A cyberattack affecting approximately 700 supermarkets in France has exposed serious weaknesses in the digital systems used to control commercial refrigeration, raising concerns about the vulnerability of European food distribution networks and other essential infrastructure.

The attack began overnight on 11–12th October, when intruders gained access to remotely managed refrigeration equipment and altered operating settings, causing refrigerators and freezers to overheat.

Stores belonging to several major supermarket chains were affected, including Intermarché, Netto, Coopérative U, Carrefour and Monoprix. Some were forced to discard substantial quantities of fresh and frozen food.

French Finance Minister Roland Lescure confirmed that approximately 700 of the country’s 10,000 supermarkets had been affected, although the severity of the disruption varied between locations.

The Paris prosecutor’s office has opened an investigation into the attack, including the damage caused by destroyed merchandise and reported fires.

The incident has drawn attention to industrial control systems that are routinely connected to the internet but may receive less cybersecurity protection than corporate networks and customer databases.

Refrigeration systems remotely manipulated

Investigators have established that refrigeration equipment was targeted through vulnerabilities associated with remote monitoring and control systems.

The French cybersecurity authorities identified compromises involving products supplied by Danish manufacturer Danfoss and American company Copeland.

Some of the affected systems used older equipment that no longer received regular security updates.

According to information released by the companies and cybersecurity specialists, certain industrial controllers had been accessible through public internet connections, creating opportunities for unauthorised access.

Hackers reportedly manipulated defrost cycles and increased temperature settings, preventing equipment from maintaining the cold conditions required to preserve food.

The attack affected approximately 300 Intermarché and Netto stores, while Coopérative U reported disruption at around 80 outlets.

Several retailers managed to contain the damage, but others lost substantial quantities of stock.

The consequences extended beyond malfunctioning equipment. Businesses faced the cost of replacing spoiled food, repairing refrigeration systems and restoring normal operations.

The precise financial damage is still being assessed, although estimates from the retail sector indicate that losses across France could amount to tens of millions of euros.

Vulnerabilities in connected equipment

The incident illustrates the security problems created by the growing use of internet-connected industrial equipment.

Modern refrigeration installations allow contractors and maintenance specialists to monitor temperatures, adjust settings and diagnose faults remotely.

These arrangements can reduce operating costs and improve efficiency, but they also create additional access points that attackers may exploit.

Cybersecurity specialists have identified vulnerabilities in commercial refrigeration platforms manufactured by Danfoss and Copeland.

The manufacturers subsequently addressed identified flaws, although older or unsupported equipment remained a concern.

A critical problem for businesses is that industrial machinery often remains operational for many years after its original software has become obsolete.

Replacing entire refrigeration installations can involve substantial expense and operational disruption, encouraging operators to retain equipment that may no longer meet contemporary cybersecurity standards.

The risks are particularly difficult to manage when responsibility for maintenance, software updates and network security is divided between retailers, equipment suppliers and external contractors.

France’s delayed cybersecurity legislation

The attack has renewed scrutiny of France’s implementation of the European Union’s NIS2 Directive, which is intended to strengthen cybersecurity across sectors providing important economic and public services.

The directive establishes common requirements covering risk management, incident reporting, organisational responsibility and protection against cyber threats.

Its scope extends beyond traditional critical infrastructure such as energy, telecommunications and transport to include certain businesses involved in food production, processing and distribution.

EU member states were required to incorporate the directive into national legislation by 17 October 2024.

France was among the countries that received a formal warning from the European Commission in May 2025 over incomplete implementation.

French cybersecurity specialists have since warned that delays have complicated efforts to establish consistent obligations for organisations operating industrial and commercial systems.

However, NIS2 does not automatically cover every supermarket. Its application depends on the nature and size of an organisation and the provisions of national implementing legislation.

The incident therefore raises questions not only about the pace of legislative implementation but also about the practical protection of equipment already in use.

Wider implications for European infrastructure

The disruption demonstrates how a cyberattack can cause physical damage without directly targeting a conventional industrial facility.

Unlike breaches intended to steal customer information, the French incident interfered with machinery responsible for preserving essential products.

The distinction is important for European policymakers, who increasingly face threats to infrastructure that combines digital controls with physical operations.

The European Union’s cybersecurity agency ENISA has organised cross-border exercises to test how authorities and companies would respond to disruption affecting essential services.

The attack itself has been established, but responsibility for it has not been publicly attributed.

French authorities have said there is no immediate threat to national food supplies. Nevertheless, the destruction of merchandise and interruption of ordinary retail operations have demonstrated the potential economic consequences of weaknesses in relatively commonplace equipment.

The continuing investigation must establish how access was obtained, which systems were compromised and whether the vulnerabilities were known to operators before the attack.

