Some weeks the news feels like it was written by a governance consultant with a sense of humour. This was one of them.
On one side of the Atlantic, millions of people voted, and then everyone waited while the counting, checking and certifying ground on at its own careful pace. On this side, supermarket freezers across Europe quietly turned themselves into ovens, and a lot of people asked a very reasonable question: why does a fridge need the internet in the first place?
One story is about the future of a nation and the other is about a lot of spoiled fish fingers. But underneath, they're asking the same thing: who's in charge, and how do we know we can trust the system?
The fridge that nobody was watching
The facts first. Early this week, supermarkets in at least half a dozen European countries, including Sweden, Belgium, Ireland and Italy, found their fridges and freezers warming up after the control systems were taken over remotely. Millions of euros' worth of food was spoiled. It followed a similar attack on French and Dutch retailers only weeks earlier (AP via PBS).
The way in was hardly sophisticated. Experts pointed to internet-facing controllers, firmware that was past its end of life, and default passwords nobody had changed. The head of the UK's National Cyber Security Centre said the French units had been connected straight to the internet with their factory passwords still in place. One of the targeted control systems had reportedly had a security advisory out since May 2025 (Scientific American).
To be fair to the fridges, there's a good reason they're online. Remote monitoring saves money, cuts waste and means someone gets an alert at 3am instead of discovering a disaster at 7. Connection isn't the problem. The problem is that nobody treated the fridge as part of the IT estate. It looked like an appliance, so it was governed like one: bought, installed, and forgotten.
Meanwhile, the count goes on
We're not here to talk about who won the US midterms. Whatever your politics, this was a week that showed how much rests on process.
On Tuesday night the projections started rolling in, along with a great deal of noise. But the result that counts isn't what's said on election night. It's the one that emerges after every eligible ballot is counted, checked and certified, on a timetable set out in advance by each state's own rules. Some states have to certify within weeks; California has until 11 December.
That slow, slightly unglamorous machinery is what lets people accept an outcome they didn't vote for. Trust doesn't come from the speed of the answer or the confidence of whoever is announcing it. It comes from a process that is known in advance, applied consistently, and open to being checked.
Which, if you've ever sat on a board, should sound familiar.
Closer to home: when the website just vanishes
There was a homegrown version of the story too. From 28 October, hundreds of GP practices in England and Wales found their websites had disappeared, along with the online consultation forms patients use to get in touch. The cause wasn't a hacker. Their website provider, Silicon Practice, had gone into administration, and GPonline reported up to 600 practices were affected (GPonline). NHS England asked practices to set out their business continuity plans to their ICBs.
A week earlier, a pair of critical flaws in PHP, the code behind roughly 70% of the world's websites, had cyber agencies urging organisations to patch immediately or take vulnerable sites offline (CISA). Different causes, same lesson: the digital front door to your service depends on people and code you may never have met.
What this means for healthcare providers
Here's where the fish fingers get serious. Every clinic, hospital and care service has its own fridges, and they hold vaccines, insulin, blood products and temperature-sensitive medicines. Many are now monitored remotely. So are building management systems, theatre air handling, nurse call systems, door access and the infusion pumps on the ward - sometimes even the defibrillators.
If a supermarket freezer warms up, you lose stock. If a medicines fridge warms up overnight and nobody notices, you may not know which doses are still safe, and patients may already have received them.
So, in the spirit of the week, a few Friday questions for your next governance meeting:
• Do we know what's connected? Not just laptops and servers, but fridges, pumps, monitors and building systems. If it isn't on an asset register, nobody is governing it.
• Who owns it? Estates bought it, pharmacy relies on it, IT has never heard of it. Assets that belong to everyone tend to belong to no one.
• Have the default passwords been changed, and is the software still supported? These are dull questions, which is exactly why they get skipped.
• What happens if a supplier disappears overnight? Do we own our domain and our content, could patients still reach us tomorrow, and is that written into the business continuity plan?
• What happens when it fails? Is there a manual check, an alarm that reaches a real person, and a clear rule for quarantining stock when a temperature breach can't be ruled out?
• Would we hear about it? A good reporting culture covers the boiler room as well as the ward.
The election lesson applies too. Patients, staff and regulators trust your outcomes because your processes are known, consistent and checkable, not because someone in the meeting sounded confident. That goes for an incident review, a complaint response, and the temperature log on the fridge.
A hopeful note for the weekend
It would be easy to end the week thinking everything is fragile, from democracies to dairy aisles. We'd suggest the opposite.
Both stories are, in their own way, reassuring. The fridge attacks got in through gaps that are well understood and cheap to close: change the password, update the firmware, know what's plugged in. Nobody needs a quantum computer to fix this, just a list and someone who owns it. And the long, patient count is a reminder that good process is designed to outlast a noisy night.
That's the quiet promise of governance. It isn't glamorous, and it rarely makes the headlines unless it's missing. But it's what lets people trust the result, whether that's an election, an inspection, or the insulin in the fridge.
Have a lovely weekend. And perhaps, before you head off, ask someone when the password on the medicines fridge was last changed.
