On 12 October 2026, hackers remotely deregulated the temperature-control systems of connected refrigerators in hundreds of supermarkets across France, heating cabinets and destroying fresh and frozen stock. According to TF1, at least 150 stores of one retail network and nearly a hundred of another were hit, the cybercrime section of the Paris prosecutor’s office took up the case across the whole French territory, and the anti-cybercrime office was tasked with listing victims and linking the reported damage in terms of food losses and fire outbreaks. Some cabinets reportedly heated toward 50C for about six hours overnight, one ice-cream freezer displayed 26.5C on Monday morning, and two stores in eastern France alone reported combined losses of 270,000 euros, as reported by the BBC relying on trade and local media. According to TF1, the affected networks stated that all compromised food would be destroyed to avoid health risks.
At the date of writing, no court has established how the intrusion happened, who is responsible for it, or who must ultimately bear each part of the loss. The facts below are reported from the press sources cited; what those sources do not say is written in the conditional. Signed contracts — franchise or cooperation agreements, supply contracts, insurance policies — prevail over any general analysis, and only a court decides liability. This article is written for the independent operator running a store inside a French retail network, including British owners and investors in France: it explains how to protect the insurance claim, what duties apply when clearing and restocking, what can be asked of the network head and the supplier, and how the criminal complaint route works.
Readers who shopped in the affected stores as customers, rather than operators, will find the consumer refund and food-poisoning route explained in our companion article on food poisoning, refunds and compensation for British shoppers.
I. Protecting the business in the first days: insurance cover and evidence
A. How do you notify the insurer and prove hundreds of thousands of euros of destroyed stock?
The first reflex of an independent store operator is to clean up and reopen. The first legal reflex should be to freeze the evidence of the loss, because an insurer pays documented loss, not described loss. Photograph every affected unit with its temperature display visible, keep the automatic temperature logs from the refrigeration supervision software, retain delivery slips and stock records showing what the full cabinets contained, keep the slips or certificates for every destroyed batch, and keep the invoices for emergency measures such as refrigerated lorries, overtime and replacement stock. Ask the insurer immediately whether it appoints its own loss adjuster and whether an independent assessment should be organised jointly before anything is repaired or discarded. Most business policies impose short notification deadlines, and missing them can complicate payment even where the loss itself is undisputed.
Two provisions of the Insurance Code frame the discussion. Article L121-1 of the Insurance Code states: “L’assurance relative aux biens est un contrat d’indemnité ; l’indemnité due par l’assureur à l’assuré ne peut pas dépasser le montant de la valeur de la chose assurée au moment du sinistre.” (Insurance of property is a contract of indemnity; the indemnity owed by the insurer to the insured cannot exceed the value of the insured thing at the time of the loss.) In plain terms, the operator is compensated for the value of the destroyed goods at the time of the incident, not for hoped-for resale margins, and the accounts must therefore separate the cost price of the destroyed stock from the lost profit on it. Lost profit is only covered if the policy contains business-interruption cover (perte d’exploitation), which reimburses the margin lost during closure or reduced trading within the limits and waiting periods of the contract. Additional expenses incurred to keep trading, such as renting refrigerated equipment, may fall under an additional-cost extension where one was purchased.
The sensitive point is the cyber exclusion. Article L113-1 of the Insurance Code provides: “Les pertes et les dommages occasionnés par des cas fortuits ou causés par la faute de l’assuré sont à la charge de l’assureur, sauf exclusion formelle et limitée contenue dans la police.” (Losses and damage caused by fortuitous events or by the fault of the insured are borne by the insurer, except for a formal and limited exclusion contained in the policy.) An insurer relying on a cyber or computer-attack exclusion would therefore have to point to wording that is both formal and limited; a vague reference to computer incidents spread across general conditions would be open to challenge. The second paragraph of the same article adds that the insurer does not cover loss arising from the intentional or fraudulent fault of the insured, which in this affair works in the operator’s favour: the store owner is the victim of the attack, not its author. The Cour de cassation applies this paragraph strictly against insurers. In a judgment of 20 January 2022 (Second Civil Chamber, no. 20-13.245, official text), it held: “La faute dolosive s’entend d’un acte délibéré de l’assuré commis avec la conscience du caractère inéluctable de ses conséquences dommageables.” (Fraudulent fault means a deliberate act by the insured, committed with awareness of the inevitable nature of its damaging consequences.) Nothing reported about the supermarket affair suggests any deliberate act by the store operators, so this exclusion should not concern them; it is mentioned here so that operators recognise it if an insurer raises it.
