On 12 October 2026, press reports described a large-scale cyberattack that forced refrigeration systems to defrost in hundreds of French supermarkets, with outbreaks of fire reported in some stores and the Paris prosecutor’s office reported to have opened an investigation to identify the victims and establish the link with the damage reported. For a British resident or second-home owner in France, the immediate worry is the spoiled contents of the fridge. The second worry arrives a few days later by email or text message: a note from a loyalty scheme, a strange login alert, or a phishing message quoting your real address. This article deals with that second risk: what happens when a cyberattack on a French food retailer touches your personal data as a loyalty-card holder, and what a British shopper can do about it under French law.
Two cautions belong at the very start. At the date of writing, no official source has established that customer personal data was accessed, copied or misused in this incident, and no liability of any retailer has been established; the contracts you signed, including the loyalty scheme terms and your bank agreements, prevail over any general analysis, and only a court decides individual cases. The paragraphs that follow explain the general method that applies whenever a French retailer suffers a cyberattack: how to find out whether your data is affected, how to protect yourself in the first days, how to complain to the CNIL (Commission nationale de l’informatique et des libertés, the French data protection authority), and how French courts award compensation when misuse of personal data causes real, proven loss.
I. What a French retailer must do with your loyalty-card data after a cyberattack, and what you can demand at once
A. How do you find out whether your personal data is affected after a supermarket cyberattack in France?
A supermarket loyalty card looks harmless: name, postal address, email address, telephone number, date of birth, purchase history, and often bank details if you pay through an app or take store credit. Under European data protection law, every one of those items is personal data, and the retailer that runs the scheme is the data controller, the organisation that decides why and how the data is processed. When attackers penetrate the retailer’s systems, the controller has two notification duties that matter directly to you. First, it must notify the CNIL, the French supervisory authority, without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach. Second, when the breach is likely to result in a high risk to your rights, for example because login credentials, identity documents or bank details may have been exposed, it must communicate the breach to you directly, in clear language, describing what happened, what data is concerned, and what measures you should take. These duties come from Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016, the General Data Protection Regulation, the General Data Protection Regulation, known as the GDPR, as applied in France under the supervision of the CNIL.
In practice, a British shopper in France should therefore watch three channels in the days after a reported attack: the email inbox linked to the loyalty account, including the spam folder; the retailer app and the loyalty account page, where forced password resets or security notices sometimes appear before any email; and the retailer’s own press statements on its website. Treat with suspicion any message that asks you to click a link to secure your account, because the weeks after a publicised attack are the peak season for phishing, the fraudulent messages that imitate the retailer to harvest your passwords. According to the specialist press that recounted the October 2026 incident, the confirmed facts concern refrigeration equipment and food losses, not customer databases, so a message claiming that your loyalty data has certainly been stolen would go further than any published source and should be handled as unverified unless the retailer itself or the CNIL confirms it.
If you hold a loyalty account, take four steps now, before any confirmation. First, change the loyalty account password and every other account where you reused it, and switch on two-factor authentication where the retailer offers it. Second, download or screenshot your loyalty statements, your points balance and your linked payment methods, because these records fix the baseline against which later fraudulent use is measured. Third, activate transaction alerts with your French bank or your UK bank for the card linked to the store, so that any unusual debit produces an immediate notification. Fourth, keep every message connected with the incident: the retailer’s emails with full headers, text messages, screenshots of the app, and notes of any telephone calls with dates and names. French civil liability turns on proof, and Article 1353 of the Civil Code states the rule plainly: “Celui qui réclame l’exécution d’une obligation doit la prouver. Réciproquement, celui qui se prétend libéré doit justifier le paiement ou le fait qui a produit l’extinction de son obligation.” In plain terms, whoever claims must prove, so the shopper who keeps contemporaneous evidence starts from a far stronger position than the one who reconstructs events months later.
