On 8 November 2026, British readers woke up to an unusual technology story sitting at the top of Google Trends in the United Kingdom: the word “hackers”, driven by news that dozens of supermarkets in seven European countries had their refrigerators and freezers hit by a cyberattack. According to the BBC, around 40 Delhaize supermarkets in Belgium and Luxembourg were affected, alongside a smaller number of shops in Sweden, Ireland, the Netherlands, Estonia and Finland, with freezer temperatures reportedly climbing as high as 50C. The same report recalls that the method used appears identical to the one deployed a month earlier in an incident that hit hundreds of French supermarkets, where millions of euros worth of food had to be thrown away. A French-owned retailer, Carrefour, told the press that 15 of its Belgian stores were affected this time, and United States investigators are reported to be working with French officials to examine possible links with refrigeration failures observed on American military bases. For anyone who shops, travels or does business in France, the episode raises three very practical questions: what happens to food that has been stored in a hacked freezer, what a retailer must do with your personal data when its connected systems are compromised, and how to file a criminal complaint in France. French and European law answer each of these points with unusual precision, from the criminal provisions on hacking to the GDPR breach-notification clock and the food-withdrawal machinery. This article sets out the exact texts and the court decisions that apply them.<\/p>\n
The facts, as reported by the British press on the day the trend peaked, are straightforward. The Guardian<\/a> describes the affair as part of a possible wider hacking epidemic, alongside a fake nuclear alert and a large cryptocurrency heist, while the Wall Street Journal asks who is causing chaos across Europe. The BBC report gives the concrete detail that matters for consumers: a Belgian company, Sabcobel, which manufactures some of the affected refrigeration units, said the evaporators were switched to defrost mode, warming the cabinets up, in what is believed to be the same method used in the previous month’s incident that hit hundreds of French supermarkets. Its chief executive told the Belga news agency that the incident was a cyberattack and that his teams had been working all night and all morning to disconnect the affected units from the network. He added that since the French attack of early October, the company had tried to protect its customers’ fridges against this vulnerability, but that the units needed physical modifications, not only software updates. Most supermarkets across Europe are connected to the internet, the report notes, so maintenance and troubleshooting can be carried out remotely, which is precisely what makes a remote attack on temperature settings possible. The damage is tangible: in the Belgian town of Hoeilaart, one Delhaize branch estimated its lost produce at 100,000 euros, before even counting the turnover lost while the shop stayed closed. Colruyt Group, which operates Spar stores in Belgium under franchise, told Reuters that five of its shops had their fridge systems attacked. The Swedish furniture retailer IKEA said refrigeration systems at its store in Mons, in western Belgium, were affected. Carrefour, a French-owned supermarket group, said the incident had only affected 15 of its Belgian stores and that measures had been taken immediately to keep all shops open. Both Belgium’s and Sweden’s national cybersecurity agencies said they were monitoring the incident, the United Kingdom’s National Cyber Security Centre said it was working with international partners and industry, and no incidents have so far been reported on British soil. Ireland, by contrast, is on the list of affected countries, which means Irish shoppers and Irish businesses are directly concerned, and British travellers and British companies operating in France are concerned through the French leg of the affair: the October attack on hundreds of French supermarkets, the French-owned retailer involved, and the reported cooperation between American investigators and French officials. No official source has attributed the attack at the time of writing, and this article draws no conclusion on that point: everything that follows describes the legal machinery that applies whatever the identity of the attackers.