On 8 November 2026, British readers woke up to an unusual technology story sitting at the top of Google Trends in the United Kingdom: the word “hackers”, driven by news that dozens of supermarkets in seven European countries had their refrigerators and freezers hit by a cyberattack. According to the BBC, around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, alongside a smaller number of shops in Sweden, Ireland, the Netherlands, Estonia and Finland, with freezer temperatures reportedly climbing as high as 50C. The same report recalls that the method used appears identical to the one deployed a month earlier in an incident that hit hundreds of French supermarkets, where millions of euros worth of food had to be thrown away. A French-owned retailer, Carrefour, told the press that 15 of its Belgian stores were affected this time, and United States investigators are reported to be working with French officials to examine possible links with refrigeration failures observed on American military bases. For anyone who shops, travels or does business in France, the episode raises three very practical questions: what happens to food that has been stored in a hacked freezer, what a retailer must do with your personal data when its connected systems are compromised, and how to file a criminal complaint in France. French and European law answer each of these points with unusual precision, from the criminal provisions on hacking to the GDPR breach-notification clock and the food-withdrawal machinery. This article sets out the exact texts and the court decisions that apply them.
I. Hackers freezers: what the attack changed and why French law governs the French part of it
A. Hackers attack: defrost-mode freezers from Belgium to Ireland, one month after hundreds of French supermarkets
The facts, as reported by the British press on the day the trend peaked, are straightforward. The Guardian describes the affair as part of a possible wider hacking epidemic, alongside a fake nuclear alert and a large cryptocurrency heist, while the Wall Street Journal asks who is causing chaos across Europe. The BBC report gives the concrete detail that matters for consumers: a Belgian company, Sabcobel, which manufactures some of the affected refrigeration units, said the evaporators were switched to defrost mode, warming the cabinets up, in what is believed to be the same method used in the previous month’s incident that hit hundreds of French supermarkets. Its chief executive told the Belga news agency that the incident was a cyberattack and that his teams had been working all night and all morning to disconnect the affected units from the network. He added that since the French attack of early October, the company had tried to protect its customers’ fridges against this vulnerability, but that the units needed physical modifications, not only software updates. Most supermarkets across Europe are connected to the internet, the report notes, so maintenance and troubleshooting can be carried out remotely, which is precisely what makes a remote attack on temperature settings possible. The damage is tangible: in the Belgian town of Hoeilaart, one Delhaize branch estimated its lost produce at 100,000 euros, before even counting the turnover lost while the shop stayed closed. Colruyt Group, which operates Spar stores in Belgium under franchise, told Reuters that five of its shops had their fridge systems attacked. The Swedish furniture retailer IKEA said refrigeration systems at its store in Mons, in western Belgium, were affected. Carrefour, a French-owned supermarket group, said the incident had only affected 15 of its Belgian stores and that measures had been taken immediately to keep all shops open. Both Belgium’s and Sweden’s national cybersecurity agencies said they were monitoring the incident, the United Kingdom’s National Cyber Security Centre said it was working with international partners and industry, and no incidents have so far been reported on British soil. Ireland, by contrast, is on the list of affected countries, which means Irish shoppers and Irish businesses are directly concerned, and British travellers and British companies operating in France are concerned through the French leg of the affair: the October attack on hundreds of French supermarkets, the French-owned retailer involved, and the reported cooperation between American investigators and French officials. No official source has attributed the attack at the time of writing, and this article draws no conclusion on that point: everything that follows describes the legal machinery that applies whatever the identity of the attackers.
B. Fridge hackers on French soil: territorial criminal law and EU regulations that apply directly
When a freezer is remotely forced into defrost mode in a French supermarket, French criminal law applies without any need for a legal construction. Article 113-2 of the French Criminal Code provides: “La loi pénale française est applicable aux infractions commises sur le territoire de la République. L’infraction est réputée commise sur le territoire de la République dès lors qu’un de ses faits constitutifs a eu lieu sur ce territoire.” (French criminal law applies to offences committed on the territory of the Republic. An offence is deemed committed on the territory of the Republic as soon as one of its constituent acts took place on that territory.) A hacker sitting abroad who alters the operation of a system located in France therefore commits an act that French courts can punish, because the alteration of the system’s functioning takes place in France. This territorial anchor matters for British and Irish victims too: a tourist who buys spoiled food in France, or a company whose French subsidiary’s systems are attacked, deals with facts localised in France, and the complaint can be filed with the French police or the French public prosecutor. Alongside criminal law, two layers of European Union law frame the case. First, EU regulations apply directly in every Member State with no French implementing statute needed, which is why the shopper, the retailer and the CNIL all read the same GDPR and food-safety texts. Second, EU directives such as the NIS2 cybersecurity directive bind each Member State as to the result to be achieved while leaving the national reporting channels to domestic arrangements. With that architecture in mind, the two halves of the problem can be treated separately: the food on the shelves, and the data in the systems.
