French Supermarket Cyber Attack: Does International Law Apply?
Introduction
The French supermarket cyber attack of October 11–12, 2026, disrupted refrigeration systems at hundreds of stores, including Intermarché, Carrefour, Coopérative U, and Monoprix. International law applies to cyber operations, particularly through treaties governing cybercrime and international cooperation. However, the available evidence does not establish that a foreign state conducted or directed this attack, or that it constituted a prohibited use of force under the UN Charter (Marchandon and Stargardter, 2026; United Nations, 1945).
The attackers reportedly manipulated connected refrigeration equipment, causing temperatures in affected Intermarché units to reach 50°C for approximately six hours. Supermarkets were forced to discard large quantities of perishable food, while the Paris prosecutor's office confirmed an investigation into reported damage, including food losses and fires. The precise causes of the reported fires and the full extent of the financial losses had not been established (AFP, 2026; Marchandon and Stargardter, 2026).
The operation targeted technology responsible for controlling physical equipment rather than conventional retail websites or payment systems. Refrigeration management systems manufactured by Danfoss were implicated, with the company identifying obsolete equipment and outdated firmware among affected installations. Although the systems involved have been identified, the precise method used to gain unauthorized control has not been conclusively established. The incident illustrates how interference with operational technology can cause physical and economic damage beyond the compromised computer systems (AFP, 2026).
The Budapest Convention on Cybercrime provides an established legal framework for criminalizing specified forms of unauthorized computer activity and facilitating cooperation between national authorities (Council of Europe, 2001). Separate principles govern cyber operations attributable to states. Article 2(4) of the UN Charter prohibits the threat or use of force in international relations, while Article 51 recognizes the right of self-defense in response to an armed attack. The International Court of Justice has distinguished armed attacks from less grave uses of force, making the scale and effects of an operation legally significant (ICJ, 1986).
State responsibility raises a further question. Under Article 2 of the International Law Commission's Articles on Responsibility of States for Internationally Wrongful Acts, responsibility requires conduct attributable to a state and a breach of an international obligation (ILC, 2001). Neither condition can be presumed from the sophistication of an attack or the location of the affected equipment. With the perpetrators publicly unidentified as of October 12, the French supermarket incident remains principally a criminal investigation, while its possible implications for territorial sovereignty, state responsibility, and the international prohibition on force depend on evidence that has yet to emerge.
1. What Happened in the French Supermarket Cyber Attack?
During the night of October 11–12, 2026, a large-scale cyberattack disrupted refrigeration systems at hundreds of supermarkets across France. Attackers remotely manipulated connected equipment, causing refrigerators, freezers, and cold-storage installations to reach abnormally high temperatures. By Monday morning, employees at affected stores were removing spoiled merchandise, inspecting damaged equipment, and attempting to restore refrigeration services (Marchandon and Stargardter, 2026).
The disruption affected several major retail networks, including Intermarché, Netto, Coopérative U, Carrefour, and Monoprix. Les Mousquetaires initially reported approximately 150 affected Intermarché stores, while subsequent French reporting identified around 300 establishments across the wider Intermarché and Netto network. Coopérative U reported disruption at approximately 100 outlets, and Carrefour confirmed that 80 supermarkets had been affected. Monoprix also reported incidents affecting part of its network (Chaperon et al., 2026).
Several E.Leclerc establishments experienced related refrigeration problems, although reporting indicated that the disruption involved equipment supplied or maintained by an external provider. This distinction is relevant because the involvement of a retailer does not necessarily establish that attackers gained access to its internal corporate network. The incident concerned equipment used by different businesses, some of which depended on related refrigeration management technology.
The number of affected stores remained subject to revision throughout October 12. Different figures reflected the reporting periods, retail brands, and organizational boundaries used by individual companies. In particular, the earlier Intermarché count and the subsequent combined Intermarché/Netto figure should not be added together. The available reporting establishes a widespread disruption but does not provide a definitive national total.
The physical consequences were substantial. Les Mousquetaires reported that refrigeration equipment in affected Intermarché stores reached approximately 50°C for six hours. Le Monde described manipulation of defrost cycles, including their extension from one hour to eight hours, which delayed the detection of abnormal conditions. In one establishment at La Haye, temperatures reportedly reached 80°C, damaging equipment exposed to excessive heat (Chaperon et al., 2026).
These observations concerned particular installations and cannot be treated as uniform measurements across the affected networks. Nevertheless, the interruption of refrigeration compromised the cold chain, requiring businesses to discard perishable merchandise even where equipment could subsequently be restored. Some stores temporarily closed sections of their premises while employees removed stock and assessed damage.
The financial consequences were immediately apparent at individual establishments. An Intermarché operator in Gradignan reported approximately €21,000 in merchandise losses at purchase cost. Industry representatives anticipated losses reaching millions of euros nationally, but those estimates remained preliminary. The Paris prosecutor's office also reported fires associated with the incident, although the precise causes, number of incidents, and extent of resulting physical destruction had not been conclusively established (Marchandon and Stargardter, 2026).
France's Office anti-cybercriminalité (OFAC) was entrusted with the criminal investigation opened by the Paris prosecutor's office. Investigators were tasked with identifying affected businesses and establishing the relationship between unauthorized interference and the reported damage. Prime Minister Sébastien Lecornu also instructed the Agence nationale de la sécurité des systèmes d'information (ANSSI), France's national cybersecurity authority, to investigate the technical circumstances of the attack.
