipulated or an asset isn’t monitored, scheduled patrol checks can provide another opportunity to detect a problem. A guard using an independent thermometer can document both presence and the condition observed at that moment.

Neither layer is enough alone. Sensors can be tampered with or fail quietly. Patrols can’t be everywhere at once. Together, they create a verified record for your most critical assets.

It’s not just supermarkets

• Corporate campus: a sensor flags the staff restaurant’s cold storage on a Saturday. The SOC dispatches an officer, who confirms the issue and escalates to facilities before the food is served on Monday.
• Healthcare: a medication fridge reads out of range overnight. Security doesn’t decide whether the stock is safe; they verify the reading and escalate quickly to pharmacy or clinical staff who do.
• Food distribution: a reefer trailer loses power between shifts. A sensor alert or a scheduled yard check can catch it before the load ships.
• Manufacturing: temperature-sensitive materials sit through a weekend shutdown. Sensor alerts and patrol checks aligned with your quality procedures can flag a problem before it hits inventory or production.
• Data centers: a cooling alert fires, or a patrol notices an unusual temperature or a leak. Either way, it is routed straight to the technical team.

Your guards don’t need to become refrigeration engineers. They need to know what to check, what counts as a problem and who to call.

Three questions for your team this week

1. Do your cyber, facilities and security teams look at these risks together? If a controller is compromised, who would notice, and would they tell the people on site?
2. What does each layer check? Know which assets have sensors, which have patrol checks, and which have both. For patrols, define the reading, the method and the acceptable range, and make sure it doesn’t depend on the system you’re verifying.
3. Who acts when something’s wrong? Every alert or exception needs an owner, a dispatch path and a backup contact if the first person doesn’t answer.

A reading that sits in a report until Monday doesn’t help with a problem unfolding on Saturday night.

Turn alerts into action, and action into evidence

A useful response ties together four things: the asset, the reading, the time and what was done about it. That record helps your team act in the moment, and later it can support investigations, audits and insurance claims.

The next failure on your sites might start with a hacker or a broken compressor. Either way, you need more than an alert, and more than proof that someone walked past.