When a Cyberattack Reaches the Shop Floor
A cyberattack can become visible long before anyone opens a laptop.
For French supermarket staff this week, it meant refrigeration systems failing to keep products cold and fresh and frozen stock having to be discarded.
On 12 October, Intermarché and Coopérative U confirmed attacks affecting refrigeration at hundreds of stores. AFP reported that around 150–200 Intermarché locations and almost 100 Coopérative U outlets were affected.
The incident remains under investigation. Its immediate consequences, however, illustrate a challenge every leadership team should consider: a digital disruption can quickly demand decisions about safety, operations, suppliers and customer confidence.
The consequences cross departments
Connected equipment supports much of everyday business. Refrigeration, access controls, building systems and production machinery can all sit at the meeting point between digital infrastructure and physical operations.
When that equipment becomes unreliable, the response needs to bring together people who may rarely practise managing an incident as one team.
Technical specialists investigate what has happened and work to contain it. Operations teams establish what can continue safely. Suppliers provide equipment knowledge and support. Leaders make decisions about disruption, resources and communication.
Each needs information from the others.
A technical recovery plan alone cannot answer every question facing a store manager, facilities lead or chief executive.
Who makes the first decisions?
Imagine several sites reporting unusual equipment behaviour at the same time.
Who recognises that the reports may be connected? Who brings the relevant people together? Who has authority to suspend an activity while the cause is still uncertain?
These questions become harder when an incident starts overnight, a key manager is unavailable or the supplier’s support line is dealing with many affected customers.
Organisations need a clear route from a local concern to a coordinated response. Staff should know what to report, how to escalate it and who can authorise immediate protective action.
The first decisions will often be made with incomplete information. Preparing people for that uncertainty is part of crisis readiness.
Recovery means more than restoring the system
Getting equipment working again is an important milestone. It does not necessarily mean normal operations can resume immediately.
Depending on the incident, teams may need to assess affected stock, inspect equipment, arrange replacements and establish that operations can restart safely.
They also need to record what happened and why decisions were taken. That information supports the investigation, discussions with advisers and the organisation’s own review.
Recovery planning should therefore cover the whole operation, including the people and suppliers needed to bring it back into service.
Test the handovers
A short discussion exercise can expose gaps before a real incident does.
Choose one connected system your organisation relies on. Imagine it becomes unreliable across several locations, outside normal working hours.
Bring together operations, IT, facilities, communications and leadership. Ask them to work through the first hour.
Where does the initial report go? What information is needed to make a decision? Which supplier contacts are available? How will staff receive consistent instructions?
Then introduce a complication: the usual communication channel is unavailable, or the supplier cannot give a recovery estimate.
The value comes from identifying where responsibility is unclear and fixing those gaps.
Preparedness needs a whole-business view
The French supermarket incident is still developing. Conclusions about its cause and responsibility should follow the evidence.
For other organisations, it already offers a useful prompt to examine their own dependencies and response arrangements.
At SJ Group International, we help organisations assess risk, prepare their people and rehearse decisions through practical crisis planning and scenario-based exercises.
If an essential system failed tomorrow, would your teams know how to respond together?
To discuss your organisation’s preparedness, contact office@sjgroupinternational.com.
Assess. Prepare. Respond.
Reporting checked on 12 October 2026. The incident remains under investigation.
About the author: Nick Shah OBE, Founder and CEO of SJ Group International, brings over 35 years of experience in law enforcement, crisis response and corporate security.