13/10/2026
From vulnerabilities in refrigeration equipment to the liability of business operators: the legal implications of a cyber incident with public health consequences
Cyberattacks are usually associated with data theft, the blocking of IT systems, unauthorised access to information or ransom demands for restoring access to data. Technological change, however, has substantially altered the nature of the risks. In an economy where industrial processes, technical installations and commercial infrastructure are controlled through interconnected IT systems, compromising a single piece of equipment can have direct consequences in the physical world.
A relevant example is the cyberattack reported in October 2026 on several supermarket chains in France. According to information published by the international press, the incidents affected refrigeration systems, causing temperatures in refrigerated display cases to rise, food products to deteriorate and, in some cases, fires to break out. Several retail networks were affected, and the French authorities opened investigations to establish the circumstances and causes of the incidents.
From a cybersecurity perspective, the significance of this case lies not only in the scale of the material damage, but above all in the nature of the systems compromised. Commercial refrigeration is an essential technical process for keeping food in proper condition. Where that process is controlled through equipment connected to IT networks, the security of those systems becomes part of the operational safety of the business.
Consequently, an incident that at first sight appears to belong solely to the IT domain may simultaneously have economic, operational, contractual, compliance and public health consequences.
This reality calls for a reconsideration of the way business operators assess cyber risks. Protecting IT infrastructure can no longer be treated as an isolated activity falling solely within the remit of the IT department; it must be integrated into the organisation's overall risk management system.
To understand the legal implications of such incidents, it is necessary to distinguish between traditional IT systems and operational technology systems, known as OT – Operational Technology.
IT systems are used mainly to process, store and transmit information. OT systems monitor or control physical processes and technical equipment. This category may include industrial and commercial refrigeration systems, air-conditioning installations, automation systems, production equipment, energy installations and certain access control systems.
In practice, the two categories are increasingly interconnected. Centralised administration, remote monitoring, maintenance by external suppliers and integration with management platforms make operations more efficient, but they can also create additional access routes to operational equipment.
A vulnerability in an industrial controller, an inadequate configuration, the use of compromised credentials or the uncontrolled exposure of an administration interface may allow an attacker to interfere with the normal operation of the installation.
In the case of refrigeration systems, the effect may consist in changing temperature settings, interrupting cooling functions, altering operating cycles or disabling alarm mechanisms. The consequences depend on the system's architecture, the functions accessible to the attacker and the existence of independent protection mechanisms.
It should be stressed that the use of outdated equipment does not in itself prove a breach of the law. However, keeping in operation systems for which security updates are no longer available, without adequate compensating measures, may represent a significant risk that must be identified, assessed and managed.
In this context, OT security involves more than installing antivirus software or protecting employees' computers. It requires an inventory of connected equipment, knowledge of software and firmware versions, control of access to administration interfaces, network segmentation and verification of the ability to detect unauthorised changes.
According to information published in connection with the incidents in France, the investigations concerned refrigeration control systems supplied by Danfoss, and the company indicated that outdated software versions were being used in the affected equipment. However, establishing the vulnerability actually exploited, the means of access and the responsibilities of each party is a matter for the technical investigations and the competent authorities.
The case highlights a recurring problem in cybersecurity: the existence of a vulnerability is not sufficient to explain an incident, and the availability of an update does not guarantee that it will be installed and properly integrated into the operation of the equipment.
In industrial environments, updates may require compatibility checks, temporary shutdown of the installation, the intervention of a specialised supplier or an assessment of the impact on operational processes. These difficulties are real, but they do not justify ignoring identified risks indefinitely.
From an organisational point of view, the business operator must have a documented process for determining what equipment it uses, who is responsible for administering it, which vulnerabilities are known and under what conditions remedial measures can be applied.
Where an update cannot be carried out immediately, alternative measures must be considered, such as isolating the equipment from external networks, restricting remote access, using additional monitoring mechanisms, limiting administrative rights and implementing manual intervention procedures.
A decision to postpone an update must be justified by a risk assessment, identify the compensating measures and set a date for reassessment. For equipment no longer supported by the manufacturer, the organisation must also assess the residual risk, including whether the equipment should be replaced.
Consequently, the relevant compliance question is not only whether the operator has installed a particular security program, but whether it has adopted measures proportionate to the real risks of its business and whether it can demonstrate this through verifiable documents and records.
At European level, Directive (EU) 2022/2555, known as NIS2, establishes a framework for achieving a high common level of cybersecurity across the Union. The Directive emphasises management accountability, risk assessment, supply chain security, incident handling, business continuity and access control.
In Romania, the general transposing framework is GEO No 155/2024 establishing a framework for the cybersecurity of networks and information systems in the national civilian cyberspace, as amended and supplemented.
The specific applicability of these provisions must be assessed by reference to the sector of activity, the size and characteristics of the entity, the statutory identification criteria and any applicable sector-specific rules. The fact that a company uses IT systems or carries on retail activities does not automatically mean that it is an essential or important entity. Its legal classification must be checked individually.