For Brussels and national regulators, the case provides a practical test of whether European cybersecurity legislation can translate into effective protection for the connected equipment on which ordinary commercial activities increasingly depend.

The United States has warned the European Union that proposed restrictions on American satellite operators could provoke commercial retaliation against European businesses, escalating a dispute over the future of satellite communications and Europe’s efforts to reduce its dependence on foreign technology.

US Ambassador to the EU Andrew Puzder has criticised plans under consideration in Brussels that would reserve parts of the radio spectrum for European operators, potentially restricting services provided by Elon Musk’s SpaceX and its Starlink satellite network.

According to details of Washington’s objections, the American administration believes the proposed arrangements would discriminate against US companies and undermine competition. Puzder has warned that European businesses could face substantial consequences if the restrictions proceed.

The disagreement comes as Brussels pursues a broader strategy intended to strengthen Europe’s technological independence in satellite communications, cloud computing and artificial intelligence. Washington has increasingly challenged European regulations that it considers detrimental to American technology companies.

A dispute over access to satellite frequencies

At the centre of the disagreement is the allocation of radio frequencies used by satellite communications systems. Access to suitable spectrum is essential for providing reliable services, particularly as operators deploy increasingly large constellations in low Earth orbit.

SpaceX has established a substantial commercial and technological advantage through Starlink, which operates thousands of satellites and provides broadband services to residential, commercial and government customers across numerous countries.

European operators argue that the expansion of American satellite networks could make it difficult for European competitors to secure sufficient spectrum and develop commercially viable services.

Washington takes a different position, warning that preferential treatment for European operators could restrict competition rather than strengthen it.

The precise legal form of the proposed EU restrictions, and whether they will proceed, remain unsettled. No final European prohibition on American satellite services has been announced.

Nevertheless, the dispute raises a question for Brussels: whether measures intended to protect European industrial capacity can be introduced without exposing European exporters and investors to American retaliation.

Europe’s satellite ambitions

The European Commission is investing heavily in IRIS², its secure satellite communications programme, which is intended to provide independent communications capabilities for governments, defence organisations and commercial customers.

Under arrangements confirmed in August, the programme’s principal constellation is planned to comprise 348 satellites operating in low and medium Earth orbit, with initial launches scheduled for 2029.

The system is designed to reduce Europe’s reliance on communications infrastructure controlled by companies or governments outside the EU, particularly during military emergencies, cyber incidents and interruptions to terrestrial networks.

The Commission’s technical programme envisages communications services supporting border management, crisis response, defence and other sensitive government activities.

However, IRIS² is not yet operational, and European commercial operators face significant competition from SpaceX.

Eutelsat, which operates the OneWeb satellite network, is among the European companies positioned to benefit from increased demand for alternatives to Starlink.

Its shares rose sharply on 14 October following reports of restrictions affecting Ukrainian access to certain Starlink services. The market reaction reflected renewed interest in European-controlled satellite communications.

OneWeb cannot simply replace Starlink across all applications. Differences in network architecture, terminal equipment and available capacity complicate any rapid transition.

Ukraine adds a security dimension

The dispute is particularly sensitive because Starlink has become an important part of Ukraine’s communications infrastructure during Russia’s invasion.

Ukrainian forces have relied on satellite connectivity for communications in areas where conventional telecommunications infrastructure has been damaged or destroyed.

The strategic consequences of relying on a commercial provider became more prominent following reports that access to certain Starlink capabilities had been restricted.

For European governments, the episode has reinforced concerns about whether defence communications should depend on technology controlled by a company subject to political and commercial pressures outside Europe.

Yet restricting American participation before European alternatives are fully available could produce its own operational difficulties.

The Commission must therefore distinguish between developing independent European capabilities and limiting access to services that governments, businesses and military organisations currently require.

Another transatlantic regulatory confrontation

The satellite dispute follows disagreements over European regulation of American digital companies, including competition enforcement and restrictions on online platforms.

As EU Today reported in May, the European Commission had already proposed reserving much of the future mobile satellite spectrum for European operators.

Washington’s opposition introduces a different dimension because spectrum allocation affects market access directly.

The American administration is also linking the dispute to broader commercial relations, raising the possibility that measures affecting satellite companies could produce consequences for unrelated European industries.

Brussels has not announced a final decision on the disputed spectrum arrangements, while the United States has not specified which retaliatory measures it would impose.

The immediate issue is therefore regulatory rather than an enacted trade restriction. Whether it develops into a wider confrontation will depend on the Commission’s final proposals and Washington’s willingness to pursue its warning through commercial measures.

The EU General Court has upheld the European Commission’s decision to classify Stripchat as a very large online platform, establishing important limits on how technology companies can challenge the calculation of their European user numbers.

