Cyberattack disrupts supermarket refrigeration

A cyberattack in mid-October targeted refrigeration systems of supermarkets, forcing them to discard all frozen products. This incident highlighted how cyber threats can impact the physical world.

Investigation launched after attack

The cybercrime section of the Paris prosecutor's office took charge of the case on October 12, following the attack that occurred during the night of October 11 to 12. Hundreds of stores were affected, leading to significant losses.

Legal questions about liability

Beyond the technical aspects of the attack, the issue of compensation remains unresolved. While the attackers are clearly responsible, victims may also bear some liability if they failed to secure their systems adequately.

Need for cyber technical inspection

The idea of a "cyber technical inspection" is being considered to improve cyber security. This would involve checking the security of companies before incidents occur, similar to how vehicles are inspected before being driven.

No official cyber inspection yet

Currently, there is no official "technical inspection" in the field of cyber security. Companies must follow general obligations, such as those under the General Data Protection Regulation (GDPR), but there is no specific checklist for compliance.

Cyberattacks have tangible consequences

The risks of cyberattacks extend beyond digital damage. In the case of the supermarkets, the attack resulted in destroyed goods, store closures, and potential health and environmental risks. Similar incidents have occurred in other sectors, such as water purification networks in the United States.

Common security flaws are often overlooked

Many cyberattacks exploit basic and well-known security flaws. For instance, an investigation into a burglary at the Louvre revealed that critical servers were protected by the password "LOUVRE," which could be cracked quickly. This highlights the widespread neglect of basic security practices.

Refrigeration systems were vulnerable

Experts believe the refrigeration cyberattack was not particularly complex but likely resulted from a missed software update. These systems are connected to the Internet for remote control, making them vulnerable if updates are not applied.

Negligence may affect insurance claims

Companies that fail to take basic security precautions may find their insurance claims denied after a cyberattack. Insurers may argue that the company's negligence contributed to the damage, reducing the attacker's liability.

Victims are not always innocent

While the attacker is clearly at fault, the attacked company may also be held responsible for not securing its systems. Legal principles suggest that negligence can be considered a fault, even if the company is a victim.

Force majeure not a valid defense

In a 2020 ruling, the Paris Court of Appeal rejected the use of "force majeure" as a defense for a ransomware attack. A cyberattack does not meet the legal criteria for being external, unpredictable, or irresistible.

Companies face legal uncertainty

The increasing number of regulatory texts makes it difficult for companies to know their obligations. The European NIS 2 directive, which aims to improve cyber security, has faced delays in being implemented in France.

Public authorities may introduce inspections

To address this uncertainty, public authorities are considering mandatory and periodic information security inspections. This would help clarify obligations and the limits of liability for companies.

Cyberscore as a potential solution

A "cyberscore" is being proposed, where major digital platforms would have their security audited and the results made public. This is inspired by the Nutri-Score system, aiming to increase transparency and accountability.