French authorities began coordinating with European counterparts amid concerns that similar disruptions might extend beyond France. A separate cybersecurity incident affected the Dutch retailer Ahold Delhaize, including services associated with Albert Heijn. The company stated that there was no reason to connect its incident with the French refrigeration attack. No publicly established evidence as of October 12 identified the French attackers, their geographical location, or any government responsible for directing the operation.
2. How Were French Supermarket Refrigerators Hacked?
The French supermarket attack targeted operational technology rather than conventional retail websites or payment systems. Operational technology comprises computer-controlled systems used to monitor and regulate physical equipment. In commercial refrigeration, these systems manage temperatures, operating schedules, defrost cycles, alarms, and maintenance functions across multiple refrigeration units.
Large supermarkets commonly rely on centralized management systems that allow technicians to monitor equipment remotely. Such arrangements make it possible to adjust refrigeration settings or diagnose faults without visiting every installation. Remote administration also creates potential security vulnerabilities when management interfaces are exposed to external networks, credentials are compromised, or software protections become outdated.
The reported interference involved unauthorized changes to refrigeration controls. Defrost cycles are ordinary operational procedures used to prevent ice accumulation, but their timing and duration must remain compatible with safe food storage. Extending these cycles or modifying temperature parameters can interrupt cooling long enough to compromise refrigerated merchandise. According to Le Monde, the attackers altered defrosting operations and delayed alarms, allowing abnormal conditions to persist before employees detected the problem (Chaperon et al., 2026).
Danfoss, the Danish manufacturer of refrigeration management equipment, acknowledged incidents involving its systems in France. AFP identified the AK-SM800 and AK-SC355 among the legacy products implicated in the disruption. Danfoss also reported outdated firmware in affected installations and emphasized that some older products no longer received software or security updates (AFP, 2026).
The security of such equipment had previously attracted attention. In March 2025, Danfoss published advisory DSA-2025-03-01 concerning CVE-2025-41450, an authentication weakness affecting its AK-SM 8xxA series. The manufacturer identified firmware version 4.2 as the remedy. In August 2025, advisory DSA-2025-08-01 documented two further vulnerabilities, CVE-2025-41451 and CVE-2025-41452, involving command injection and unauthorized manipulation of web-interface configuration. Danfoss identified firmware version 4.3.1 as the relevant corrective release (Danfoss, 2025a; 2025b).
In August 2026, Claroty's Team82 published additional research examining the AK-SM 800A refrigeration management platform. Researcher Amir Zaltzman described weaknesses affecting the system's management interface and the potential consequences of unauthorized access. The findings demonstrated how vulnerabilities in centralized refrigeration controls could expose multiple connected devices to operational interference (Zaltzman, 2026).
The implicated refrigeration technology and several previously documented security weaknesses have been identified, but the precise vulnerability or access mechanism exploited during the October attack has not been conclusively established. The AK-SM 800A platform examined by Claroty is not interchangeable with every legacy model identified in the French incident. Published security advisories explain potential avenues of intrusion without proving that attackers used any particular documented vulnerability.
The distinction is significant because an attacker does not necessarily need to destroy computer hardware to cause physical damage. Altering operating parameters may be sufficient to interrupt cooling, compromise merchandise, or expose equipment to excessive temperatures. The resulting consequences can extend beyond the affected computer system into the physical environment.
The French incident consequently illustrates a cyber-physical operation: interference conducted through digital systems that produces effects on physical equipment and property. This technical description does not determine whether the conduct constitutes cyberwarfare, a prohibited use of force, or an internationally wrongful act. Those classifications depend on separate legal requirements, particularly the operation's consequences and its relationship to a state.
3. Does International Law Apply to the Attack?
International law applies to activities conducted through computer networks, including operations involving privately owned infrastructure. The United Nations Groups of Governmental Experts affirmed that existing international law, particularly the UN Charter, applies to state conduct involving information and communications technologies (United Nations, 2015; 2021). The central question is which legal obligations are engaged by the conduct and circumstances of a particular operation.
The French supermarket attack presents several distinct legal relationships. Unauthorized interference with computer systems may constitute an offense under French criminal legislation. Where evidence or suspects are located abroad, international treaties can provide mechanisms for cooperation between national authorities. These rules do not require proof that the perpetrators acted on behalf of a government.
Public international law governing interstate conduct raises additional questions. A cyber operation directed against privately owned equipment may violate obligations owed by one state to another if the conduct is legally attributable to a state and satisfies the requirements of the relevant prohibition. Private ownership does not remove commercial infrastructure from the protection of international law.
The geographical distribution of computer infrastructure complicates that assessment. Refrigeration equipment may be located in France while the manufacturer, maintenance provider, hosting service, and communication infrastructure are situated in different jurisdictions. An internet address associated with malicious activity may identify an intermediary server rather than the perpetrator's physical location. Such evidence can assist investigators without necessarily establishing governmental involvement.
Different international prohibitions also operate according to different legal standards. Territorial sovereignty concerns the rights of states within their territory. The prohibition of intervention addresses coercive interference in matters reserved to a state's independent decision-making. Article 2(4) of the UN Charter regulates threats or uses of force, while Article 51 addresses self-defense following an armed attack.
These distinctions are particularly relevant where cyber operations cause economic loss or physical damage. An operation may engage criminal cooperation obligations without constituting a prohibited interstate use of force. Conversely, conduct attributable to a foreign state may breach an international obligation without reaching the armed-attack threshold. The classification of the French incident cannot be determined solely by the number of supermarkets affected or the commercial value of destroyed merchandise.