II. Your rights after a food cyberattack in France: spoiled-food refunds, data-breach notification and criminal complaint
A. Spoiled food after the hackers freezers incident: withdrawal, recall and refund in France
Food that has spent hours at 50C in a cabinet forced into defrost mode is not a borderline product: European food law starts from a blunt prohibition. Article 14 of Regulation 178/2002 provides: “Aucune denrée alimentaire n’est mise sur le marché si elle est dangereuse.” (No food shall be placed on the market if it is unsafe.) A food is unsafe if it is injurious to health or unfit for human consumption, assessed notably in light of the normal conditions of use by the consumer at each stage of distribution and of the information provided to the consumer. A retailer that has reason to think that food it has distributed no longer meets safety requirements must act immediately, whether or not a customer has complained. Article 19 of the same regulation states: “il engage immédiatement les procédures de retrait du marché de la denrée alimentaire en question, lorsque celle-ci ne se trouve plus sous le contrôle direct de ce premier exploitant du secteur alimentaire, et en informe les autorités compétentes. Lorsque le produit peut avoir atteint le consommateur, l’exploitant informe les consommateurs de façon effective et précise des raisons du retrait et, au besoin, rappelle les produits déjà fournis aux consommateurs lorsque les autres mesures sont insuffisantes pour atteindre un niveau élevé de protection de la santé.” (it shall immediately initiate procedures to withdraw the food in question from the market where the food has left the immediate control of that initial food business operator, and inform the competent authorities thereof. Where the product may have reached the consumer, the operator shall effectively and accurately inform the consumers of the reason for its withdrawal, and if necessary, recall from consumers products already supplied to them where other measures are not sufficient to achieve a high level of health protection.) In France, this European machinery connects to the national recall platform that consumers know as RappelConso. Article L. 423-3 of the French Consumer Code provides: “les opérateurs économiques qui procèdent au rappel de produits en font la déclaration de façon dématérialisée sur un site internet dédié, mis à la disposition du public par l’administration.” (economic operators carrying out a product recall shall declare it electronically on a dedicated website made available to the public by the administration.) For food specifically, the same article adds that producers and distributors must keep an updated quantified record of withdrawn or recalled products available to authorised officers, and that operators recalling foodstuffs declare it electronically in the same way. The general compliance of goods sold in France sits under Article L. 412-1 of the Consumer Code: “Des décrets en Conseil d’Etat définissent les règles auxquelles doivent satisfaire les marchandises. Ils déterminent notamment : 1° Les conditions dans lesquelles l’exportation, l’offre, la vente, la distribution à titre gratuit, la détention, l’étiquetage, le conditionnement ou le mode d’utilisation des marchandises sont interdits ou réglementés” (Decrees in the Conseil d’Etat define the rules which goods must satisfy. They determine in particular: 1. The conditions under which the export, offering, sale, free distribution, possession, labelling, packaging or conditions of use of goods are prohibited or regulated). For the shopper, the practical translation is simple. Keep the receipt and, if possible, a photograph of the product and its labels. If the product is covered by a withdrawal or recall notice, follow the instructions on the RappelConso notice and stop consuming it. Ask the store for a refund or replacement: a foodstuff that has broken the cold chain because of a cyberattack does not match what the contract promised, and Article L. 217-4 of the Consumer Code recalls the baseline: “Le bien est conforme au contrat s’il répond notamment, le cas échéant, aux critères suivants : 1° Il correspond à la description, au type, à la quantité et à la qualité, notamment en ce qui concerne la fonctionnalité, la compatibilité, l’interopérabilité, ou toute autre caractéristique prévues au contrat” (Goods are in conformity with the contract where they meet, where applicable, the following criteria: 1. They match the description, type, quantity and quality, particularly as regards functionality, compatibility, interoperability or any other characteristic provided for by the contract). If symptoms appear after consumption, seek medical attention promptly and keep every medical document, because compensation for bodily injury follows its own evidentiary path. Reports can also be filed on the French consumer-reporting platform SignalConso and, for serious risks, to the health authorities, so that the withdrawal chain documented in Article 19 and Article L. 423-3 is triggered even when the retailer was unaware of the hack.
