Cybersecurity liability for the supermarket freezer attacks that hit France in October and northern Europe on 1 November 2026 will turn on what each operator did in the three weeks between the two waves, and the questions it raises, from NIS2 scope to food law and insurance, must be answered in the usual emergency, just as CRA reporting, national cyber laws and the new product liability regime land on the same companies.