Operators should also check three extensions that are often overlooked. First, product-spoilage cover (denrées périssables), sometimes limited to accidental breakdown of equipment, whose wording must be read to see whether a malicious remote command counts as breakdown. Second, the additional-cost and business-interruption sections, with their waiting periods and accounting requirements. Third, legal-expenses cover (protection juridique), which may fund the criminal complaint and the civil-party claim described in Part II. Where several policies could apply — the operator’s own policy, a group policy purchased by the network head, the equipment supplier’s liability policy — notify all of them within their deadlines and let them sort out contributions between themselves; notifying one insurer never excuses missing the deadline of another.
B. What must you do with the unsafe food, and can you simply close while waiting?
Food that has spent hours at 26C or 50C cannot be put back on sale, however costly its destruction feels. French law states a general safety duty: Article L411-1 of the Consumer Code provides: “Dès la première mise sur le marché, les produits et les services doivent répondre aux prescriptions en vigueur relatives à la sécurité et à la santé des personnes, à la loyauté des transactions commerciales et à la protection des consommateurs.” (From first being placed on the market, products and services must comply with the rules in force on the safety and health of persons, fair trading and consumer protection.) European food law points the same way: Regulation (EC) No 178/2002 (OJ L 31) prohibits placing unsafe food on the market and expects operators that suspect non-compliance to withdraw the product immediately and to inform consumers accurately where products may have reached them; dangerous-product alerts are centralised in France on the official portal RappelConso. One network stated through the press that it had thrown all affected food away to avoid health risks, which is exactly what the safety duty expects. Keep the destruction records: they prove compliance with the withdrawal duty and they quantify the stock loss for the insurer in the same gesture.
Closing the store entirely while waiting for repairs feels natural but carries its own risks. The franchise or cooperation agreement usually contains opening-hours and continuity obligations, and the commercial lease usually requires continuous operation too; an operator who closes for weeks without written agreement from the network head and the landlord may face contractual claims on top of the hack. The better route is to agree temporary measures in writing: partial opening of the unaffected departments, shortened hours, or a jointly recorded temporary closure where the premises genuinely cannot trade safely. Article 1218 of the Civil Code defines force majeure in contract matters as follows: “Il y a force majeure en matière contractuelle lorsqu’un événement échappant au contrôle du débiteur, qui ne pouvait être raisonnablement prévu lors de la conclusion du contrat et dont les effets ne peuvent être évités par des mesures appropriées, empêche l’exécution de son obligation par le débiteur.” (There is force majeure in contract matters where an event beyond the debtor’s control, which could not reasonably have been foreseen when the contract was concluded and whose effects cannot be avoided by appropriate measures, prevents the debtor from performing the obligation.) A large-scale remote attack on refrigeration software would be a serious candidate for that definition, but it is the court that would decide, contract by contract, and force majeure excuses non-performance toward the other contracting party — it does not by itself create a right to be paid. Operators should therefore invoke it as a shield in writing where continuity obligations are at stake, while pursuing payment through the insurance and liability routes, and they should take all reasonable steps to limit the loss, since a failure to mitigate can reduce compensation.
Staff safety during the clean-up deserves the same written discipline: hot cabinets, slippery floors from defrosted units, heavy lifting of destroyed pallets and electrical equipment behaving abnormally. Record the instructions given, the protective equipment provided and any incident, however minor, because these records protect both the team and the business if an employee later reports an injury.
II. Who answers for the loss: the network, the software supplier and the hackers
A. What can the store operator ask of the network head and the refrigeration supplier?
In French food retail, most stores carrying a national banner are run by independent operators bound to the network by a franchise, affiliation or cooperation contract. That contract, not general principles, decides who maintains the refrigeration software, who chose the supplier, who can push updates, and who assists whom in a crisis. The operator should therefore reread three sets of clauses before writing to anyone: maintenance and IT clauses, assistance and supply clauses, and insurance clauses, including any group policy purchased centrally. Where the network head selected the refrigeration-management software, organised its updates, or retained remote administration rights, the operator would have serious grounds to ask the network to take charge of the technical response, to organise the joint assessment of losses across stores, and to confirm in writing how destroyed stock will be replaced and on what payment terms. Where the contract instead leaves IT to each store, the operator should still notify the network head immediately, because coordinated action across hundreds of stores strengthens everyone’s position toward the supplier and the investigators.