The Budapest Convention provides the clearest established international legal framework connected to the reported conduct. Questions of sovereignty, state responsibility, and the use of force remain conditional on evidence concerning the perpetrators and the full consequences of the operation. The absence of publicly established foreign-state attribution does not diminish the seriousness of the criminal investigation, but it limits the conclusions that can presently be drawn under the law governing relations between states.
4. Cybercrime and the Budapest Convention
The Convention on Cybercrime, adopted in Budapest on November 23, 2001, establishes an international framework for addressing specified offenses involving computer systems and electronic data. Developed under the Council of Europe, it requires participating states to criminalize certain forms of unauthorized conduct and provides mechanisms for investigating offenses with international dimensions.
France deposited its instrument of approval on January 10, 2006, and the Convention entered into force for the country on May 1, 2006. The treaty is relevant to the supermarket incident because its provisions concern unauthorized access, interference with computer data, and disruption of computer-system operations. Its application does not depend on whether the targeted equipment belongs to a public authority or a private business (Council of Europe, 2001).
The Convention does not itself impose criminal sentences on individual hackers. It requires participating states to establish appropriate offenses and investigative powers through domestic law. The legal responsibility of a suspect is determined under the applicable national legislation, subject to the elements of the offense, jurisdictional requirements, and relevant procedural guarantees.
4.1 Illegal Access, Data Interference, and System Interference
Article 2 of the Budapest Convention addresses intentional access to all or part of a computer system without authorization. If investigators establish that the attackers entered refrigeration management systems without permission, the conduct may fall within the category addressed by this provision. The applicable national offense must still be established according to its own legal requirements.
Article 4 concerns intentional and unauthorized interference with computer data, including alteration, deletion, deterioration, or suppression. Refrigeration controllers rely on stored configurations that determine temperatures, operating schedules, and alarm conditions. Unauthorized modification of those settings may constitute data interference, even where the computer system remains operational. Article 4 also permits participating states to reserve the right to require serious harm as a condition of criminalization (Council of Europe, 2001, Art. 4).
Article 5 addresses serious interference with the functioning of a computer system through specified forms of manipulation of computer data. The reported disruption of refrigeration management systems may be relevant to this provision. Its seriousness requirement concerns interference with computer-system functioning and must be assessed under the applicable criminal law. Financial losses may form part of the factual circumstances, but they do not independently establish every element of system interference.
French criminal law contains corresponding provisions in Articles 323-1 to 323-3 of the Penal Code. Article 323-1 criminalizes fraudulent access to or remaining within an automated data-processing system. Article 323-2 concerns obstruction or distortion of a system's functioning, while Article 323-3 addresses specified fraudulent operations involving computer data, including its introduction, extraction, alteration, and deletion (France, Penal Code, Arts. 323-1–323-3).
The same cyber operation may involve several forms of conduct. Obtaining unauthorized access, changing stored configurations, and impairing system operations are analytically distinct acts, even where they form part of a continuous sequence. Their criminal classification depends on the evidence and the elements prescribed by the applicable legislation.
The physical consequences of the French attack may also be relevant to other domestic offenses involving property damage. Nevertheless, neither the opening of an investigation nor the destruction of merchandise establishes the precise charges that prosecutors will pursue. Criminal responsibility requires proof of the applicable offense, not merely evidence that an affected business suffered losses.
4.2 Cross-Border Evidence and Criminal Cooperation
Cybercrime investigations frequently involve electronic evidence distributed across several jurisdictions. A system physically located in France may communicate with servers abroad, while administrative access may pass through commercial hosting services or compromised intermediary devices. Investigators must distinguish the location of the affected equipment from the location of the person controlling the malicious operation.
The Budapest Convention provides mechanisms for addressing these difficulties. Article 16 requires participating states to establish powers for the expedited preservation of specified stored computer data. Article 29 provides for requests between participating states to preserve relevant data located in another state's territory. These measures can help prevent evidence from being deleted or altered before investigators obtain it through the appropriate legal procedures (Council of Europe, 2001).
Preservation does not itself grant unrestricted access to the relevant information. Obtaining electronic evidence may require separate procedures under domestic law or international mutual assistance arrangements. Article 31, for example, addresses requests concerning access to stored computer data located within the territory of another participating state.
Article 35 establishes a network of contact points available continuously to facilitate urgent cooperation. The network can assist with technical advice, preservation of electronic evidence, and the identification of suspects. Its operation remains subject to the Convention's requirements and applicable national law.
These mechanisms could become relevant if evidence concerning the supermarket attack is held by a foreign service provider or located on infrastructure outside France. Their usefulness would depend on identifying the relevant jurisdiction, determining the applicable procedural conditions, and obtaining cooperation from the authorities concerned.
The Convention does not authorize unrestricted unilateral investigative operations inside another state's territory. Its cross-border provisions operate within defined limits, including specific circumstances involving publicly available data or lawful voluntary consent under Article 32. International cooperation must respect the conditions established by the Convention and applicable law.
Criminal investigation and state responsibility remain separate questions. Establishing that a hacker operated from another country does not automatically attribute the conduct to that country's government. The Budapest Convention can facilitate investigation and prosecution even when the perpetrators are independent private actors.
5. Territorial Sovereignty and Foreign Cyber Operations
Territorial sovereignty protects the authority and independence of states within their territory. Its application to cyber operations becomes relevant when digital interference originating outside a country produces effects on systems or equipment located inside it. In the French supermarket incident, the affected refrigeration installations were physically situated in France, regardless of the geographical location of their manufacturers or remote-management services.
