A cyberattack has caused the temperature of the refrigeration systems in hundreds of French supermarkets to rise to 50 °C, resulting in millions in losses. It was not necessary to attack their financial systems or shut down their corporate servers. All it took was manipulating a connected technical system.
This incident demonstrates why cybersecurity can no longer be limited to protecting data and computers. It must also protect the processes that enable a company to operate. And this is precisely where the NIS2 Directive comes into its own.
What Happened at French Supermarkets
During the night of October 11–12, 2026, a cyberattack affected the refrigeration systems of numerous supermarkets in France, including stores operated by Intermarché, Netto, Coopérative U, and E.Leclerc.
The attackers managed to remotely manipulate the refrigeration control systems, triggering defrost cycles and raising temperatures to 50 °C. The consequences were immediate: fresh and frozen food rendered unusable, operational disruptions, damage to facilities, and financial losses that could amount to several million euros.
According to initial reports, the incident affected hundreds of businesses. French authorities have launched an investigation to determine the scope of the attack, identify those responsible, and determine how they gained access.
Published reports point to refrigeration control systems manufactured by Danfoss and possible vulnerabilities in older versions of the software, which have yet to be confirmed. However, the investigation is ongoing, and the technical details and specific responsibilities have yet to be clarified.
At the same time, cyber incidents have been reported at the Albert Heijn chain in the Netherlands and the Delhaize chain in Belgium, both part of the Ahold Delhaize group. At this time, there is no confirmed link between these incidents and the attack in France.
The most significant aspect for any company is that the attack did not require compromising the ERP, accounting, or customer databases. The target was the technology systems that controlled a physical process essential to the business.
And that changes the way we understand cybersecurity.
An example of why NIS2 exists
When we talk about cyberattacks, we usually think of ransomware, data theft, personal data breaches, or website outages. But what happens when a cyberattack prevents food from being preserved, halts a production line, shuts down a hospital’s HVAC system, or paralyzes an automated warehouse?
In these cases, the problem is no longer solely technological. It becomes an issue of business continuity, security, and financial losses.
Directive (EU) 2022/2555, known as NIS2, aims precisely to enhance organizations’ ability to prevent, withstand, and respond to incidents that compromise the security of their networks and information systems and the continuity of their services.
It does not replace the General Data Protection Regulation (GDPR), but rather addresses different and complementary risks. The GDPR protects personal data. NIS2 establishes cybersecurity risk management and incident reporting obligations for certain entities, even if there is no leak of personal information.
The French case highlights three particularly important aspects.
1. Industrial technology is also part of cybersecurity
Refrigeration, HVAC, access control, alarm, and industrial automation systems are all part of what is known as operational technology (OT). Increasingly, this equipment is connected to computer networks and can be managed remotely.
This makes maintenance easier and helps optimize costs, but it also introduces new attack vectors.
A company may have its servers protected, its employees using multi-factor authentication, and its computers up to date, while still maintaining an industrial system accessible from the Internet that runs outdated software.
The security of the corporate environment does not automatically guarantee the security of its operational systems.
2. Vendors are also part of the security perimeter
Many companies outsource the maintenance of their technical facilities. The provider of refrigeration, HVAC, or automation services may have remote access to monitor equipment, adjust settings, or resolve issues. That access can become a point of entry if it is not properly protected.
The entire chain of access used in the French attack has not yet been publicly determined. But the incident illustrates a known risk: the exposure of connected operational systems and reliance on third-party technologies and services.
Article 21.2.d of NIS2 requires entities subject to the Directive to adopt measures regarding supply chain security, including security aspects of their relationships with their direct suppliers and service providers.
This means that contracting a third party does not eliminate the need to manage the risks associated with its activities.
3. A cyber incident can have physical consequences
The most striking aspect of the attack is that a computer command ended up destroying merchandise. A refrigeration system must have controls in place to prevent it from operating outside safe conditions, even when it receives incorrect or malicious commands.
Protection should not rely solely on software. Depending on the system, separate safeguards, alarms, temperature monitoring, shutdown mechanisms, and manual intervention procedures may be necessary.
Cybersecurity and operational security must work together.
The question is no longer just whether someone can break into our systems, but what could physically happen if they manage to do so.
Would a Spanish supermarket be required to comply with NIS2?
It is important to note a key distinction here. NIS2 includes the production, processing, and distribution of food among its sectors, as set forth in Annex II of the Directive.
However, its scope does not automatically include every establishment that sells food. The European text specifically refers to food businesses engaged in wholesale distribution and industrial production and processing.
Therefore, a supermarket engaged exclusively in retail sales is not included based on that activity alone.
The situation may be different for a large chain that also engages in wholesale distribution, production, or industrial processing through its own corporate structure. In such cases, it will be necessary to analyze the actual activities, the legal entities involved, their size, and the application criteria set forth in the regulations.