French statute supports operators at the pre-contractual stage, which matters for recent joiners. Article L330-3 of the Commercial Code requires anyone making a trade name, brand or sign available while demanding exclusivity to provide, at least twenty days before signature, “un document donnant des informations sincères, qui lui permette de s’engager en connaissance de cause” (a document giving truthful information, enabling the other party to commit with full knowledge of the facts), covering among other things the network’s situation and prospects. An operator who joined shortly before the attack and was never warned of known vulnerabilities in the imposed equipment could invoke that provision, although courts assess such claims case by case and the operator would have to prove what the network knew and when.
Against the supplier of the refrigeration-management software, claims would be built on contract and on general civil liability, and both routes are conditional at this stage. According to The Guardian, the national agency identified a vulnerability in software supplied by a Danish company, and that company stated it was aware of incidents in France affecting a limited number of refrigeration-management systems, adding that the affected units were running outdated firmware and that it had long advised customers to update firmware and migrate legacy systems. If that account is confirmed, liability would turn on precise technical questions: who was contractually responsible for installing updates, whether the supplier warned each operator clearly, and whether a widely deployed remote-management function lacked reasonable safeguards. Article 1240 of the Civil Code states: “Tout fait quelconque de l’homme, qui cause à autrui un dommage, oblige celui par la faute duquel il est arrivé à le réparer.” (Any act whatever of man which causes damage to another obliges the one by whose fault it occurred to repair it.) A fault by the supplier, a causal link to the spoiled stock, and a quantified loss would therefore be needed, each proved rather than assumed.
Two practical warnings apply while these claims are prepared. First, preserve the equipment and its logs: do not reflash, reset or replace the affected controllers before the insurer’s adjuster and, where relevant, the investigators have recorded their state, because a wiped log helps nobody except the hackers. Second, coordinate with the official investigations rather than duplicating them. European cybersecurity law is moving toward fast, staged incident reporting: Directive (EU) 2022/2555 on a high common level of cybersecurity (NIS2, OJ L 333) sets a 24-hour early warning, a 72-hour incident notification and a final report within one month for designated essential and important entities. In France, transposition is still under way: ANSSI states that that it is piloting the transposition of the Directive into national law and ensuring its implementation, while transposition in France is still under way. Whether each retail network will fall within the scope depends on that transposition, but the direction is clear: notify the authorities fast, in writing, through counsel, and keep copies of everything sent.
B. How does the criminal complaint route work for a business victim, and what can it bring?
Alongside insurance and civil claims, the operator is the victim of computer offences, and French criminal law treats such conduct severely. Article 323-1 of the Criminal Code provides: “Le fait d’accéder ou de se maintenir, frauduleusement, dans tout ou partie d’un système de traitement automatisé de données est puni de trois ans d’emprisonnement et de 100 000 € d’amende. Lorsqu’il en est résulté soit la suppression ou la modification de données contenues dans le système, soit une altération du fonctionnement de ce système, la peine est de cinq ans d’emprisonnement et de 150 000 € d’amende.” (Fraudulently accessing or remaining in all or part of an automated data-processing system is punished by three years’ imprisonment and a 100,000 euro fine. Where this has resulted in the deletion or modification of data in the system, or an alteration of the functioning of that system, the penalty is five years’ imprisonment and a 150,000 euro fine.) Forcing refrigeration controllers to heat to 50C would, if proven, look like an alteration of the functioning of an automated data-processing system, which would point toward the five-year bracket, but only the courts can qualify the facts. Article 323-3 of the same Code adds: “Le fait d’introduire frauduleusement des données dans un système de traitement automatisé […] est puni de cinq ans d’emprisonnement et de 150 000 € d’amende.” (Fraudulently introducing data into an automated data-processing system … is punished by five years’ imprisonment and a 150,000 euro fine.) Sending malicious commands to hundreds of controllers could therefore fall under several overlapping qualifications, which the prosecutor, already seised in Paris according to the press, will have to sort out.
