In October 2026, a cyberattack on French supermarkets demonstrated how ordinary refrigeration equipment could become a source of physical damage. Remote controls were manipulated, leaving stores with spoiled food and reports of fires. According to the Associated Press, Finance Minister Roland Lescure told parliament that approximately 700 supermarkets were affected. Although he said national food supplies were not endangered, he acknowledged that the attack “touches the heart of our food security.” The incident reached the attention of national authorities without becoming a nationwide food crisis.
That distinction is central to the security question. A cyber disruption demands national security scrutiny when it threatens the continuity of essential functions, extends its consequences beyond individual operators, or requires public intervention beyond routine recovery. These are indicators of escalation, not an automatic classification of every intrusion as a national crisis. They also raise a question that reaches well beyond France: how confidently can governments assess their exposure when connected systems are managed across businesses, contractors, and public institutions?
The Regulatory Paradox
France operates within the European Union’s extensive cybersecurity architecture, including the NIS2 Directive and the Critical Entities Resilience framework. Yet national regulation cannot maintain every aging device or ensure that each supplier-managed system is monitored at night. In an October alert, France’s CERT-FR documented compromises affecting remote refrigeration controllers supplied by Danfoss, Copeland, and Dixell. It warned against exposing management interfaces to the internet and explained that unsupported equipment may remain vulnerable even after being reset.
Stay ahead of the geopolitical week.
MD Briefing delivers expert analysis across five global fronts — the Indo-Pacific, energy, geoeconomics, European security, and the Middle East — every Monday morning. Free.
There are important limits to the regulatory conclusion. In July 2026, the European Commission referred France to the Court of Justice of the European Union for failing to notify the full transposition of NIS2. Meanwhile, Annex II of the directive specifies wholesale food distribution and industrial production or processing, rather than covering every retail supermarket automatically. The French incident does not establish a NIS2 violation. It reveals a gap between the reach of cybersecurity governance and the practical protection of connected equipment dispersed across commercial operations.
As the US National Institute of Standards and Technology explains, operational technology controls physical processes and must be secured with safety and reliability in mind. A device may appear insignificant in a conventional corporate risk assessment yet support a function whose interruption becomes expensive or socially consequential. Its importance depends on the wider service, the availability of alternatives, and the capacity to act when the device fails.
Where the Security Threshold Lies
The 2021 Colonial Pipeline ransomware attack illustrates how social behavior can magnify operational disruption. The company suspended pipeline operations after an intrusion into its IT environment, delaying fuel deliveries along the eastern United States. Associated Press reported that panic buying left many petrol stations without fuel, even as government officials and energy analysts described the underlying problem as delivery delays rather than a shortage of supply. The response went beyond routine company recovery: the Federal Motor Carrier Safety Administration issued a regional emergency declaration, and North Carolina declared a state of emergency. Here, interrupted deliveries and consumer behavior together widened the consequences of the original intrusion.
Costa Rica crossed a more explicit national threshold in 2022. Ransomware disrupted taxation, customs, and other public functions, prompting a formal national emergency. The World Bank estimates that the crisis caused economic losses of up to 2.4 percent of GDP. Its compromised systems differed from France’s refrigeration controls, but the consequences overwhelmed ordinary arrangements for protecting state services.
Read against the three indicators, the cases mark different points on the same spectrum. France suffered physical losses across retailers, but national food supplies continued, and the response centered on investigation and operational recovery. The Colonial Pipeline affected the public beyond the operator and triggered regional and state emergency measures. Costa Rica experienced disruption to government functions and formal national escalation. The cases demonstrate that a cyber incident’s security significance cannot be derived solely from the apparent sophistication of its original intrusion.
A Cyber–Societal Security Cascade (CSSC) offers a working analytical lens for this progression, drawing on infrastructure-dependency studies and the Social Amplification of Risk Framework developed by Roger Kasperson and colleagues. It traces intrusion, physical or service disruption, public response, institutional decisions, and the possibility of crossing a national security threshold. France documents physical consequences without a demonstrated nationwide social crisis; Colonial Pipeline shows how consumer behavior can intensify a distribution problem; Costa Rica shows escalation in state response. The stages need not occur in a fixed sequence, and timely detection, alternative services, or effective recovery can prevent further consequences.