France has expressly recognized that existing international law applies to operations conducted in cyberspace. In its 2019 position on international law applicable to cyber operations, the French Ministry of the Armed Forces affirmed that France exercises sovereignty over information systems located within its territory. It also stated that unauthorized cyber operations attributable to foreign states may constitute violations of sovereignty, depending on the nature of the intrusion or its effects (France, 2019).
The French position gives particular significance to operations that interfere with systems located within national territory or produce physical consequences there. A foreign-state operation manipulating refrigeration equipment in France could consequently raise a sovereignty question even though the targeted facilities were privately owned. The relevant legal assessment would require the conduct to be attributable to a state and to violate an applicable international obligation.
The existence of a separate customary prohibition on all unauthorized interstate cyber intrusions remains contested. Some states recognize sovereignty as an independently applicable rule capable of being violated through particular cyber operations. The United Kingdom has expressed a narrower interpretation, maintaining that sovereignty is a fundamental principle but does not, by itself, establish an additional general prohibition beyond sufficiently recognized rules such as non-intervention (United Kingdom, 2021).
These differences should not be interpreted as disagreement over the existence of sovereignty itself. The dispute concerns which specific prohibitions arise from the principle and the circumstances in which remote cyber interference breaches them. Official national positions contribute to the assessment of customary international law, but no single state's interpretation settles the question for all others.
The customary prohibition of intervention establishes a distinct legal standard. In Military and Paramilitary Activities in and against Nicaragua, the International Court of Justice explained that prohibited intervention concerns matters a state is entitled to decide freely, including its political, economic, social, and cultural system. Coercion is an essential element of the prohibited conduct (ICJ, 1986, para. 205).
An operation damaging commercial refrigeration systems does not necessarily constitute coercive interference in French governmental decision-making. Its legal classification would depend on the perpetrators' objectives and the circumstances of the operation. A cyberattack designed to compel a government to change a protected policy decision could raise different questions from one undertaken for criminal profit or commercial disruption.
No publicly established evidence concerning the October 2026 incident demonstrated such a coercive objective. The substantial economic consequences also do not establish foreign-state involvement. Sovereignty and prohibited intervention remain relevant legal frameworks, but neither provides a basis for assigning international responsibility without the required factual and legal elements.
6. Can the Cyberattack Constitute a Use of Force?
Article 2(4) of the UN Charter prohibits states from threatening or using force against the territorial integrity or political independence of another state, or in any other manner inconsistent with the purposes of the United Nations. The provision is not limited to weapons employing conventional physical mechanisms. Cyber operations may fall within its scope where the conduct and its consequences satisfy the relevant legal requirements (United Nations, 1945).
The principal difficulty is distinguishing harmful cyber activity from a prohibited interstate use of force. Computer operations can produce consequences ranging from temporary service interruptions to extensive physical destruction. Their legal classification depends on the nature and severity of the conduct, its effects, and the relationship between the operation and the state whose responsibility is in question.
The French supermarket attack produced commercial losses and reports of physical damage. These consequences justify examining the prohibition on force, but they do not independently establish that the threshold was crossed. The available evidence must be assessed according to the relevant international legal standards rather than the ordinary meaning of the term cyberattack.
6.1 Physical Damage and Article 2(4) of the UN Charter
An established approach to assessing cyber operations considers whether their effects are comparable to those resulting from conventional uses of force. Operations causing significant physical destruction, injury, or death present stronger grounds for classification under Article 2(4) than activities producing temporary inconvenience or economic disruption alone. The United Kingdom's 2021 statement expressly recognized that cyber operations may constitute uses of force where their actual or threatened effects are comparable to those of conventional means (United Kingdom, 2021).
France has also adopted an effects-based approach. Its 2019 position recognizes that cyber operations may constitute prohibited uses of force depending on their severity and consequences. Physical destruction is relevant, but the assessment must consider the particular circumstances rather than apply an automatic rule based solely on the presence of damage (France, 2019).
The French supermarket incident involved several different categories of harm. Merchandise was destroyed because refrigeration conditions became unsafe, producing immediate economic losses. Equipment reportedly overheated, and authorities investigated fires associated with the disruption. These consequences cannot be treated as legally identical without examining their causes and extent.
Food spoilage may represent substantial property loss, but the financial value of discarded merchandise does not automatically determine whether an operation constitutes force. Physical destruction of equipment and injuries may carry different significance in an effects-based assessment. Evidence concerning the number of damaged installations, the extent of destruction, and any harm to individuals would be necessary for a more definitive classification.
The scale of the operation also requires care. The compromise of hundreds of commercial establishments may produce significant aggregate losses while causing limited physical destruction at individual sites. The number of affected locations is relevant to the overall consequences, but it is not an independent legal test for prohibited force.
The present evidence does not establish the complete extent of physical damage or the causal relationship between malicious commands and every reported fire. Nor does it identify a foreign state responsible for the operation. These limitations prevent a definitive finding that the attack violated Article 2(4), notwithstanding the seriousness of its consequences for affected businesses.
6.2 The Armed Attack Threshold and Self-Defense
Article 51 of the UN Charter recognizes the inherent right of individual or collective self-defense if an armed attack occurs against a member state. The International Court of Justice has distinguished armed attacks from less grave uses of force. In Nicaragua v. United States, the Court identified the gravest forms of force as armed attacks, establishing a distinction relevant to determining when self-defense may lawfully be invoked (ICJ, 1986, para. 191).