The Cour de cassation interprets these offences broadly in favour of victims. On 2 September 2025 (Criminal Chamber, no. 24-83.605, published in the Bulletin, official text), it held: “En effet, se rend coupable de l’infraction prévue par l’article 323-1 du code pénal celui qui se maintient dans un système de traitement automatisé de données en prenant connaissance du contenu des messages échangés au sein du réseau, à des fins étrangères à sa mission et à l’insu des titulaires des messages, même si, administrateur du réseau, il bénéficie, de par ses fonctions, d’un droit général d’accès à la messagerie.” (Indeed, a person is guilty of the offence under Article 323-1 of the Criminal Code where they remain in an automated data-processing system while reading messages exchanged on the network, for purposes unrelated to their duties and without the knowledge of the message holders, even where, as network administrator, they enjoy by virtue of their functions a general right of access to the messaging system.) If even a duly authorised administrator commits the offence by exceeding their mission, outside hackers acting with no authorisation at all would have little room to dispute the fraudulent character of their access, once identified.
For the operator, the criminal route matters less for the prison sentence, which benefits society, than for compensation. Article 2 of the Code of Criminal Procedure provides: “L’action civile en réparation du dommage causé par un crime, un délit ou une contravention appartient à tous ceux qui ont personnellement souffert du dommage directement causé par l’infraction.” (The civil action for compensation of damage caused by a felony, misdemeanour or petty offence belongs to all those who have personally suffered damage directly caused by the offence.) Destroyed stock, wasted goods, emergency costs and lost margin linked to the attack would therefore be capable of forming the damage of a civil claim, provided the operator proves the direct link file by file. Article 85 of the same Code adds: “Toute personne qui se prétend lésée par un crime ou un délit peut en portant plainte se constituer partie civile devant le juge d’instruction compétent en application des dispositions des articles 52, 52-1 et 706-42” (Any person claiming to have been harmed by a felony or misdemeanour may, by lodging a complaint, become a civil party before the competent investigating judge in accordance with Articles 52, 52-1 and 706-42.) In practice, the operator files a plain complaint with the prosecutor first, then, if needed, a complaint with constitution of civil-party status (constitution de partie civile) before the investigating judge, which triggers a judicial investigation even if the prosecutor had shelved the case, subject to consignation (a deposit) and admissibility control.
Admissibility is assessed flexibly, which helps business victims at an early stage when the damage is still being counted. On 15 February 2022 (Criminal Chamber, no. 21-80.670, official text), the Cour de cassation recalled: “Il résulte de ces textes que, pour qu’une constitution de partie civile incidente soit recevable devant la juridiction d’instruction, il suffit que les circonstances sur lesquelles elle s’appuie permettent au juge d’instruction d’admettre comme possibles l’existence du préjudice allégué et la relation directe de celui-ci avec une infraction à la loi pénale.” (It follows from these texts that, for an incidental constitution of civil-party status to be admissible before the investigating court, it suffices that the circumstances relied upon allow the investigating judge to accept as possible the existence of the alleged harm and its direct relationship with a criminal offence.) An operator whose controllers were remotely forced to 50C overnight, whose stock was destroyed and whose losses are documented, would therefore have solid grounds to be admitted as a civil party, even before the hackers are identified, since investigation against unknown persons (plainte contre X) is routine in computer crime. The civil party can then request investigative acts, access the file through counsel, and seek damages from the convicted persons, while knowing that recovery depends on the offenders’ solvency and that the award never exceeds the proved loss.
Conclusion
The independent store operator facing cabinets full of spoiled food should work three tracks at once: notify every potentially applicable insurer within days and document each euro of destroyed stock, destroyed-batch certificates and emergency costs; clear and restock in compliance with the European withdrawal duty while agreeing any trading adjustments with the network head and landlord in writing; and join the criminal process as a civil party so the documented loss can be compensated by those convicted, while pursuing the contractual and liability routes against the network and the software supplier where the facts support them. At the date of writing, no intrusion technique, no responsibility and no sharing of the loss between these actors has been established by any court; the contracts signed by each operator prevail over general analysis, and only the judge will decide who pays what.