<\/p>\n When a freezer is remotely forced into defrost mode in a French supermarket, French criminal law applies without any need for a legal construction. Article 113-2 of the French Criminal Code<\/a> provides: “La loi p\u00e9nale fran\u00e7aise est applicable aux infractions commises sur le territoire de la R\u00e9publique. L’infraction est r\u00e9put\u00e9e commise sur le territoire de la R\u00e9publique d\u00e8s lors qu’un de ses faits constitutifs a eu lieu sur ce territoire.” (French criminal law applies to offences committed on the territory of the Republic. An offence is deemed committed on the territory of the Republic as soon as one of its constituent acts took place on that territory.) A hacker sitting abroad who alters the operation of a system located in France therefore commits an act that French courts can punish, because the alteration of the system’s functioning takes place in France. This territorial anchor matters for British and Irish victims too: a tourist who buys spoiled food in France, or a company whose French subsidiary’s systems are attacked, deals with facts localised in France, and the complaint can be filed with the French police or the French public prosecutor. Alongside criminal law, two layers of European Union law frame the case. First, EU regulations apply directly in every Member State with no French implementing statute needed, which is why the shopper, the retailer and the CNIL all read the same GDPR and food-safety texts. Second, EU directives such as the NIS2 cybersecurity directive bind each Member State as to the result to be achieved while leaving the national reporting channels to domestic arrangements. With that architecture in mind, the two halves of the problem can be treated separately: the food on the shelves, and the data in the systems.<\/p>\n Food that has spent hours at 50C in a cabinet forced into defrost mode is not a borderline product: European food law starts from a blunt prohibition. Article 14 of Regulation 178\/2002<\/a> provides: “Aucune denr\u00e9e alimentaire n’est mise sur le march\u00e9 si elle est dangereuse.” (No food shall be placed on the market if it is unsafe.) A food is unsafe if it is injurious to health or unfit for human consumption, assessed notably in light of the normal conditions of use by the consumer at each stage of distribution and of the information provided to the consumer. A retailer that has reason to think that food it has distributed no longer meets safety requirements must act immediately, whether or not a customer has complained. Article 19 of the same regulation<\/a> states: “il engage imm\u00e9diatement les proc\u00e9dures de retrait du march\u00e9 de la denr\u00e9e alimentaire en question, lorsque celle-ci ne se trouve plus sous le contr\u00f4le direct de ce premier exploitant du secteur alimentaire, et en informe les autorit\u00e9s comp\u00e9tentes. Lorsque le produit peut avoir atteint le consommateur, l’exploitant informe les consommateurs de fa\u00e7on effective et pr\u00e9cise des raisons du retrait et, au besoin, rappelle les produits d\u00e9j\u00e0 fournis aux consommateurs lorsque les autres mesures sont insuffisantes pour atteindre un niveau \u00e9lev\u00e9 de protection de la sant\u00e9.” (it shall immediately initiate procedures to withdraw the food in question from the market where the food has left the immediate control of that initial food business operator, and inform the competent authorities thereof. Where the product may have reached the consumer, the operator shall effectively and accurately inform the consumers of the reason for its withdrawal, and if necessary, recall from consumers products already supplied to them where other measures are not sufficient to achieve a high level of health protection.) In France, this European machinery connects to the national recall platform that consumers know as RappelConso<\/a>. Article L. 423-3 of the French Consumer Code<\/a> provides: “les op\u00e9rateurs \u00e9conomiques qui proc\u00e8dent au rappel de produits en font la d\u00e9claration de fa\u00e7on d\u00e9mat\u00e9rialis\u00e9e sur un site internet d\u00e9di\u00e9, mis \u00e0 la disposition du public par l’administration.” (economic operators carrying out a product recall shall declare it electronically on a dedicated website made available to the public by the administration.) For food specifically, the same article adds that producers and distributors must keep an updated quantified record of withdrawn or recalled products available to authorised officers, and that operators recalling foodstuffs declare it electronically in the same way. The general compliance of goods sold in France sits under Article L. 412-1 of the Consumer Code<\/a>: “Des d\u00e9crets en Conseil d’Etat d\u00e9finissent les r\u00e8gles auxquelles doivent satisfaire les marchandises. Ils d\u00e9terminent notamment : 1\u00b0 Les conditions dans lesquelles l’exportation, l’offre, la