The Court addressed related questions in Oil Platforms, examining whether the attacks attributed to Iran satisfied the conditions necessary for the United States to rely on self-defense. The judgment also emphasized necessity and proportionality as requirements governing defensive measures. These are separate conditions: the necessity and proportionality of a response cannot compensate for the absence of an armed attack (ICJ, 2003, paras. 51, 73–77).
Cyber operations may potentially satisfy the armed-attack threshold where their scale and effects are comparable to sufficiently grave conventional attacks. Extensive destruction of physical infrastructure or serious injury could be relevant to that assessment. The digital method of execution does not exclude the possibility that an operation constitutes an armed attack.
The consequences reported in France do not presently establish that threshold. The attack disrupted refrigeration systems and destroyed merchandise, while the extent of associated physical damage remained under investigation. Substantial commercial losses, without more, do not establish an armed attack under Article 51.
The position of cyber operations conducted by non-state actors raises additional legal questions. States and legal commentators differ over aspects of self-defense against such actors, particularly where force would be used within another state's territory without its consent. Those disagreements do not establish a general entitlement to respond militarily to cybercrime.
International humanitarian law requires a separate analysis. It governs conduct during armed conflicts and may apply to cyber operations forming part of an existing conflict or contributing to the initiation of one, where the applicable classification requirements are satisfied. A preexisting armed conflict is not necessarily required for the law of international armed conflict to become applicable.
Nevertheless, the existence of harmful digital interference does not itself establish an armed conflict. No publicly established evidence connected the French refrigeration attack to hostilities between states or otherwise demonstrated the conditions necessary for applying international humanitarian law. Describing the incident as cyberwarfare would consequently imply a legal characterization that the available facts do not support.
7. State Responsibility and Attribution of the Attack
International responsibility arises when conduct attributable to a state breaches an international obligation binding upon it. Article 2 of the International Law Commission's Articles on Responsibility of States for Internationally Wrongful Acts identifies these requirements. Adopted in 2001, the Articles contain rules that codify customary international law to differing degrees, alongside provisions reflecting progressive development (ILC, 2001).
In cyber operations, identifying the technical origin of malicious activity is different from establishing legal attribution. Investigators may identify software, network infrastructure, individual operators, or intermediary servers used to transmit commands. Such findings can be relevant to criminal investigations, but they do not necessarily establish that the conduct is attributable to a government.
This distinction is central to the French supermarket incident. The coordination of attacks against several retail networks does not establish state sponsorship. Neither the sophistication of the operation nor the geographical location of a compromised server independently satisfies the rules governing attribution under international law.
7.1 Private Hackers, State Control, and Attribution
Article 4 of the ILC Articles attributes the conduct of state organs to the state, irrespective of whether those organs exercise legislative, executive, judicial, or other functions. Conduct performed by a state intelligence service or another governmental body may consequently be attributable to the state when the relevant legal conditions are satisfied.
Article 7 addresses circumstances in which a state organ, or an entity empowered to exercise governmental authority, exceeds its authority or contravenes instructions while acting in that capacity. The fact that an operation was unauthorized under domestic instructions does not necessarily exclude attribution. The relevant question concerns the person's official capacity and the circumstances in which the conduct occurred (ILC, 2001, Art. 7).
Article 8 concerns persons or groups acting on a state's instructions or under its direction or control. The International Court of Justice examined the attribution of non-state conduct in Nicaragua v. United States and subsequently addressed the effective-control standard in Application of the Genocide Convention (Bosnia and Herzegovina v. Serbia and Montenegro). The Court emphasized the need to establish control or instructions relating to the operation in which the alleged violation occurred, rather than relying solely on general relationships between a state and a group (ICJ, 1986; 2007, paras. 398–401).
The distinction prevents political or organizational associations from automatically becoming legal attribution. Financial assistance, shared objectives, ideological sympathy, or the provision of technical resources may be relevant evidence, but they do not necessarily establish the control required under Article 8. The applicable test must be satisfied in relation to the conduct at issue.
Article 11 establishes another possible basis for attribution where a state acknowledges and adopts conduct as its own. This requires more than public approval or a favorable political reaction. The conduct must be acknowledged and adopted in a manner satisfying the legal requirements of the provision.
No publicly established evidence concerning the French attack identified a state organ responsible for the interference, demonstrated governmental instructions or control, or established subsequent adoption by a state. These evidentiary limits prevent attribution under the rules examined.
If an internationally wrongful act were established, the responsible state could be required to cease continuing wrongful conduct and provide reparation for legally attributable injury. Articles 30 and 31 of the ILC Articles address cessation, assurances of non-repetition where appropriate, and the obligation to make full reparation (ILC, 2001).
Such consequences depend on establishing both attribution and breach of an applicable international obligation. Criminal responsibility of individual perpetrators would remain a separate matter, governed by the relevant criminal legislation and procedures.
7.2 Territorial Due Diligence and Cyber Operations
A different question concerns the obligations of a state from whose territory private actors conduct harmful operations against another country. Even where private conduct cannot be attributed to the territorial state, responsibility may arise from the state's own failure to comply with an applicable international obligation. The legal basis and conditions of such responsibility must be established independently.
In Corfu Channel, the International Court of Justice recognized that states must not knowingly allow their territory to be used for acts contrary to the rights of other states.
The judgment concerned mines in Albanian territorial waters and Albania's responsibilities arising from its knowledge of the danger. The Court's reasoning has influenced subsequent discussion of territorial obligations, although it did not address computer networks or cyber operations (ICJ, 1949).