Where the retailer stays silent and you suspect your data has been misused, you have a direct route to the regulator. Any person may lodge a complaint with the CNIL about the processing of their personal data, online through the CNIL complaints service, and the CNIL publishes the procedure and the supporting documents required on cnil.fr. The CNIL can investigate, order the organisation to comply, and impose administrative fines; its sanction decisions are published and can later support a civil claim, although the CNIL itself does not award you damages. A parallel practical step for a British reader is to check the UK side: if the same credentials protect UK accounts, update them as well, and consult gov.uk guidance on recovering hacked accounts and reporting fraud, since the attacker does not stop at the Channel.
B. How do you protect your money and your identity in France in the first 72 hours?
The fastest losses after a retail cyberattack rarely come from the attack itself. They come from the fraud wave that follows: phishing texts in French quoting your loyalty number, fake refund forms for the spoiled food, telephone callers posing as your bank’s fraud team, and attempts to use exposed credentials on banking, email and social media accounts. A British resident in France faces one extra difficulty: the scam may arrive in French, invoke unfamiliar bodies such as the DGCCRF (Direction générale de la concurrence, de la consommation et de la répression des fraudes, the consumer protection authority) or the gendarmerie, and pressure you to act before you can check. Slow the tempo down. No French bank, no retailer and no public authority ever asks for your full password, your card PIN or an SMS code by telephone or by link. Any caller who does is, by that fact alone, not who they claim to be.
Organise your defence around your bank first. If a debit you did not authorise appears, notify the bank at once through the opposition procedure, the formal blocking of the payment instrument, and confirm the opposition in writing; keep the confirmation, because the allocation of unauthorised payment losses depends on the speed of your reaction and on whether strong authentication was used. If you receive a phishing message that reuses personal details only the retailer holds, such as your loyalty number or your exact points balance, file a report on the French government PHAROS platform for illegal online content and keep the report receipt. If identity documents were exposed, for example because the loyalty app stored a scan of your passport for a money-transfer or parcel service, consider filing a complaint for identity theft and placing a fraud alert with the Banque de France’s FIBEN-related procedures through your bank, and monitor your credit file. Each of these steps creates a dated official trace, and dated traces are what turn a vague complaint into a documented file.
French criminal law treats attacks on personal data with real severity, which matters because a criminal complaint opens procedural doors that a simple letter does not. Article 226-18 of the Criminal Code provides: “Le fait de collecter des données à caractère personnel par un moyen frauduleux, déloyal ou illicite est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende.” Article 226-16 punishes the operator’s side: “Le fait, y compris par négligence, de procéder ou de faire procéder à des traitements de données à caractère personnel sans qu’aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende.” And Article 226-17 targets security failures directly: “Le fait de procéder ou de faire procéder à un traitement de données à caractère personnel sans mettre en oeuvre les mesures prescrites aux articles 24,25,30 et 32 du règlement (UE) 2016/679 du 27 avril 2016 précité ou au 6° de l’article 4 et aux articles 99 à 101 de la loi n° 78-17 du 6 janvier 1978 précitée est puni de cinq ans d’emprisonnement et de 300 000 euros d’amende.” These texts do not designate any retailer as guilty; they describe the offences a prosecutor would have to establish, and they explain why preserving evidence and filing a timely complaint helps the investigation that the Paris prosecutor’s office was reported to have opened after the October 2026 refrigeration attacks.
Filing the complaint itself is straightforward. You can report to the police or the gendarmerie, including through the French online pre-complaint system for property and fraud offences, and you can constitute yourself civil party to seek damages within the criminal proceedings. Article 85 of the Code of Criminal Procedure opens that route in these terms: “Toute personne qui se prétend lésée par un crime ou un délit peut en portant plainte se constituer partie civile devant le juge d’instruction compétent en application des dispositions des articles 52, 52-1 et 706-42 .” For a British complainant with limited French, bring a French-speaking companion, keep a copy of everything filed, and ask for the complaint receipt, the récépissé, with the file number. Corporate offenders face specific penalties too: Article 226-24 of the Criminal Code provides that legal persons found criminally liable for the data offences in that section incur, besides fines under Article 131-38, the penalties listed in Article 131-39, which can include bans on the activity involved. Again, these are the tools the law makes available; whether they apply to any particular retailer is for the prosecutor and then the court, never for this article, to say.