B. Hacked systems, personal data and criminal complaint: CNIL notification, prison sentences and compensation
The second half of the affair concerns the systems themselves, and here French criminal law is severe. Three provisions of the Criminal Code cover the attack end to end. Article 323-1 punishes unauthorised access: “Le fait d’accéder ou de se maintenir, frauduleusement, dans tout ou partie d’un système de traitement automatisé de données est puni de trois ans d’emprisonnement et de 100 000 € d’amende. Lorsqu’il en est résulté soit la suppression ou la modification de données contenues dans le système, soit une altération du fonctionnement de ce système, la peine est de cinq ans d’emprisonnement et de 150 000 € d’amende.” (Fraudulently accessing or remaining in all or part of an automated data processing system is punished by three years’ imprisonment and a 100,000 euro fine. Where this has resulted in either the deletion or modification of data contained in the system, or an alteration of the functioning of that system, the penalty is five years’ imprisonment and a 150,000 euro fine.) Forcing evaporators into defrost mode is precisely an alteration of the functioning of a system. Article 323-2 adds: “Le fait d’entraver ou de fausser le fonctionnement d’un système de traitement automatisé de données est puni de cinq ans d’emprisonnement et de 150 000 € d’amende.” (Obstructing or distorting the functioning of an automated data processing system is punished by five years’ imprisonment and a 150,000 euro fine.) And Article 323-3 covers manipulation of the data itself: “Le fait d’introduire frauduleusement des données dans un système de traitement automatisé, d’extraire, de détenir, de reproduire, de transmettre, de supprimer ou de modifier frauduleusement les données qu’il contient est puni de cinq ans d’emprisonnement et de 150 000 € d’amende.” (Fraudulently entering data into an automated processing system, or fraudulently extracting, holding, reproducing, transmitting, deleting or modifying the data it contains, is punished by five years’ imprisonment and a 150,000 euro fine.) The Cour de cassation applies these texts strictly. In a judgment of 8 June 2021 (no. 20-85.853), the criminal chamber recalled: “le seul fait de modifier ou supprimer, en violation de la réglementation en vigueur, de telles données caractérise le délit précité, sans qu’il soit nécessaire que ces modifications ou suppressions émanent d’une personne n’ayant pas un droit d’accès au système, ni que leur auteur soit animé de la volonté de nuire” (the mere fact of modifying or deleting such data, in breach of the rules in force, constitutes the aforementioned offence, without it being necessary for those modifications or deletions to come from a person having no right of access to the system, nor for their author to be driven by an intent to cause harm), and added the rule that matters most for concealed remote attacks: “des modifications ou suppressions de données sont nécessairement frauduleuses dès lors qu’elles ont été sciemment dissimulées à au moins un autre utilisateur d’un tel système, même s’il n’est pas titulaire de droits de modification” (modifications or deletions of data are necessarily fraudulent where they have been knowingly concealed from at least one other user of such a system). A remote command that silently flips freezers into defrost mode, hidden from the store teams, fits that definition. For balance, the same chamber held on 7 January 2020 (no. 18-84.755) that a software vendor is not automatically guilty of supplying hacking tools: in that case, the tax administration had complained against the designer and distributor of pharmacy management software containing a hidden feature, and the courts confirmed the investigating judge’s dismissal order (a confirmé l’ordonnance de non-lieu rendue par le juge d’instruction). The target of criminal law is the attacker, not every supplier in the chain. Victims and witnesses can file a complaint with any French police station or gendarmerie brigade, or with the public prosecutor, including by the online pre-complaint system before a physical appointment; joining the proceedings as a civil party later allows damages to be claimed in the criminal trial. The data-protection layer runs in parallel and binds the retailer, not the hacker. Supermarket loyalty cards, online accounts and connected payment flows mean retailers hold personal data, and a breach of connected refrigeration systems can expose customer databases hosted on the same networks. Article 32 of the GDPR requires: “le responsable du traitement et le sous-traitant mettent en œuvre les mesures techniques et organisationnelles appropriées afin de garantir un niveau de sécurité adapté au risque, y compris entre autres, selon les besoins” (the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk). If data is nevertheless compromised, Article 33 orders notification: “En cas de violation de données à caractère personnel, le responsable du traitement