Cybersecurity Liability After the Supermarket Freezer Attacks: Why the Second Wave Will Be Judged Against the Firs

Cybersecurity liability for the supermarket freezer attacks that hit France in October and northern Europe on 1 November 2026 will turn on what each operator did in the three weeks between the two waves, and the questions it raises, from NIS2 scope to food law and insurance, must be answered in the usual emergency, just as CRA reporting, national cyber laws and the new product liability regime land on the same companies.

On the night of 11 to 12 October 2026, attackers reached the refrigeration controllers of French supermarkets and switched them into defrost mode, pushing some units to 50 degrees, and the French government later put the toll at around 700 of the country’s 10,000 supermarkets. The national cyber agency urged operators to disconnect the exposed controllers and the Paris prosecutor opened an investigation. I analysed the duties exposed by that first wave in Connected Products Under Attack.

Three weeks later the same mechanism reappeared in Belgium, Luxembourg, Sweden and Estonia and, according to Bloomberg, Ireland and Finland. The damage is still being assessed, but the legal position of the November victims is already very different from that of the October ones.

The three weeks that decide cybersecurity liability

The contractor running the refrigeration of Delhaize and other Belgian chains blamed a cyberattack, a Belgian installer said that most of its customers had moved to secure connections after the French attack, and ICA confirmed that the Swedish stores hit were those operating outside its central network. Researchers had already published, in August, vulnerabilities in the Danfoss and Copeland platforms, and many units in the field are end of life with no patch available.

Read together, these statements show that an industry-wide remediation took place after October, that most operators completed it, and that the November casualties were largely those who did not. Before 12 October an attack on refrigeration control could fairly be called unforeseeable, while today any assessment of whether an operator took appropriate measures runs against a public warning issued three weeks before the loss, and against evidence of what comparable operators did with those weeks.

The attackers did not even need malware, since they issued a legitimate command to a system designed to accept it, and this matters because a product performing its documented function is not obviously defective, while insurance wordings are largely written around malicious code.

NIS2 and the Cyber Resilience Act: where cybersecurity liability falls between two regimes

The two pillars of EU cyber law were not drafted with the supermarket cold room in mind, and the gaps show at three levels.

• Scope attaches to the entity, not the group. The food sector in Annex II of the NIS2 Directive covers wholesale distribution and industrial production and processing, so store-level retail generally sits outside it, while the distribution centres of the same group often qualify. A group can therefore hold NIS2 duties in one company, run the compromised stores from another, and discover the boundary while drafting a notification, an issue that national authorities are already testing.
• Retailers can enter NIS2 through other doors. Digital services offered to third parties or energy supplied to customers can bring a retail group within scope, so several victims may well have been inside the perimeter after all.
• Legacy equipment still triggers manufacturer reporting. Under the Cyber Resilience Act, manufacturers have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026, starting with a 24-hour early warning, and the duty covers products already on the market, even though the essential requirements only apply to products placed on the market from 11 December 2027.

Whether a CRA report was owed depends on whether a vulnerability was exploited or an exposed interface simply abused, and the facts remain unclear, since a government source spoke of a flaw in Danfoss software while the agency confirmed that controllers from two other vendors were also targeted. The operator cannot see whether its vendor filed a report, and that filing is the dated record fixing what the operator ought to have known and when.

Food law reaches what cybersecurity law does not

Regulation (EC) No 852/2004 prohibits keeping food at temperatures that could create a health risk and requires that the cold chain not be interrupted, with no cybersecurity threshold and no size filter, and the General Food Law requires an operator with reason to believe its food is unsafe to withdraw it, inform the authorities and, where necessary, recall it, with a lighter regime for retailers that do not alter packaging. Spoiled stock is visible to any shift manager or customer, so the food inspector usually arrives before the cyber regulator, while most incident response plans assume the opposite.

Allocating cybersecurity liability between retailers, manufacturers and contractors

The operator’s main claim runs against whoever supplied, installed or remotely maintained the compromised system, and it will largely be contractual. The new Product Liability Directive, applying to products placed on the market from 9 December 2026, treats software as a product and links defectiveness to cybersecurity and security updates, but it excludes property used exclusively for professional purposes, so it will not pay for spoiled stock, although it will shape consumer claims and the standard courts borrow when assessing negligence.

Maintenance agreements typically cover response times and spare parts, ignore remote access, patching and end-of-life notice, and allocate the risk of an attack by not mentioning it. Boards, for their part, carry cybersecurity oversight as a governance duty, yet nobody owns the refrigeration estate at group level, so the choice between restoring and preserving evidence falls to whoever stands in front of a warm cabinet at two in the morning.

Cyber insurance and the gap between two wordings

I am not an insurance lawyer, but standalone cyber policies generally exclude physical damage to tangible property, which sends the spoiled stock to the property programme, where a matching cyber exclusion is often waiting. An overnight event rarely crosses a business interruption waiting period of eight or twelve hours, and contingent cover usually requires the controller vendor to be scheduled as an outsourced provider, which it almost never is. Proposal forms describing the corporate network rarely describe the operational estate accurately, and the October warning now gives underwriters a benchmark for arguing that minimum security conditions were not met.

What businesses should do now to address potential cybersecurity liability

The sequence matters more than any single argument, because several steps foreclose each other. For companies already hit, the first 72 hours should cover the following:

1. Preserve evidence before restoring. One forensic image serves the regulatory file, the coverage claim and the supplier recourse, and an Italian court recently left half of a ransomware loss with the client, partly on evidential grounds.
2. Notify the insurer before appointing advisers. Notification is usually a condition precedent, and policies often require pre-approved counsel and forensics.
3. Map legal entities against jurisdictions. Reporting clocks run per Member State and per entity, and food authorities belong on the map alongside cyber regulators, which for a group in five countries can mean a dozen parallel deadlines.
4. Decide on reporting with a pre-agreed methodology. Reportability under NIS2, the CRA and food law should not be assessed from scratch at night, and each filing should be drafted defensively, as the first exhibit of a future dispute.
5. Write to the vendor on day one. A request for CRA filings, firmware versions and remote access logs sent the day after the incident reads as diligence, while the same request three weeks later reads as claim preparation.
6. Keep one master chronology. Regulatory filings, the insurance claim and the supplier recourse will run in parallel, in different languages, before readers who will compare them, so a single chronology owned by counsel should be checked before each submission.

For companies not yet hit, including retailers in Italy, Spain and the other markets named in the October reports, the clock started on 12 October, and each of the following steps should be documented with a date:

1. Take OT management interfaces off the internet. Inventory every controller reachable from outside, place it behind secure access and record when this was done.
2. Reopen the maintenance contracts. Add remote access rules, patching and end-of-life commitments, disclosure of CRA reports and liability caps that do not swallow security failures.
3. Test the insurance programme against this scenario. Ask the broker which policy pays for stock spoiled by a cyberattack, and correct proposal answers that describe only the corporate network.
4. Assign ownership and rehearse the decision. Name the executive who owns the refrigeration estate and decides between preservation and restoration, and run a cross-border tabletop exercise, as AI agent incidents are already forcing companies to do for decisions they never expected to take.

The November victims will be measured against what the market learned in October, and the next operator to be hit, in whichever European country the attackers choose, will be measured against both waves, which makes the coming weeks the cheapest moment to build the record.