The application of due diligence to cyberspace remains contested. Some states regard existing customary international law as imposing obligations to take appropriate measures against harmful cyber activity originating from their territory. Others question whether sufficient state practice and acceptance as law establish a distinct customary cybersecurity due diligence obligation.
The United Kingdom's 2021 statement illustrates this disagreement. It recognizes the importance of states taking reasonably available measures against harmful cyber activity but does not consider the existing evidence sufficient to establish a specific customary due diligence obligation applicable to cyberspace. This distinction separates non-binding expectations of responsible conduct from legally binding obligations (United Kingdom, 2021).
Responsibility for a state's own omission would differ from attributing the private attackers' operation to that state. A legal assessment would require identifying an applicable obligation, establishing the relevant knowledge and circumstances, and determining whether the state failed to perform the conduct required by that obligation.
The French incident does not presently permit such an assessment. The attackers' geographical location has not been publicly established, and no evidence demonstrates that a foreign government possessed the relevant knowledge or failed to undertake legally required measures. Territorial due diligence remains a possible avenue of analysis rather than an established basis for international responsibility.
8. EU Cybersecurity Law and French Food Infrastructure
The French supermarket attack also raises questions under European Union legislation concerning cybersecurity and the resilience of essential services. Two instruments are particularly relevant: Directive (EU) 2022/2555, known as NIS2, and Directive (EU) 2022/2557 on the resilience of critical entities. Both were adopted in December 2022, but they address different aspects of infrastructure protection.
NIS2 establishes cybersecurity risk-management and incident-reporting requirements for entities falling within its scope. The Critical Entities Resilience Directive concerns the ability of designated entities to maintain essential services during disruptive incidents. Neither instrument automatically classifies every supermarket as critical infrastructure or establishes a legal violation whenever connected equipment is compromised.
Their application must also be assessed against the French legal framework in force at the time of the attack. France had not completed its legislative transposition of the two directives by October 12, 2026. The relevant bill, concerning the resilience of critical infrastructure and the strengthening of cybersecurity, was adopted by the Senate on March 12, 2025, and remained under consideration in the National Assembly (French Senate, 2025; French National Assembly, 2026).
8.1 NIS2 and Cybersecurity in the Food Sector
Directive (EU) 2022/2555 seeks to establish a common level of cybersecurity across specified sectors within the European Union. Its provisions cover cybersecurity risk management, significant-incident reporting, supervisory arrangements, and cooperation between competent authorities. The directive required member states to adopt the necessary implementing measures by October 17, 2024, and apply them from October 18, 2024 (European Union, 2022a, Art. 41).
The food sector is included within Annex II, but coverage is specifically defined. The directive identifies food businesses engaged in wholesale distribution and industrial production and processing. It does not automatically extend its food-sector classification to every establishment selling groceries directly to consumers.
Large retail groups may conduct different activities through separate legal entities. A supermarket operator may primarily engage in retail sales, while related companies undertake wholesale distribution, food processing, or other regulated operations. Coverage depends on the actual activities of the relevant entity, applicable size criteria, exceptions, and the rules governing its classification.
Article 21 requires covered entities to implement appropriate cybersecurity risk-management measures. These include policies addressing risk assessment, incident handling, business continuity, access control, and supply-chain security. Such requirements are relevant to organizations relying on externally maintained refrigeration equipment and connected industrial control systems.
Article 23 establishes obligations concerning the reporting of significant incidents by entities falling within the directive's scope. The reporting requirements depend on the applicable conditions and the significance of the incident for the services provided. A disruption affecting refrigeration equipment does not independently determine the reporting obligations of every retailer using that equipment.
France's incomplete transposition of NIS2 must be distinguished from cybersecurity legislation already in force. Law No. 2018-133 of February 26, 2018, implemented provisions associated with the original NIS framework and established obligations for designated operators of essential services and certain digital service providers. Decree No. 2018-384 of May 23, 2018, developed the corresponding rules concerning designation, cybersecurity measures, incident notification, and supervision (France, 2018a; 2018b).
Under that framework, operators of essential services were subject to specific designation procedures. The fact that a company provides economically important services does not automatically establish that it was designated. Determining whether the 2018 legislation applied to a particular business requires examination of its activities, legal status, and the relevant designation.
France also maintained a separate system for protecting activities of vital importance under the Defense Code. That framework concerned designated operators and specified infrastructure or systems meeting national criteria. Its relationship with the original NIS regime did not mean that all retailers were automatically subject to identical cybersecurity obligations.
The incomplete transposition of NIS2 did not erase existing French requirements. Equally, the directive's provisions cannot simply be treated as directly enforceable obligations against private supermarket operators in the absence of the necessary legal conditions. Any assessment of compliance must identify the regulated entity, the applicable legislation, and the obligations in force when the incident occurred.
The French supermarket attack demonstrates the relevance of these regulatory distinctions. Connected refrigeration systems may be operated by retailers, supplied by manufacturers, and maintained by external contractors. Responsibility for access controls, software updates, network security, and incident management may be distributed among different organizations. The occurrence of an attack does not, without further evidence, establish that any particular entity breached an applicable legal duty.
8.2 Critical Entities and Food Supply Resilience
Directive (EU) 2022/2557 establishes a framework for improving the resilience of entities providing essential services in specified sectors. Its approach extends beyond cybersecurity to include the capacity to prevent, withstand, respond to, and recover from disruptive incidents. The directive required member states to transpose its provisions by October 17, 2024, while establishing additional deadlines for implementing particular measures (European Union, 2022b).