vente, la distribution \u00e0 titre gratuit, la d\u00e9tention, l’\u00e9tiquetage, le conditionnement ou le mode d’utilisation des marchandises sont interdits ou r\u00e9glement\u00e9s” (Decrees in the Conseil d’Etat define the rules which goods must satisfy. They determine in particular: 1. The conditions under which the export, offering, sale, free distribution, possession, labelling, packaging or conditions of use of goods are prohibited or regulated). For the shopper, the practical translation is simple. Keep the receipt and, if possible, a photograph of the product and its labels. If the product is covered by a withdrawal or recall notice, follow the instructions on the RappelConso notice and stop consuming it. Ask the store for a refund or replacement: a foodstuff that has broken the cold chain because of a cyberattack does not match what the contract promised, and Article L. 217-4 of the Consumer Code<\/a> recalls the baseline: “Le bien est conforme au contrat s’il r\u00e9pond notamment, le cas \u00e9ch\u00e9ant, aux crit\u00e8res suivants : 1\u00b0 Il correspond \u00e0 la description, au type, \u00e0 la quantit\u00e9 et \u00e0 la qualit\u00e9, notamment en ce qui concerne la fonctionnalit\u00e9, la compatibilit\u00e9, l’interop\u00e9rabilit\u00e9, ou toute autre caract\u00e9ristique pr\u00e9vues au contrat” (Goods are in conformity with the contract where they meet, where applicable, the following criteria: 1. They match the description, type, quantity and quality, particularly as regards functionality, compatibility, interoperability or any other characteristic provided for by the contract). If symptoms appear after consumption, seek medical attention promptly and keep every medical document, because compensation for bodily injury follows its own evidentiary path. Reports can also be filed on the French consumer-reporting platform SignalConso<\/a> and, for serious risks, to the health authorities, so that the withdrawal chain documented in Article 19 and Article L. 423-3 is triggered even when the retailer was unaware of the hack.<\/p>\n The second half of the affair concerns the systems themselves, and here French criminal law is severe. Three provisions of the Criminal Code cover the attack end to end. Article 323-1<\/a> punishes unauthorised access: “Le fait d’acc\u00e9der ou de se maintenir, frauduleusement, dans tout ou partie d’un syst\u00e8me de traitement automatis\u00e9 de donn\u00e9es est puni de trois ans d’emprisonnement et de 100 000 \u20ac d’amende. Lorsqu’il en est r\u00e9sult\u00e9 soit la suppression ou la modification de donn\u00e9es contenues dans le syst\u00e8me, soit une alt\u00e9ration du fonctionnement de ce syst\u00e8me, la peine est de cinq ans d’emprisonnement et de 150 000 \u20ac d’amende.” (Fraudulently accessing or remaining in all or part of an automated data processing system is punished by three years’ imprisonment and a 100,000 euro fine. Where this has resulted in either the deletion or modification of data contained in the system, or an alteration of the functioning of that system, the penalty is five years’ imprisonment and a 150,000 euro fine.) Forcing evaporators into defrost mode is precisely an alteration of the functioning of a system. Article 323-2<\/a> adds: “Le fait d’entraver ou de fausser le fonctionnement d’un syst\u00e8me de traitement automatis\u00e9 de donn\u00e9es est puni de cinq ans d’emprisonnement et de 150 000 \u20ac d’amende.” (Obstructing or distorting the functioning of an automated data processing system is punished by five years’ imprisonment and a 150,000 euro fine.) And Article 323-3<\/a> covers manipulation of the data itself: “Le fait d’introduire frauduleusement des donn\u00e9es dans un syst\u00e8me de traitement automatis\u00e9, d’extraire, de d\u00e9tenir, de reproduire, de transmettre, de supprimer ou de modifier frauduleusement les donn\u00e9es qu’il contient est puni de cinq ans d’emprisonnement et de 150 000 \u20ac d’amende.” (Fraudulently entering data into an automated processing system, or fraudulently extracting, holding, reproducing, transmitting, deleting or modifying the data it contains, is punished by five years’ imprisonment and a 150,000 euro fine.) The Cour de cassation applies these texts strictly. In a judgment of 8 June 2021 (no. 20-85.853)<\/a>, the criminal chamber recalled: “le seul fait de modifier ou supprimer, en violation de la r\u00e9glementation en vigueur, de telles donn\u00e9es caract\u00e9rise le d\u00e9lit pr\u00e9cit\u00e9, sans qu’il soit n\u00e9cessaire que ces modifications ou suppressions \u00e9manent d’une personne n’ayant pas un droit d’acc\u00e8s au syst\u00e8me, ni que leur auteur soit anim\u00e9 de la volont\u00e9 