For entities to which GEO No 155/2024 applies, risk management measures must cover, among other things, risk analysis and information system security, incident handling, business continuity, supply chain security, security in the acquisition and maintenance of systems, and assessment of the effectiveness of the measures implemented.
These obligations are also relevant to OT systems, insofar as they form part of the networks and information systems covered by the applicable legal framework. Excluding industrial equipment from the security analysis simply because it is not office computing equipment could lead to an incomplete risk assessment.
From the management's perspective, cybersecurity involves allocating the necessary resources, assigning responsibilities, approving risk management measures and overseeing their implementation. Delegating technical tasks to the IT department or an external supplier does not automatically remove the legal obligations incumbent on the entity.
At the same time, it would be wrong to conclude that every cyber incident automatically triggers the legal liability of management. The analysis must take into account the applicable obligations, the measures actually adopted, the risks that could reasonably have been identified and the specific circumstances of the incident.
Where an attack affects the operation of operational systems, the technical handling of the incident must be coordinated with the notification and reporting obligations laid down by the applicable legislation.
Under Article 15 of GEO No 155/2024, essential and important entities have reporting obligations towards the competent authorities for incidents that have a significant impact on the provision of their services, under the conditions laid down in the act.
The legal regime provides, among other things, for an early warning within 24 hours of becoming aware of the significant incident, an incident notification within 72 hours and a final report within the period laid down by law. For information establishing a cross-border impact, there is also a reporting obligation within a separate period of no more than six hours from the relevant moment specified in the act. The specific deadlines and conditions must be checked against the consolidated version of the legislation and the entity's situation.
An incident that simultaneously affects several sites or may have consequences in several States calls for careful assessment of the impact and of the obligations to cooperate. In this context, having an internal reporting procedure is essential to avoid delays caused by a lack of clarity about who is responsible and about approval workflows.
Business operators should be able to identify quickly the person coordinating the incident response, the cybersecurity officer, the persons responsible for communicating with suppliers and authorities, and the members of management who must be informed.
Furthermore, reporting must not be made conditional on the completion of the technical investigation. In practice, the first hours of an incident are devoted to containing its effects, gathering the available information and carrying out a preliminary assessment. Statutory reporting requirements must be handled in parallel with these activities, on the basis of the information available at the time.
An effective procedure must also determine how event logs, relevant configurations, communications with suppliers and other technical evidence needed to investigate the incident and justify the decisions taken are to be preserved.
Incidents involving equipment supplied and administered by third parties raise an important legal issue: the allocation of responsibilities between the manufacturer, the maintenance service provider, the system integrator and the business operator using the equipment.
In many organisations, refrigeration systems or other technical installations are purchased from a manufacturer, installed by an integrator and subsequently administered by a service provider. Remote access may be provided by yet another entity, and monitoring may be carried out through a centralised platform.
This operational fragmentation must not lead to an uncontrolled fragmentation of security responsibilities.
Contracts with suppliers should set out, depending on the nature of the service, obligations regarding security updates, vulnerability notification, incident communication, remote access, log retention, cooperation in investigations and withdrawal of access when the contract ends.
The duration of technical support, the conditions under which updates are provided, the vulnerability management procedure and the parties' responsibilities when equipment reaches the end of its life cycle must also be considered.
For systems that are essential to the organisation's business, procurement should not be assessed solely in terms of initial cost and technical performance. The duration of support, the possibility of updates, the availability of spare parts and components and integration with existing security mechanisms are factors that affect the total cost and the operational risk.
It should be stressed that the existence of a vulnerability in a product does not in itself establish the manufacturer's legal liability. That depends on the applicable obligations, the specific circumstances, the conduct of the parties, the causal link and any relevant contractual clauses.
Similarly, a business operator cannot assume that using a product sold by a reputable supplier relieves it of the obligation to assess the risks that the product introduces into its own infrastructure.
An attack on refrigeration systems shows that cybersecurity can directly affect compliance with legal obligations that do not traditionally belong to the IT domain.
For perishable foodstuffs, maintaining appropriate temperature conditions is an essential element of product safety. An unauthorised change to the installation's parameters may affect the operator's ability to keep food in adequate conditions.
For this reason, the response to a cyber incident must not be limited to restoring the operation of the equipment. The consequences for the products, the storage conditions and the risks to consumers must be assessed separately.
Where there are suspicions that products have been kept in inadequate conditions, the operator must apply the relevant food safety procedures, document the assessment and take the measures necessary to prevent products that do not meet legal requirements from being placed on the market.
A decision to withdraw or dispose of products may cause significant economic losses, but it must be considered first and foremost in light of consumer protection and food safety obligations.
At the same time, the organisation must assess the impact on its commercial activity: unavailable installations, temporary closure of premises, loss of stock, interrupted deliveries and the need to relocate products.
These consequences must be taken into account when drawing up business continuity plans and disaster recovery procedures. Those plans must include scenarios in which IT systems appear to be working normally, but the commands sent to physical equipment are incorrect or have been manipulated.
