Freezers went offline, and the logs went with them

When the fridge is also the witness

CERT-SE confirmed in November 2024 that connected freezer and cooling systems had been hit by a cyberattack ^[1]. The incident itself is straightforward: someone got in, and systems went offline. The interesting part is what happens next.

Think of it like the black box on a plane. When something goes wrong, the box tells you what happened. Except in this case, the black box is sitting inside the plane, and the plane is what stopped working. If the logs are kept on the system that was compromised, and that system went offline, you're left trying to piece together the timeline from whatever survived.

What the Cybersecurity Act asks for

The Swedish Cybersecurity Act, which implements NIS2, has been in force since 15 January 2026 ^[2]. It covers essential and important entities in 18 sectors, including energy, transport, healthcare and digital infrastructure.

When a significant incident occurs, the organisation has three reporting steps, each with a short deadline. An early warning goes to the supervisory authority within 24 hours of becoming aware of the incident. An incident notification follows within 72 hours, with details of what happened. A final report is due within a month ^[2].

The clock starts when the organisation becomes aware, not when it finishes investigating. That distinction matters when logs are incomplete or when the systems that hold them are offline.

The evidence question nobody asks early enough

A supervisor reviewing an incident report will want to know what happened, when the organisation first knew about it and whether the deadlines were met. If the logs are gone, that conversation gets harder.

Logs are like receipts: nobody looks at them until there's a dispute. When freezer systems go offline and take their logs with them, the question becomes whether the organisation can show when it detected the breach, escalated internally and sent the early warning.

The Act doesn't say how logs must be kept, only that the organisation must have risk management in place and report incidents ^[2]. It is fair to assume that a regulator asking for an incident timeline will expect something more solid than a spreadsheet put together afterwards.

What this means for you

If your organisation relies on connected systems, three questions are worth asking now, not after an incident:

• Where are the logs kept, and can they survive if the system goes offline?
• If a breach happens at 3 a.m. and is noticed at 9 a.m., could you show when the first detection occurred?
• When you send an early warning or an incident notification, do you have a record of when it was sent that nobody can quietly rewrite?

The deadline clock runs from awareness, and awareness is something you have to be able to show.

Logs that hold up when the system doesn't

This is where a digital witness fits.

The thing to seal is log segments at short intervals, for example every few minutes. The fingerprint goes to WitniumChain through the REST API, the SDK or the MCP server, not the logs themselves. The logs stay on your systems.

If the system goes offline, the sealed fingerprints remain. When an auditor or a supervisor asks whether anyone with administrator rights edited the access log during the incident, you can show that each segment is exactly what was written at the time, even if the system itself was compromised.

A witness doesn't replace access control, monitoring or backups. It gives you a record that holds up under scrutiny, separate from the systems being scrutinised.

How it would work

1. Log segments are sealed continuously as they close.
2. When an incident occurs, you check each segment's fingerprint against the sealed record.
3. If they match, the log hasn't changed. If they don't, the change shows.

The first 2,000 witnesses a month are free. Read the docs or get started at witniumchain.com.

What to watch

The Cybersecurity Act is in force, and the Cyber Resilience Regulation's reporting requirements took effect on 11 September 2026, with the product requirements following on 11 December 2027 ^[3][4]. Between them, they cover a broad sweep of organisations and products.

If you make or operate connected systems, the reporting deadlines are short and the expectations are clear. The logs you keep now are the logs someone will ask for later.