It is not enough to simply state that an organization is large or that it has logistics centers to automatically conclude that it is subject to the requirement.
But there is another issue that is even more relevant.
NIS2 also indirectly affects companies that are not subject to the regulation
Let’s imagine a company with 150 employees that specializes in industrial refrigeration maintenance. Its customers include large logistics operators, food manufacturers, and retail chains. Although this company is not directly covered by NIS2, some of its customers may be.
And those clients will have to manage the cybersecurity risks in their supply chain. In practice, they may impose contractual requirements such as:
- Multifactor authentication for remote access.
- Identification and authorization of technicians involved.
- Vulnerability and update management.
- Logging of accesses and actions.
- Incident reporting procedures.
- Periodic security assessments.
- Evidence of the measures implemented.
As a result, NIS2 is being commercially extended to organizations that are not directly subject to the Directive.
Not because they all automatically assume the same legal obligations, but because their customers need assurances that they will fulfill their own obligations. This is one of the most significant changes that NIS2 introduces to business-to-business relationships.
NIS2 in Spain: Waiting for the Law Does Not Eliminate the Risk
The European deadline for transposing NIS2 expired on October 17, 2024.
On July 8, 2026, the European Commission announced its decision to refer Spain, France, Ireland, and the Netherlands to the Court of Justice of the European Union for failing to notify the Commission of the full transposition of the Directive.
In Spain, the government approved the preliminary draft of the Cybersecurity Coordination and Governance Act in January 2025, aimed at incorporating NIS2 into the national legal system.
As of the date of this article, transposition has yet to be completed.
This does not mean that NIS2 can be fully enforced against any Spanish private company as if a national transposition law were already in force. Directly enforceable obligations must be analyzed in accordance with the applicable legal framework, including existing cybersecurity regulations and contractual commitments.
But that doesn’t mean companies should wait either. There are three reasons to start preparing.
First: Customers are already passing on security requirements to their suppliers.
An organization required to manage its supply chain needs to understand the risks associated with the services it contracts.
Second: Adapting takes time.
Taking inventory of assets, evaluating suppliers, reviewing remote access, implementing controls, defining procedures, and training staff are activities that cannot be completed in a matter of weeks.
Waiting for the final publication of the law could turn a planned adaptation into an urgent and costly project.
Third: cyberattacks don’t wait for the Official State Gazette.
The risks that NIS2 aims to reduce already exist. The attack on French supermarkets is an example of their consequences.
The lack of full implementation does not prevent a company from suffering a similar incident tomorrow.
Three practical lessons for any company
The French case offers three lessons applicable both to organizations subject to NIS2 and to those that want to improve their prevention and response capabilities.
Lesson 1: Your vendors with remote access are also part of your perimeter
A company may have a perfectly drafted vendor security policy and, at the same time, be unaware of how many external companies can connect to its facilities.
Let’s think about a factory. The machinery supplier accesses the system remotely to make adjustments. The HVAC supplier monitors the facilities. The alarm maintenance technician can modify settings, and another supplier manages the access control systems.
Each of these connections represents a dependency and a potential risk.
The organization should be able to answer five questions for each supplier:
- Who is authorized to access it?
- Which systems can it connect to?
- What authentication mechanism does it use?
- When did they last log in, and what did they do?
- Who can suspend or revoke that access?
It is not enough to simply have a list of approved suppliers.
It is necessary to identify access points, assess their criticality, establish security conditions, and periodically review authorizations.
For higher-risk access points, it is advisable to incorporate multi-factor authentication, least privilege, activity logs, temporary access, and immediate revocation mechanisms.
A vendor policy describes how the controls should function. Evidence of access demonstrates whether they actually work.
Lesson 2. If it’s not in the inventory, it’s unlikely to be protected
Many organizations maintain inventories of computers, servers, applications, and licenses. But do they also include their connected cold storage units, HVAC systems, industrial controllers, sensors, access devices, or remote maintenance equipment?
These assets are often managed by departments other than IT: maintenance, operations, production, or general services.
This can result in an incomplete view of the attack surface. The first step is to identify the technology assets involved in critical business processes.
Next, we need to analyze:
- What role do they play, and what impact would their unavailability have?
- What connections do they have with other networks and systems?
- Which providers can manage them.
- What vulnerabilities and dependencies they have.
- What controls are in place to limit their consequences.
In OT systems, it is also particularly important to examine network segmentation and independent protection mechanisms.
Not all devices can be updated or protected in the same way as a conventional computer. Therefore, security measures must be tailored to their technical and operational characteristics.
In the case of a cold storage room, for example, there should be mechanisms in place to detect abnormal temperatures, generate alerts, and mitigate dangerous situations—without relying exclusively on the controller, which could be compromised.