en notifie la violation en question à l’autorité de contrôle compétente conformément à l’article 55, dans les meilleurs délais et, si possible, 72 heures au plus tard après en avoir pris connaissance, à moins que la violation en question ne soit pas susceptible d’engendrer un risque pour les droits et libertés des personnes physiques. Lorsque la notification à l’autorité de contrôle n’a pas lieu dans les 72 heures, elle est accompagnée des motifs du retard.” (In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.) In France that authority is the CNIL. Where the breach is likely to create a high risk for individuals, Article 34 adds direct information to customers: “Lorsqu’une violation de données à caractère personnel est susceptible d’engendrer un risque élevé pour les droits et libertés d’une personne physique, le responsable du traitement communique la violation de données à caractère personnel à la personne concernée dans les meilleurs délais.” (When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.) At European scale, the NIS2 cybersecurity directive organises incident reporting by essential and important entities: “sans retard injustifié et en tout état de cause dans les 24 heures après avoir eu connaissance de l’incident important, une alerte précoce” (without undue delay and in any event within 24 hours after having become aware of a significant incident, an early warning), then “sans retard injustifié et en tout état de cause dans les 72 heures après avoir eu connaissance de l’incident important, une notification d’incident” (without undue delay and in any event within 72 hours, an incident notification), followed by a final report within one month. French courts already draw civil consequences when a professional’s mailbox or system is compromised. On 18 November 2025, the Nice judicial court (RG 22/03193) recalled that “L’article 32 du RGPD précise que le responsable du traitement et d’un éventuel sous-traitant doivent mettre en œuvre les mesures techniques et organisationnelles appropriées afin de garantir un niveau de sécurité adapté, en prenant en compte l’état des connaissances, les coûts de mise en œuvre ainsi que la nature, la portée, le contexte et les finalités du traitement concerné” (Article 32 of the GDPR states that the controller and any processor must implement appropriate technical and organisational measures to ensure a level of security appropriate), and ordered: “CONDAMNE la SARL ETUDE [Y] à payer à Monsieur [X] [A] la somme 8.899,95 euros à titre de dommages et intérêts” (ORDERS SARL ETUDE [Y] to pay Mr [X] [A] the sum of 8,899.95 euros in damages), in a case where a hacked professional mailbox had been used to divert a client’s bank transfer by fake bank details. The lesson for customers of a hacked retailer is practical: if fraudulent use of your data or your payment details follows the attack, document every debit, oppose compromised payment instruments without delay, file a complaint, and notify the CNIL through its online complaint service, because the retailer’s security duties and your right to compensation are judged on the measures actually implemented, not on the mere fact that hackers struck.
Conclusion
The freezers will be repaired, the shelves restocked and the software patched, but the legal traces of the November 2026 attacks will last longer than the melted ice cream. The facts reported by the BBC, the Guardian and the Wall Street Journal describe the same operating method striking Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland one month after hundreds of French supermarkets were hit, with a French-owned group among the victims and French officials associated with the cross-border investigation. On the food side, European law prohibits placing unsafe food on the market, obliges operators to withdraw and where necessary recall suspect products while informing the authorities and consumers, and connects to the French public recall register, with refunds available for products that no longer match what was sold. On the systems side, French criminal law punishes unauthorised access, obstruction and fraudulent data manipulation with up to five years’ imprisonment and 150,000 euros in fines, aggravated where State systems are targeted, and the Cour de cassation treats concealed remote manipulation as necessarily fraudulent; the GDPR adds the 72-hour notification to the CNIL and direct information to exposed customers, the NIS2 directive organises 24-hour and 72-hour reporting up the chain, and civil courts order damages where a professional’s compromised system causes a customer’s loss. Anyone affected in France, resident, traveller or business, should therefore keep receipts and photographs, follow the recall notices, oppose any compromised payment means, file a complaint with the French police or prosecutor, and alert the CNIL if personal data is involved. The hackers chose connected cold; the law answers with texts that were written for exactly this kind of borderless incident.