The European Union’s General Court has rejected a legal challenge to the European Commission’s classification of adult entertainment platform Stripchat under the Digital Services Act, strengthening Brussels’ authority to determine which online services must comply with the legislation’s most demanding obligations.

In its judgment delivered on 14th October, the Luxembourg-based court dismissed the action brought by Technius Ltd, the company operating Stripchat, against its designation as a very large online platform.

The dispute centred on how the Commission calculated the platform’s average monthly active users in the European Union, which determines whether additional regulatory obligations apply.

Under the Digital Services Act, platforms exceeding 45 million monthly active recipients in the EU are subject to enhanced supervision, including requirements concerning systemic risks, transparency, content moderation and independent auditing.

The judgment addresses a fundamental question for European digital regulation: whether companies can exclude particular categories of website visits when calculating the number of people using their services.

How Brussels challenged the platform’s figures

In February 2023, Technius reported that Stripchat had approximately 31.8 million average monthly active recipients in the EU, placing it below the threshold for very large online platforms.

The company relied on information provided by Similarweb, a commercial service measuring website traffic and user behaviour.

However, the Commission questioned the methodology used to reach that figure. Technius had discounted certain visits on the grounds that users entered the website but departed without engaging with its content.

Such visits are commonly described as bounced visits and frequently appear in commercial website analytics.

The Commission concluded that the company’s deductions had significantly underestimated its audience because the original Similarweb calculation of unique visitors already incorporated a filtering process excluding many bounced visits.

On that basis, Brussels calculated that Stripchat had more than 62 million monthly unique visitors in the EU, well above the statutory threshold.

The Commission consequently designated the platform as a very large online service on 20th December 2023. Technius challenged the decision, arguing that the figures were unreliable and that the absence of a prescribed calculation methodology undermined legal certainty.

The EU General Court rejected both arguments.

Court rejects challenge to calculation methodology

According to the court’s official explanation, the Commission had adequately explained its calculation and was entitled to rely on the data available when the designation decision was adopted.

The judges found that Technius had effectively applied deductions to figures from which relevant traffic had already been filtered, producing an artificially reduced estimate of active recipients.

The judgment also addressed a potentially significant complication.

After the Commission adopted its decision, Similarweb revised its methodology. Using the corrected method, Stripchat’s estimated monthly active audience for the relevant period was approximately 37.3 million.

That figure was below the threshold for classification as a very large online platform. Nevertheless, the court held that the subsequent correction did not invalidate the original designation.

The judges determined that the Commission’s decision had to be assessed according to the facts, applicable law and permissible evidence available when the decision was taken.

The ruling therefore does not establish that Stripchat currently exceeds 45 million monthly users. It confirms that the later recalculation was insufficient to annul the Commission’s December 2023 decision.

A significant precedent for digital regulation

The consequences extend beyond one adult entertainment website.

The Digital Services Act covers online intermediaries operating in the European market, including social networks, marketplaces, hosting services and other platforms.

Its obligations increase according to the size and nature of a company’s operations. Very large online platforms must assess systemic risks associated with their services, introduce appropriate mitigation measures and submit to independent audits.

The Commission is responsible for supervising their additional obligations and can impose substantial financial penalties for established infringements.

The distinction between the two categories can therefore have considerable financial and operational consequences.

Companies falling below the 45 million threshold remain subject to relevant DSA obligations but do not face the same additional requirements imposed on the largest platforms.

The General Court’s ruling confirms that companies cannot escape designation by applying an unreliable interpretation of website traffic data.

At the same time, the Commission’s published supervisory framework allows a designation to be revoked when a platform remains below the threshold for a full year.

European technology enforcement faces growing scrutiny

The judgment comes as the Commission faces multiple legal challenges to its enforcement of Europe’s digital legislation.

As EU Today previously reported, Washington has sought to intervene in proceedings concerning the Commission’s €120 million Digital Services Act fine against X, introducing an additional diplomatic dimension to European regulatory disputes.

The Commission is also pursuing separate investigations into whether major platforms comply with obligations concerning the protection of minors, advertising transparency and the management of illegal content.

In another case examined by EU Today, Brussels reached preliminary findings concerning TikTok’s default privacy settings for children, illustrating the practical consequences of the stricter duties imposed on very large online platforms.

The Stripchat judgment concerns designation rather than a finding that the company breached any substantive safety obligation. Its immediate consequence is to preserve the Commission’s original classification decision.

Technius may still appeal to the Court of Justice of the European Union on points of law within two months and ten days of notification of the judgment.

For European regulators, the decision provides judicial support for using established commercial analytics when assessing the reach of online platforms, provided that the methodology is adequately explained and the underlying evidence is reliable.