de nuire” (the mere fact of modifying or deleting such data, in breach of the rules in force, constitutes the aforementioned offence, without it being necessary for those modifications or deletions to come from a person having no right of access to the system, nor for their author to be driven by an intent to cause harm), and added the rule that matters most for concealed remote attacks: “des modifications ou suppressions de donn\u00e9es sont n\u00e9cessairement frauduleuses d\u00e8s lors qu’elles ont \u00e9t\u00e9 sciemment dissimul\u00e9es \u00e0 au moins un autre utilisateur d’un tel syst\u00e8me, m\u00eame s’il n’est pas titulaire de droits de modification” (modifications or deletions of data are necessarily fraudulent where they have been knowingly concealed from at least one other user of such a system). A remote command that silently flips freezers into defrost mode, hidden from the store teams, fits that definition. For balance, the same chamber held on 7 January 2020 (no. 18-84.755)<\/a> that a software vendor is not automatically guilty of supplying hacking tools: in that case, the tax administration had complained against the designer and distributor of pharmacy management software containing a hidden feature, and the courts confirmed the investigating judge’s dismissal order (a confirm\u00e9 l’ordonnance de non-lieu rendue par le juge d’instruction). The target of criminal law is the attacker, not every supplier in the chain. Victims and witnesses can file a complaint with any French police station or gendarmerie brigade, or with the public prosecutor, including by the online pre-complaint system before a physical appointment; joining the proceedings as a civil party later allows damages to be claimed in the criminal trial. The data-protection layer runs in parallel and binds the retailer, not the hacker. Supermarket loyalty cards, online accounts and connected payment flows mean retailers hold personal data, and a breach of connected refrigeration systems can expose customer databases hosted on the same networks. Article 32 of the GDPR<\/a> requires: “le responsable du traitement et le sous-traitant mettent en \u0153uvre les mesures techniques et organisationnelles appropri\u00e9es afin de garantir un niveau de s\u00e9curit\u00e9 adapt\u00e9 au risque, y compris entre autres, selon les besoins” (the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk). If data is nevertheless compromised, Article 33<\/a> orders notification: “En cas de violation de donn\u00e9es \u00e0 caract\u00e8re personnel, le responsable du traitement en notifie la violation en question \u00e0 l’autorit\u00e9 de contr\u00f4le comp\u00e9tente conform\u00e9ment \u00e0 l’article 55, dans les meilleurs d\u00e9lais et, si possible, 72 heures au plus tard apr\u00e8s en avoir pris connaissance, \u00e0 moins que la violation en question ne soit pas susceptible d’engendrer un risque pour les droits et libert\u00e9s des personnes physiques. Lorsque la notification \u00e0 l’autorit\u00e9 de contr\u00f4le n’a pas lieu dans les 72 heures, elle est accompagn\u00e9e des motifs du retard.” (In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.) In France that authority is the CNIL. Where the breach is likely to create a high risk for individuals, Article 34<\/a> adds direct information to customers: “Lorsqu’une violation de donn\u00e9es \u00e0 caract\u00e8re personnel est susceptible d’engendrer un risque \u00e9lev\u00e9 pour les droits et libert\u00e9s d’une personne physique, le responsable du traitement communique la violation de donn\u00e9es \u00e0 caract\u00e8re personnel \u00e0 la personne concern\u00e9e dans les meilleurs d\u00e9lais.” (When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.) At European scale, the NIS2 cybersecurity directive<\/a> organises incident reporting by essential and important entities: “sans retard injustifi\u00e9 et en tout \u00e9tat de cause dans les 24 heures apr\u00e8s avoir eu connaissance de l’incident important, une alerte pr\u00e9coce” (without undue delay and in any event within 24 hours after having become aware of a significant incident, an early warning), then “sans retard injustifi\u00e9 et en tout \u00e9tat de cause dans les 72 heures apr\u00e8s avoir eu connaissance de l’incident important, une notification d’incident” (without undue delay and in any event within 72 hours, an incident notification), followed by a final report within one month. French courts already draw civil consequences when a professional’s mailbox or system is compromised. On 18 November 2025, the Nice judicial court (RG 22\/03193)<\/a> recalled that “L’article 32 du RGPD pr\u00e9cise que le responsable du traitement et d’un \u00e9ventuel sous-traitant doivent mettre en \u0153uvre les mesures techniques et organisationnelles appropri\u00e9es afin de garantir un niveau de s\u00e9curit\u00e9 adapt\u00e9, en prenant en compte l’\u00e9tat des connaissances, les co\u00fbts de mise en \u0153uvre ainsi que la nature, la port\u00e9e, le contexte et les finalit\u00e9s du traitement concern\u00e9” (Article 32 of the GDPR states that the controller and any processor must implement appropriate technical and organisational measures to ensure a level of security appropriate), and ordered: “CONDAMNE la SARL ETUDE [Y] \u00e0 payer \u00e0 Monsieur [X] [A] la somme 8.899,95 euros \u00e0 titre de dommages et int\u00e9r\u00eats” (ORDERS SARL ETUDE [Y] to pay Mr [X] [A] the sum of 8,899.95 euros in damages), in a case where a hacked professional mailbox had been used to divert a client’s bank transfer by fake bank details. The lesson for customers of a hacked retailer is practical: if fraudulent use of your data or your payment details follows the attack, document every debit, oppose compromised payment instruments without delay, file a complaint, and notify the CNIL through its online complaint service<\/a>, because the retailer’s security duties and your right to compensation are judged on the measures actually implemented, not on the mere fact that hackers struck.<\/p>\n The freezers will be repaired, the shelves restocked and the software patched, but the legal traces of the November 2026 attacks will last longer than the melted ice cream. The facts reported by the BBC, the Guardian and the Wall Street Journal describe the same operating method striking Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland one month after hundreds of French supermarkets were hit, with a French-owned group among the victims and French officials associated with the cross-border investigation. On the food side, European law prohibits placing unsafe food on the market, obliges operators to withdraw and where necessary recall suspect products while informing the authorities and consumers, and connects to the French public recall register, with refunds available for products that no longer match what was sold. On the systems side, French criminal law punishes unauthorised access, obstruction and fraudulent data manipulation with up to five years’ imprisonment and 150,000 euros in fines, aggravated where State systems are targeted, and the Cour de cassation treats concealed remote manipulation as necessarily fraudulent; the GDPR adds the 72-hour notification to the CNIL and direct information to exposed customers, the NIS2 directive organises 24-hour and 72-hour reporting up the chain, and civil courts order damages where a professional’s compromised system causes a customer’s loss. Anyone affected in France, resident, traveller or business, should therefore keep receipts and photographs, follow the recall notices, oppose any compromised payment means, file a complaint with the French police or prosecutor, and alert the CNIL if personal data is involved. The hackers chose connected cold; the law answers with texts that were written for exactly this kind of borderless incident.<\/p>\n","protected":false},"excerpt":{"rendered":" Supermarket freezers were remotely forced into defrost mode in seven European countries, one month after hundreds of French supermarkets were hit. For shoppers, travellers and businesses in France: spoiled-food withdrawal and refunds, GDPR breach notification to the CNIL, and criminal complaint for hacking, with the exact French and EU texts.<\/p>\n","protected":false},"author":251031309,"featured_media":16394,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kj_source_type":"","_kj_official_id":"","_kj_official_url":"","_kj_judilibre_id":"","_kj_jur":"","_kj_lieu":"","_kj_chambre":"","_kj_rg":"","_kj_date":"","activitypub_content_warning":"","activitypub_content_visibility":"","activitypub_max_image_attachments":4,"activitypub_interaction_policy_quote":"anyone","activitypub_status":"federated","footnotes":""},"categories":[80314,80316],"tags":[],"class_list":["post-2163806","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-decryptage","category-numerique-donnees-personnelles"],"yoast_head":"\nB. Fridge hackers on French soil: territorial criminal law and EU regulations that apply directly<\/h3>\n
II. Your rights after a food cyberattack in France: spoiled-food refunds, data-breach notification and criminal complaint<\/h2>\n
A. Spoiled food after the hackers freezers incident: withdrawal, recall and refund in France<\/h3>\n
B. Hacked systems, personal data and criminal complaint: CNIL notification, prison sentences and compensation<\/h3>\n
Conclusion<\/h2>\n