The asset inventory is not just a paperwork formality. It is the starting point for determining what needs protection and why.
Lesson 3. When an incident occurs, the clock starts ticking
One of the best-known new features of NIS2 is its system for reporting significant incidents.
Article 23 establishes a tiered procedure for covered entities and incidents that meet the notification criteria.
| Deadline | Action |
|---|---|
| 24 hours | Early warning as soon as the significant incident is reported. |
| 72 hours | Notification including an initial assessment, severity, impact, and available indicators. |
| 1 month | Final report, including a description of the incident, probable causes, measures taken, and impact. |
The deadline for the final report is generally calculated from the submission of the 72-hour notification. The Directive also provides for interim reports and cases in which the investigation remains open.
Not all incidents must be reported under this procedure. It is necessary to determine whether they meet the criteria for a significant incident and to comply with the applicable regulations.
But the main operational problem arises before any notification is sent. Who detects the incident? Who assesses its severity? Who decides whether it should be reported? Who gathers the information? Who preserves the evidence?
If these responsibilities are not defined in advance, the first few hours may be wasted trying to organize the response.
The organization needs a procedure that allows it to log the incident, classify it, assign responsibilities, monitor deadlines, document decisions, and preserve evidence.
And the responsibility does not fall solely on the IT department.
Article 20 of NIS2 requires that the governing bodies of covered entities approve cybersecurity risk management measures, oversee their implementation, and receive appropriate training.
Cybersecurity is no longer purely a technical issue; it has also become a corporate governance responsibility.
Checklist: Would your company be prepared for a similar incident?
These six questions provide a preliminary assessment of an organization’s preparedness.
- Suppliers: Do we know which suppliers have remote access to our systems and what permissions each one has?
- Assessment: Have we assessed the cybersecurity risks of our critical suppliers over the past 12 months?
- Assets: Does our inventory include OT and IoT systems, in addition to servers, applications, and computers?
- Incidents: Do we have a procedure that addresses 24-hour, 72-hour, and one-month deadlines when applicable?
- Management: Has management approved the risk management measures and is it overseeing their implementation?
- Continuity: Do we know how to maintain or recover our critical physical processes if one of our technological systems fails?
It’s not about getting six “yes” answers on a questionnaire. What matters is being able to back up each answer with up-to-date information, identified responsible parties, and verifiable evidence.
Because a company may claim that it controls its suppliers’ access, but it may not have a log that shows who logged into a system in the early morning hours.
And that difference can prove decisive when an incident occurs.
From Documentary Compliance to Operational Compliance
The attack on French supermarkets demonstrates that cybersecurity risks can materialize far beyond traditional IT systems. A cold storage room, an industrial controller, or a remote maintenance access point can become the starting point for an incident with significant economic and operational consequences.
NIS2 establishes a framework for managing these risks, but having policies and procedures in place does not, by itself, guarantee that they are working. The difference lies in execution.
It is not the same to have a vendor assessment policy as it is to know which vendors have been assessed, when, with what results, and what corrective actions are still pending. It is not the same to have an asset inventory as it is to know which critical systems depend on an external vendor and what controls have been implemented.
And having an incident procedure in place is not the same as being able to demonstrate when an incident was detected, who made each decision, and whether the applicable deadlines were met.
The difference between documentary compliance and operational compliance is moving from simply saying we comply to being able to demonstrate how we comply.
How Ithikios Can Help
At Ithikios, we work to enable organizations to manage their compliance obligations through defined processes, identified responsible parties, and verifiable evidence.
Our approach allows us to connect different activities that are traditionally managed in isolation:
- Third-Party Manager: approval, evaluation, and monitoring of suppliers, including risks associated with critical third parties.
- Risk Manager: identification and assessment of risks, linking them to assets, threats, and mitigation measures.
- Controls Manager: management of controls, responsible parties, tasks, and evidence, with mappings between frameworks such as NIS2, ISO 27001, and ENS.
- Incident Manager: recording, classification, and tracking of incidents, including assignment of responsible parties, deadlines, and traceability of actions.
These capabilities help organize and demonstrate compliance management, although they do not replace technical cybersecurity solutions or specific business continuity mechanisms. The goal is to ensure that security measures are not merely documented but are integrated into the organization’s day-to-day operations.
Because, after an incident, the important question won’t just be whether there was a security policy in place. It will be whether anyone knew who had access to the system, what controls had been implemented, and exactly what happened at 3:00 a.m.
That’s operational compliance: accountable people, defined processes, and evidence of what’s actually being done.
Find out how to manage compliance with NIS2, ISO 27001, and ENS with Ithikios: https://ithikios.com/compliance/
* Article enhanced with AI