II. How does a British shopper obtain compensation in France when misused loyalty data causes genuine loss?
A. Why does a data breach alone pay nothing, and what must you prove to obtain damages?
This is the point on which disappointed claimants lose most often: under the law now applied by French courts, the mere fact that a retailer violated data protection rules does not give you a right to money. Compensation requires three elements proved together: a breach of the rules, a concrete material or moral loss suffered by you, and a causal link between the two. The Cour de cassation, France’s supreme court for civil and criminal matters, stated the principle in a published social-chamber judgment of 24 June 2026, appeal no. V 24-22.792, available on the Court official website: “la simple violation du règlement général sur la protection des données n’ouvre pas, à elle seule, droit à réparation”, meaning that the simple violation of the data protection regulation does not, by itself, open a right to compensation.
The reasoning of that judgment repays close reading, because the Court anchored French practice to two decisions of the Court of Justice of the European Union, the CJEU, whose rulings bind all member states. First, the Court recalled that Article 82(1) of the GDPR gives anyone harmed by a breach of the Regulation, whether the harm is material or moral, a right to be compensated by the controller or the processor involved. Then it set out what the CJEU had decided on 4 May 2023 in case C-300/21, Österreichische Post, in three propositions: a bare breach of the Regulation, without proven harm, is not enough to create a right to damages; next, European law forbids national rules or practices that would make compensation for moral harm conditional on the suffering reaching a minimum level of seriousness; and finally, when fixing the amount of damages, national judges apply their own domestic rules on the extent of financial compensation, provided the European principles of equivalence and effectiveness are respected (CJEU, 4 May 2023, case C-300/21, Österreichische Post). For a British claimant, the second proposition is the most encouraging: a French court may not refuse moral damages on the ground that your distress was not serious enough, although you must still prove that distress exists.
The same judgment added a second CJEU reference, decided 25 January 2024 in case C-687/21, MediaMarktSaturn Hagen-Iserlohn, with two further rules: the right to damages under that provision, including for moral harm, serves a compensatory purpose: money awarded must make good in full the concrete loss actually suffered because of the breach, and must not punish; and a claimant must prove two things together, not one: both the breach of the Regulation and the material or moral damage that breach caused to them (CJEU, 25 January 2024, case C-687/21, MediaMarktSaturn Hagen-Iserlohn). In practical terms, French judges compensate the loss you actually suffered, in full, but they do not punish the company through damages; there are no American-style punitive awards. The official texts of both CJEU decisions are freely available on Curia, the Court of Justice official case-law portal.
Behind the European layer sits classic French civil liability, which supplies the cause of action before the French courts. Article 1240 of the Civil Code provides: “Tout fait quelconque de l’homme, qui cause à autrui un dommage, oblige celui par la faute duquel il est arrivé à le réparer.” Article 1241 adds: “Chacun est responsable du dommage qu’il a causé non seulement par son fait, mais encore par sa négligence ou par son imprudence.” A retailer that stored passwords in clear text, left a loyalty database exposed online, or ignored a known vulnerability for months would have to answer questions about fault and negligence under these articles, combined with the GDPR security duty in Article 32 of the Regulation, recalled by Article 226-17 of the Criminal Code. But the claimant’s file must document each head of loss separately: the debited sums with bank statements, the replacement costs of compromised documents, the time demonstrably spent remedying the fraud, and the moral suffering, for example anxiety, sleep disturbance or the documented fear of identity theft, supported by medical certificates or contemporaneous correspondence rather than bare assertion. A companion article on this site explains the parallel route for the spoiled food itself, namely how shoppers document and claim refunds for goods lost when store refrigeration fails, which follows consumer-sales and food-safety rules rather than data protection law: how British shoppers claim for spoiled food after a supermarket refrigeration failure.