Article 6 required member states to identify critical entities in the sectors and subsectors covered by the directive by July 17, 2026. Identification depends on substantive criteria, including the provision of essential services, the location of relevant infrastructure, and the potential for significant disruption. Sectoral inclusion is consequently distinct from formal identification as a critical entity.
The food sector is covered through a defined category of businesses. The directive identifies food businesses engaged exclusively in logistics and wholesale distribution and large-scale industrial production and processing. The wording does not automatically include every supermarket or ordinary retail establishment simply because it supplies food to consumers.
This distinction is relevant to the French incident. Supermarkets contribute to the preservation and distribution of perishable goods, but their economic importance alone does not establish their formal classification under the directive. A legal assessment would require identifying the relevant business entity, determining whether its activities fall within the specified category, and examining the applicable national identification process.
France maintained a system for protecting activities of vital importance before the adoption of the Critical Entities Resilience Directive. Established under the Defense Code, that system concerns activities whose disruption could seriously affect national interests and includes obligations for designated operators. Its existence must be distinguished from the additional resilience arrangements contemplated by the European directive.
The French transposition bill sought to adapt existing arrangements to the new European framework. The Senate approved the bill in March 2025, but the legislative process had not been completed by October 12, 2026. The directive's identification deadline had already passed, yet that circumstance does not establish that every potentially relevant French food business had been identified or become subject to the directive's full set of national obligations.
The attack nevertheless exposes a practical vulnerability within food-distribution infrastructure. Businesses operating independently may rely on related refrigeration management systems, common manufacturers, or external maintenance services. A weakness affecting widely deployed equipment can create operational risks across several commercial networks without requiring the compromise of a single centralized corporate system.
The distribution of technical responsibilities further complicates resilience. Refrigeration equipment may be owned by a retailer, configured by an installer, updated by a manufacturer, and monitored by an external maintenance provider. Each relationship may involve distinct contractual and regulatory obligations. Establishing legal noncompliance requires identifying those responsibilities and the applicable legal requirements.
The French incident demonstrates why European cybersecurity and resilience legislation distinguishes covered entities, essential services, and regulated activities. Serious disruption to food storage may justify regulatory scrutiny, but it does not establish that a particular supermarket, manufacturer, contractor, or public authority violated the law.
Also read
Conclusion
The French supermarket cyber attack of October 11–12, 2026, demonstrates how unauthorized interference with connected refrigeration systems can cause physical and economic consequences extending beyond computer networks. The disruption affected hundreds of establishments, destroyed perishable merchandise, and prompted investigations into reported equipment damage and fires. Its immediate consequences were commercial, but the technological circumstances also raised questions concerning the protection of infrastructure and the international regulation of cyber operations.
The Budapest Convention provides an established framework for criminalization and international cooperation in investigating such conduct. European Union legislation supplies an additional regulatory framework for qualifying entities, although its application in France depends on national implementation and existing legal requirements. Neither framework requires the incident to be classified as an armed attack or attributed to a foreign government.
The rules governing sovereignty, prohibited intervention, state responsibility, and the use of force require separate legal assessments. Their application depends on the conduct involved, its consequences, and the evidence connecting it to a state. No publicly established information as of October 12 identified a foreign government responsible for the attack or demonstrated that the operation satisfied the requirements for an armed attack or an armed conflict.
International law is relevant to the French supermarket incident, particularly through cybercrime cooperation and the legal regulation of state conduct in cyberspace. The established facts, however, do not justify classifying the operation as an internationally wrongful act attributable to an identified foreign state or as an armed attack under Article 51 of the UN Charter. Those conclusions would require evidence extending beyond the damage presently documented and the criminal investigation underway.
References
AFP (2026) ‘French supermarkets suffer refrigerator shutdown after “unprecedented” cyberattack’, Agence France-Presse, 12 October. [online]. Available at: https://www.afp.com/en/french-supermarkets-suffer-refrigerator-shutdown-after-unprecedented-cyberattack (Accessed: 12 October 2026).
Chaperon, I., Leloup, D., Pinaud, O., Rescan, M. and Reynaud, F. (2026) ‘Dans les supermarchés français, une journée noire après une cyberattaque massive visant des systèmes frigorifiques’, Le Monde, 12 October. [online]. Available at: https://www.lemonde.fr/economie/article/2026/10/12/journee-noire-dans-les-supermarches-francais-apres-une-cyberattaque-massive_6792763_3234.html (Accessed: 12 October 2026).
Council of Europe (2001) Convention on Cybercrime, ETS No. 185, adopted in Budapest on 23 November 2001, entered into force on 1 July 2004. Available at: https://www.coe.int/en-GB/web/conventions/full-list2?module=treaty-detail&treatynum=185 (Accessed: 12 October 2026).
Danfoss (2025a) DSA-2025-03-01: Improper Authentication Vulnerability in Danfoss AK-SM8xxA Series, Security Advisory, 24 March. [online]. Available at: https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01/ (Accessed: 12 October 2026).
Danfoss (2025b) DSA-2025-08-01: Post-Authentication Vulnerabilities – OS Command Injection RCE and Nginx Configuration Injection in Danfoss AK-SM8xxA Series, Security Advisory, 1 August. [online]. Available at: https://www.danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01/ (Accessed: 12 October 2026).
European Union (2022a) Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), Official Journal of the European Union, L 333, 27 December, pp. 80–152. Available at: https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng (Accessed: 12 October 2026).
