The record is intact. The reading isn't.

Here is an uncomfortable observation. The industrial attack that should frighten plant people produced no ransom note, no downtime and no alarm. Attackers compromised supermarket freezer systems across Europe and quietly edited the setpoints — a few degrees, inside plausible ranges. Product sat out of spec, shipped anyway, and every dashboard stayed green while every monitoring record kept certifying compliance. I have spent two decades in automotive and aerospace quality building and signing off exactly these records — cure-oven logs, torque traces, plating-bath temperatures — and this is the attack that gets my attention. Ransomware takes a plant down and tells you immediately. Tampering lets the plant run and lies to you the whole time.

Why tampering beats ransomware

Walk the compromise the way an attacker reads it. I hold a Certified Ethical Hacker credential and a place on T-Mobile's public bug-bounty Hall of Fame for a clickjacking disclosure, and the first lesson of that work is blunt: attackers rarely break in. They log in. Reused vendor credentials on a building-management system. A remote-access portal whose password predates the machine it guards. Then the elegant part — they change nothing dramatic. A freezer setpoint nudged from −18 °C to −12 °C breaks no rule. Trips no limit alarm. The equipment faithfully holds the wrong temperature and reports that it is doing exactly what it was told to do.

That is why integrity attacks do more damage per decibel than availability attacks. Lock a plant with ransomware and you get a crisis, a war room, a recovery plan — costly but visible. Edit the setpoints and you get spoiled stock sold as safe, product released on records that were fiction, and recall exposure that surfaces months later with no forensic trail. The editing is also getting cheaper. Warnings on aviation OT exposure and new reporting that industrial AI adoption is outrunning OT security readiness make the same point from other directions. I design and deploy AI systems myself, and the first question in every design review is the same: what is this assistant allowed to write to? A networked copilot with write access to setpoints is a force multiplier for exactly this attack — plausible edits, at scale, by something that never gets bored.

Your audit trail now has an attacker in it

In food, the poisoned record is a HACCP critical control point. In automotive and aerospace it is the cure-oven log, the plating-bath temperature, the torque trace, the temperature and humidity of the CMM room. IATF 16949 and AS9100 auditors sample those records on one unstated assumption: that they are truthful. One edited sensor upstream poisons every record downstream — calibration records, release documentation, the certificates your customer files away as proof.

I learned the benign version of this failure the hard way, building a QA/QC department from zero for a 900-plus employee plant. A sensor only tells you what you asked it to. A temperature trace that sits perfectly flat is not evidence of a stable process; it can be evidence of a dead channel holding a sticky value. On one surface-treatment line we ran a QRQC and an A3 on a defect family whose root cause turned out to be slow thermal drift. The parameter log read "normal" for weeks, because the parameter was logged from the controller's own feedback. Output SPC on the parts eventually caught the shift. No attacker involved. Now give an adversary the means to edit the setpoint and the log together, and your evidence machinery becomes the cover story.

A green dashboard tells you what the sensor believes — not what the product lived through.

The worst part is legal, not technical. You inherit full recall exposure without any detectable quality failure, because the only artefact that could have caught the failure — the record — is the thing that was falsified.

Redundant, independent, deliberately dumb

The controls are unglamorous. That is exactly why they work.

• An off-network €15 datalogger strapped inside the freezer, the oven, the plating tank — read weekly, compared against the networked system. It is dumb as a bucket, and nobody hacks a bucket.
• SPC on parameters, not just outputs. Control-chart the oven temperature itself; drift and suspicious flatness are both signals.
• Alarm philosophy that watches rate and plausibility, not limits alone. A setpoint that changed three times this month, each time "within range", is an event.
• Write-once or append-only log storage, so the monitoring layer cannot edit what it reports — plus segmentation, so the building-management network never shares a segment with quality records.
• A PFMEA line for parameter integrity: "setpoint edited, no limit exceeded" as a named failure mode, with a detection control assigned to it.

Do the arithmetic. A datalogger plus ten minutes of reading a week costs less than €5. One quarantined truckload, one held plating batch, one oven lot recalled at an OEM's insistence — five figures before lunch, six if it reaches the certifying authority. Redundant logging is the cheapest insurance in the plant.

Quality people ask whether the record is true. Security people ask who can change it. Those are the same question now, and every regulated manufacturer should be asking it in the same meeting. The plants that survive the coming adversarial decades will not be the ones with the loudest alarms. They will be the ones whose paperwork still matches physics when somebody is actively trying to break the match.