B. Where and when do you claim, and what does the Paris route look like for a British claimant?
Before any court, send the retailer a formal demand, the mise en demeure, by registered letter with acknowledgement of receipt, setting out the breach as you understand it, the losses with supporting documents, the sum claimed, and a reasonable deadline, commonly one month. This letter is not a formality: it fixes the starting point for late-payment interest, it demonstrates good faith, and judges notice when a claimant sued without ever asking. Address it to the data protection officer, the DPO, whose contact details the retailer must publish, with a copy to customer service, and keep the postal receipts. If the retailer offers loyalty vouchers in return for signing a waiver, read the waiver carefully and do not sign away a compensation claim for a few euros of points; a general release signed without advice can extinguish rights you have not measured.
Mind the clock. Article 2224 of the Civil Code provides: “Les actions personnelles ou mobilières se prescrivent par cinq ans à compter du jour où le titulaire d’un droit a connu ou aurait dû connaître les faits lui permettant de l’exercer.” For a data-misuse claim, the five years normally run from the day you knew, or should have known, the facts enabling the claim, which is often the breach notification, the first fraudulent debit, or the CNIL decision you rely on, rather than the date of the attack itself. Do not confuse this with the short deadlines of payment disputes with your bank, which can be a matter of months, or with criminal limitation periods, which follow their own rules. A claim filed one week late fails entirely, however strong its merits, so diary the deadline on the day you discover the loss.
For the court itself, a British resident in France sues in France, before the tribunal judiciaire, the ordinary civil court, of the place where the damage occurred or where the retailer is established; consumers may also use the jurisdiction of their own domicile for consumer contracts under the Code of Civil Procedure. In Paris and the Île-de-France, where many British residents live and where the reported October 2026 investigation sits with the Paris prosecutor, the practical specifics are worth noting: the tribunal judiciaire de Paris hears high-value and complex civil claims, legal aid applications go through its bureau d’aide juridictionnelle, hearings proceed in French with sworn interpreters available on request, and Paris bailiffs, the commissaires de justice, serve the mise en demeure and the writ with the formal weight French judges expect. Prepare the file a Paris judge wants to see: the loyalty contract terms, the breach notification or the evidence of silence, the CNIL complaint and any response, the criminal complaint receipt, bank statements with the disputed lines highlighted, a chronological table linking each loss to the breach, and any medical evidence for moral damage. Small claims can go through the simplified prior conciliation or mediation the court will ask about, and judges increasingly expect the parties to have attempted settlement before troubling the court.
Conclusion
A cyberattack on a French supermarket chain puts a British shopper at the intersection of two French systems: the regulator, the CNIL, which investigates and sanctions, and the courts, which compensate only proven, concrete loss. The method that protects you serves both: secure your accounts immediately, preserve every trace from the first day, complain to the CNIL and to the police with file numbers to show for it, put the retailer formally on notice, and build the causal chain from the breach to each euro and each documented distress before claiming. The Cour de cassation’s 2026 ruling, following the Court of Justice, draws the boundary with unusual clarity: no compensation without proven damage, no seriousness threshold for moral suffering, full compensation for what you truly lost, and nothing punitive beyond it.
The closing cautions mirror the opening ones. At the date of writing, no official source has confirmed that customer data was compromised in the October 2026 refrigeration attacks, no accident, intrusion or damage concerning any particular retailer’s customer data has been officially established, and no liability has been found against any company; your signed contracts prevail over general commentary, and only the judge hearing your case decides whether a breach, a loss and a causal link are proved. Measured against those standards, the British shopper who acts early, documents everything and claims only what can be shown is the shopper French law is best equipped to help.