Public trust does not automatically collapse when cyberattacks occur. In an open-access experiment involving 1,828 participants across the United States, the United Kingdom, and Israel, Sharon Matzkin and colleagues simulated cyber-terror and conventional attacks on railway infrastructure and measured confidence in the government’s ability to protect people from future attacks. They found no direct overall decline, while anger was associated with increased trust in the American sample. The researchers also cautioned that prolonged or repeated failures could produce different results. Social and political consequences depend on the quality of response as well as the technical event.
The Global South’s Visibility Problem
The regulatory paradox acquires another dimension in the Global South but should not be reduced to an assumption that developing countries are uniformly less secure. Indonesia received 100 out of 100 in the Global Cybersecurity Index 2024, placing it in the highest commitment tier. The ITU index, based on information gathered in 2023–2024, assesses national cybersecurity measures across five pillars rather than the operational condition of every government service.
In June 2024, ransomware nonetheless disrupted Indonesia’s Temporary National Data Centre, affecting services including immigration. Following further mapping, officials reported 167 of 282 participating institutions affected; by 9 July, only 30 services across 12 institutions had been restored. These numbers describe different units and should not be interpreted as a single recovery percentage. They do show why strong national cybersecurity commitments cannot substitute for resilience in a shared public-service system.
The PDNS incident exposed a visible failure of service continuity and recovery, not evidence of attacks remaining undetected. But that contrast makes another question more urgent: how much confidence should policymakers place in low reported incident numbers if monitoring capabilities are themselves uneven? The ITU’s Global Cybersecurity Index 2024 reports that 89 per cent of high-income countries had a national Computer Incident Response Team (CIRT), compared with 70 per cent of upper-middle-income countries and 67 per cent of lower-middle-income countries. Among lower-income countries, 46 percent had an operational national CIRT. The last figure uses a stricter qualification, so these percentages are not a like-for-like measure of operational performance. They nevertheless point to differences in the infrastructure available for incident response. Low reported incidents might reflect effective protection, limited connectivity, underreporting, or weak detection; counts alone cannot distinguish among them.
Japan offers a compact example of consequences crossing sectors. Following breaches involving leaked images of identity documents, its Financial Services Agency urged financial institutions to strengthen verification and accelerate an already planned transition to chip-based identification, scheduled for April 2027. The incidents did not create the rule, but they increased the urgency of a financial-sector response to threats originating elsewhere.
From Detection to Institutional Response
Automation can further compress the time available to make these decisions. Google Threat Intelligence Group reported in September 2026 that attackers compromised a cloud resource and carried out agent-enabled vulnerability scanning and credential harvesting in under six hours during the second quarter. There is no established evidence of agentic AI in the French refrigeration incidents; the wider implication is the need to shorten detection-to-intervention time without giving automated systems unsafe authority over physical equipment.
In my earlier Modern Diplomacy essay, Why ASEAN Must Prepare for AI Threats That Will Not Wait for Consensus, I argued that containment cannot depend on complete attribution or agreement across institutions. That principle applies when contractors must isolate exposed equipment or public agencies must restore disrupted services before investigators can establish who is responsible.
Three indicators make preparedness measurable: the share of network-connected operational equipment with an identified owner, exposure and maintenance status, whether anomalies are monitored outside office hours and how much time passes before intervention, and the tested recovery time for essential services. These measurements connect regulation to practical decisions and clarify where responsibility lies before an incident becomes a crisis.
Cybersecurity governance is often judged by the standards adopted, institutions established, and incidents reported. Yet those measures reveal only part of a country’s preparedness. The systems sustaining everyday life may remain largely invisible to national security planning until their failure exposes how widely the consequences can spread. For governments accelerating digital transformation, the more uncomfortable question is whether a low number of reported incidents reflects genuine resilience—or merely the limits of their ability to detect what is happening inside the systems on which society depends.