In addition, the possibility of independently monitoring certain critical parameters should be considered, so that a compromise of the central control system does not simultaneously eliminate both the operational function and the ability to detect a dangerous situation.
A cybersecurity programme adapted to operational risks must begin by identifying the systems whose unavailability or malfunction could have a significant effect on the business.
For an operator in the retail sector, the analysis should include refrigeration systems, air-conditioning installations, power supply systems, communications infrastructure and other automated equipment whose compromise could affect product safety or business continuity.
The technical inventory must be linked to a risk assessment identifying the dependencies between systems, the access routes, known vulnerabilities and the consequences of attack scenarios.
On the basis of that assessment, the operator should implement at least the following categories of measures, adapted to its risk profile:
Access control and network segmentation. OT equipment should not be directly accessible from the internet unless there is a justified need and adequate protective measures are in place. Supplier access must be limited, authorised, monitored and reviewed periodically.
Vulnerability and update management. The organisation must know which software and firmware versions are installed, follow security alerts and set remediation deadlines according to the criticality of the vulnerabilities. For systems that can no longer be updated, the compensating measures and the replacement plan must be documented if the risk cannot be sufficiently reduced.
Monitoring of operational parameters. It is necessary to assess the possibility of detecting unusual changes in temperature, settings, commands and equipment status. Alerts must be sent to persons who can actually intervene, not merely recorded on a platform.
Business continuity and manual intervention. Procedures must specify what to do when the control system becomes unavailable, sends suspicious commands or can no longer guarantee operation within normal parameters. Intervention measures must be compatible with the installation's safety requirements.
Incident management. Technical staff, management and those responsible for compliance must know how to escalate an incident, the obligations to preserve evidence and the reporting workflow to the authorities, where applicable.
Checking suppliers and contracts. Before purchasing or connecting equipment, the security conditions, the duration of support, remote access and the obligations regarding notification and remediation of vulnerabilities must be examined.
Periodic testing. The effectiveness of the measures must be verified through planned exercises and tests, including by simulating the unavailability of certain technical systems. Tests must be carried out in a controlled manner so that they do not themselves create risks for installations, products or people.
The implementation of these measures must not remain at the level of formal documents. The equipment inventory, the risk register, the update records, the monitoring reports and the minutes of exercises must make it possible to demonstrate how the organisation identifies and manages risks.
Depending on the nature of the business, these controls may be integrated into an information security management system aligned with ISO/IEC 27001 and with the relevant technical guidance for industrial system security, including the IEC 62443 family of standards.
The incidents reported in France are also relevant for business operators in Romania, including companies operating extensive networks of shops and warehouses.
The presence of a retail group in several States does not automatically mean that an incident in one country also affects the infrastructure in the others. However, the use of common suppliers, centralised administration platforms or similar technical solutions justifies a prompt assessment of any shared exposure.
Operators using equipment from the same technology family should check whether the installed versions are affected by the vulnerabilities under investigation, whether the manufacturer has issued security recommendations and whether access to the equipment is properly configured.
For groups with cross-border operations, the assessment must also cover how incident response, reporting to the competent authorities in each jurisdiction and communication between the legal entities concerned are coordinated.
It should not be assumed that an incident reported in another State automatically gives rise to identical obligations for all companies in a group. Obligations must be determined separately, according to the entity affected, the nature of the incident, the applicable legal framework and any cross-border effects.
For operators in Romania, a preventive legal and technical analysis should answer a few fundamental questions: which equipment can directly affect product safety or business continuity, who can administer it remotely, which vulnerabilities are known, what independent monitoring mechanisms exist and how quickly an unauthorised command can be detected and contained.
The answers to these questions may reveal shortcomings that are not visible in a conventional IT audit but which may prove decisive in an operational incident.
The reported attack on the refrigeration systems of French supermarkets illustrates an important shift in cyber risks: the consequences of an incident are no longer limited to data loss or application downtime, but can directly affect goods, installations, commercial processes and consumer health.
For organisations, the key legal lesson is that cybersecurity must be integrated into risk governance, supplier management and business continuity planning. High-performance technical infrastructure is not enough if equipment is kept running with known vulnerabilities, remote access is not controlled or the organisation lacks adequate mechanisms for detecting and handling incidents.
At the same time, the occurrence of an attack does not automatically prove negligence on the part of the operator, the manufacturer or the service provider. Establishing liability requires an individual analysis of the legal and contractual obligations, the security measures implemented, the cause of the incident and the link between each party's conduct and the damage caused.
The right approach therefore requires both technical prevention and legal rigour: assessing risks, documenting decisions, clarifying responsibilities, preparing the incident response and complying with reporting and consumer protection obligations.
In a business environment where IT systems control more and more physical processes, cybersecurity is no longer merely a condition for protecting information. It becomes a component of operational resilience and of an organisation's ability to meet its legal obligations towards customers, partners and authorities.
Author: P.A.