European Union (2022b) Directive (EU) 2022/2557 of the European Parliament and of the Council of 14 December 2022 on the resilience of critical entities and repealing Council Directive 2008/114/EC, Official Journal of the European Union, L 333, 27 December, pp. 164–198. Available at: https://eur-lex.europa.eu/eli/dir/2022/2557/oj/eng (Accessed: 12 October 2026).
France (1994) Code pénal, Articles 323-1–323-3, as amended. Légifrance. Available at: https://www.legifrance.gouv.fr/codes/id/LEGISCTA000006149839/2026-02-02 (Accessed: 12 October 2026).
France (2018a) Loi n° 2018-133 du 26 février 2018 portant diverses dispositions d'adaptation au droit de l'Union européenne dans le domaine de la sécurité, Journal officiel de la République française, No. 0048, 27 February, Text No. 2. Available at: https://www.legifrance.gouv.fr/eli/loi/2018/2/26/2018-133/jo/texte (Accessed: 12 October 2026).
France (2018b) Décret n° 2018-384 du 23 mai 2018 relatif à la sécurité des réseaux et systèmes d'information des opérateurs de services essentiels et des fournisseurs de service numérique, Journal officiel de la République française, No. 0118, 25 May, Text No. 1. Available at: https://www.legifrance.gouv.fr/jorf/id/JORFSCTA000036939983 (Accessed: 12 October 2026).
France, Ministry of the Armed Forces (2019) Droit international appliqué aux opérations dans le cyberespace. Paris: Ministère des Armées. Available at: https://www.defense.gouv.fr/sites/default/files/ministere-armees/Droit%20international%20appliqu%C3%A9%20aux%20op%C3%A9rations%20dans%20le%20cyberespace.pdf (Accessed: 12 October 2026).
French National Assembly (2026) Commission spéciale chargée d'examiner le projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité, parliamentary proceedings and agenda, October 2026. [online]. Available at: https://www.assemblee-nationale.fr/dyn/17/organes/autres-commissions/commissions-speciales/cs-pjl-cybersecurite (Accessed: 12 October 2026).
French Senate (2025) Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité, Texte n° 78 (2024–2025), adopted in first reading on 12 March 2025. Paris: Sénat. Available at: https://www.senat.fr/leg/tas24-078.html (Accessed: 12 October 2026).
International Court of Justice (1949) Corfu Channel (United Kingdom of Great Britain and Northern Ireland v. Albania), Merits, Judgment of 9 April 1949, ICJ Reports 1949, p. 4. Available at: https://www.icj-cij.org/node/103099 (Accessed: 12 October 2026).
International Court of Justice (1986) Military and Paramilitary Activities in and against Nicaragua (Nicaragua v. United States of America), Merits, Judgment of 27 June 1986, ICJ Reports 1986, p. 14. Available at: https://www.icj-cij.org/node/103143 (Accessed: 12 October 2026).
International Court of Justice (2003) Oil Platforms (Islamic Republic of Iran v. United States of America), Judgment of 6 November 2003, ICJ Reports 2003, p. 161. Available at: https://www.icj-cij.org/index.php/node/103215 (Accessed: 12 October 2026).
International Court of Justice (2007) Application of the Convention on the Prevention and Punishment of the Crime of Genocide (Bosnia and Herzegovina v. Serbia and Montenegro), Judgment of 26 February 2007, ICJ Reports 2007, p. 43. Available at: https://www.icj-cij.org/node/103164 (Accessed: 12 October 2026).
International Law Commission (2001) Draft Articles on Responsibility of States for Internationally Wrongful Acts, with Commentaries, Report of the International Law Commission on the Work of Its Fifty-Third Session, UN Doc. A/56/10, Chapter IV, reproduced in Yearbook of the International Law Commission, 2001, Vol. II, Part Two. Available at: https://legal.un.org/ilc/reports/2001/english/content.pdf (Accessed: 12 October 2026).
Marchandon, L. and Stargardter, G. (2026) ‘Hackers heat French supermarket fridges, sparking fires and spoiling food’, Reuters, 12 October. [online]. Available at: https://www.reuters.com/business/retail-consumer/french-supermarket-chain-intermarche-hit-by-cyberattack-150-stories-targeted-2026-10-12/ (Accessed: 12 October 2026).
United Kingdom, Foreign, Commonwealth & Development Office (2021) Application of International Law to States' Conduct in Cyberspace: UK Statement, 3 June. London: Foreign, Commonwealth & Development Office. Available at: https://www.gov.uk/government/publications/application-of-international-law-to-states-conduct-in-cyberspace-uk-statement/application-of-international-law-to-states-conduct-in-cyberspace-uk-statement (Accessed: 12 October 2026).
United Nations (1945) Charter of the United Nations, signed at San Francisco on 26 June 1945, entered into force on 24 October 1945. Available at: https://www.un.org/en/about-us/un-charter (Accessed: 12 October 2026).
United Nations Group of Governmental Experts (2015) Group of Governmental Experts on Developments in the Field of Information and Telecommunications in the Context of International Security, Report transmitted by the Secretary-General, UN Doc. A/70/174, 22 July. New York: United Nations. Available at: https://digitallibrary.un.org/record/799853/files/A_70_174-EN.pdf (Accessed: 12 October 2026).
United Nations Group of Governmental Experts (2021) Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security, Report transmitted by the Secretary-General, UN Doc. A/76/135, 14 July. New York: United Nations. Available at: https://digitallibrary.un.org/record/3934214 (Accessed: 12 October 2026).
Zaltzman, A. (2026) ‘Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers’, Claroty Team82 Research, 9 August. [online]. Available at: https://blog.claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers (Accessed: 12 October 2026).