For technology companies, it confirms that the legal assessment of user numbers extends beyond the figures they choose to report to Brussels. The Commission can scrutinise those calculations and reject methods that fail to provide a reliable estimate of an online service’s European audience.

The European Commission is assessing changes to Google’s search engine and app-store practices after imposing two substantial fines in July. Regulators must now decide whether the company’s response satisfies EU competition requirements or leaves it exposed to further enforcement.

The European Commission is continuing discussions with Google over the company’s response to €890 million in penalties imposed under the Digital Markets Act, as Brussels examines whether changes to its search engine and app-store practices are sufficient to address infringements of European competition rules.

Commission spokesman Thomas Regnier confirmed on Wednesday, 14 October, that officials remained in dialogue with the American technology company. The Commission is assessing the measures Google has introduced, taking account of feedback from businesses affected by its services before reaching a conclusion on compliance.

The review follows two decisions adopted on 23 July, when the European Commission found Google in breach of the Digital Markets Act. A €460 million fine concerned preferential treatment for Google’s own services in search results, while a separate €430 million penalty addressed restrictions preventing app developers from freely directing customers towards alternative purchasing channels.

Search rankings remain under examination

The first infringement concerns Google’s treatment of competing online services offering hotel reservations, shopping comparisons, transport information and sports results.

Regulators concluded that Google had placed its own services in more prominent positions, sometimes providing them with enhanced visual features and search functions unavailable to competing businesses.

The Digital Markets Act prohibits designated gatekeepers from giving their own products preferential treatment when ranking services that compete with those offered by other companies.

Google has already modified its European search results in response to the Commission’s decision. The changes include revised presentations of commercial information and greater prominence for independent comparison services.

As EU Today reported following the introduction of the revised search format, Google has argued that the measures could make searches less convenient and increase dependence on intermediary websites.

The company maintains that direct information previously available through its search engine may become harder for consumers to obtain.

For competitors, however, the question is whether Google’s adjustments provide genuine commercial opportunities or merely alter the appearance of search results without changing the underlying distribution of traffic.

Google Play fees face scrutiny

The second case concerns the Google Play application marketplace, where developers have historically depended on Google’s infrastructure to distribute software and sell subscriptions.

Under the DMA, developers must be able to inform customers about alternative offers and direct them towards purchasing arrangements outside the platform, including their own websites.

The Commission found that Google’s restrictions and fees had limited that freedom.

Although the company may charge for certain services associated with acquiring customers, the Commission concluded that the level and duration of its steering-related charges exceeded what the legislation permits.

Google has since adjusted its external-offers arrangements. European officials are examining whether those changes provide developers with a commercially workable alternative to transactions processed through Google Play.

The issue has consequences for subscription services, digital publishers and software companies seeking to maintain direct relationships with their customers.

A formal ability to direct consumers elsewhere is of limited benefit if the financial conditions make such transactions uneconomic.

Enforcement enters a more demanding phase

The Digital Markets Act was designed to address market practices that conventional competition investigations often took years to resolve.

Rather than requiring regulators to establish a new infringement through lengthy proceedings in every instance, the legislation imposes specific obligations on companies designated as gatekeepers.

The Commission’s DMA enforcement framework allows regulators to examine whether those obligations are being followed and to impose financial penalties when they are breached.

Google’s July fines represented an important enforcement decision. The current review concerns the company’s subsequent conduct and the practical effects of its compliance measures.

The continuation of discussions does not itself establish a fresh infringement. Further penalties would require an additional regulatory determination.

Google also faces broader obligations concerning the sharing of search data with competing providers, an issue addressed in a separate Commission decision issued in July.

These obligations concern access to anonymised information about searches, rankings and user interactions that competing search engines may need to improve their own services.

Taken together, the measures represent a substantial intervention in how Google’s European business operates.

Transatlantic tensions complicate the dispute

The proceedings have acquired a political dimension because most of the largest companies affected by the DMA are American.

President Donald Trump has criticised European penalties against US technology companies and threatened trade measures in response to what his administration regards as discriminatory regulation.

Brussels maintains that the legislation applies according to market position and commercial conduct, regardless of nationality.

European regulators must nevertheless enforce their decisions in an environment where competition policy has become entangled with wider trade relations between the United States and the European Union.

Google’s financial exposure extends beyond the €890 million imposed in July. Continued non-compliance could lead to further regulatory proceedings, while changes to the company’s services may also affect advertising revenue and its relationships with commercial partners.

The immediate assessment will concentrate on whether competing search services receive fair treatment and whether application developers can direct customers towards alternative transactions without unjustified restrictions.

The Commission has not announced a date for its final assessment. Its decision will help establish how far Europe’s digital competition legislation can change the conduct of companies whose platforms occupy central positions in online commerce.