Decentralization is one of retail’s strengths. Franchise networks, independently operated stores, local suppliers, and specialist contractors can all help businesses move faster and operate efficiently.

But the same model can create a cybersecurity challenge.

Retail brands may set commercial standards and shape the customer experience, while many of the technologies keeping stores running are selected, installed, or maintained locally. That can include refrigeration, building management systems, remote maintenance tools, connectivity, and other operational technology.

The result is a potential gap between who depends on the technology, who controls it, and who is accountable when something goes wrong.

Recent cyberattacks affecting refrigeration systems in French supermarkets have brought that issue into sharp focus. Franceinfo reported that stores operated by several major retailers were affected after refrigeration installations were targeted. The incident showed how a cyberattack against technology that sits behind the scenes can quickly become a very visible operational problem.

Technical analysis from ONYPHE also shows how connected refrigeration infrastructure can turn a cyber incident into a physical operational problem.

And that is the bigger lesson for retail leaders.

The Modern Store Is a Cyber-Physical Environment

Retail environments are more connected than ever.

Refrigeration systems, cameras, access controls, HVAC, digital signage, payment infrastructure, and building systems increasingly depend on network connectivity and remote access.

There are good reasons for this. A refrigeration engineer can diagnose a fault remotely. Stores can monitor temperature centrally. Maintenance becomes faster and more efficient.

But every connection also becomes part of the attack surface.

Recent research from Claroty’s Team82 highlighted vulnerabilities affecting widely deployed refrigeration controllers and showed how systems designed for operational convenience can become exposed to the internet.

The point is not that connected technology is inherently unsafe. The issue is whether organizations have enough visibility and governance around it.

A refrigeration controller might not look like a critical business system in the same way as a payment platform or e-commerce site. But if it stops working, stores can lose stock, operations can be disrupted, and food safety may become an issue.

That makes it part of the retailer’s critical infrastructure.

Decentralization Can Hide Shared Risk

One of the most interesting challenges in retail is that highly distributed operations can create a false sense that risk is equally distributed.

Hundreds of stores may have different owners, contractors, and local networks. On paper, they appear independent.

In practice, they may all rely on the same equipment, the same maintenance provider, the same remote-access method, or the same technology supplier.

That creates concentration risk.

A weakness in one commonly used product or service can potentially affect many separate locations at the same time.

For security leaders, this means the important question is not simply, “What technology do we own?”

It is also, “What technology does the business depend on?”

That distinction matters in franchise networks and distributed retail environments where operational control may sit outside corporate IT.

Local Autonomy Still Needs Central Security Guardrails

Decentralized operations do not need to mean centralized control of every technology decision.

Local operators still need flexibility.

But organizations should establish a consistent cybersecurity baseline across the retail ecosystem.

That could include minimum requirements for remote access, authentication, internet exposure, patching, segmentation, asset inventories, and incident reporting.

A store may still work with its preferred maintenance provider. But there should be clear expectations around how that provider connects to critical systems and how those connections are secured.

The principle is straightforward:

Local operational autonomy should not mean local interpretation of acceptable cyber risk.

Third-Party Access Is Part of the Security Perimeter

Retail operations depend heavily on contractors.

That is particularly true for specialist equipment such as refrigeration, building systems, and other OT.

Remote maintenance can be essential to business continuity, but it should also be treated as privileged access.

Security teams need to know who can connect, how they authenticate, whether access is permanent or temporary, and how that activity is monitored.

There also needs to be a clear understanding of what happens if the contractor itself is compromised.

Could an attacker use that relationship to reach multiple stores? Could the same credentials or connectivity model create access across a wider estate?

These are not simply technical questions. They belong in procurement, contracts, supplier management, and business risk discussions too.

Cybersecurity is much harder to manage when the organization only discovers critical third-party access during an incident.

Visibility Needs Business Context

Asset visibility is another important part of the picture.

Knowing that an internet-facing controller exists is useful. Knowing where it is, who manages it, what store depends on it, which contractor can access it, and what happens if it fails is far more valuable.

That context helps organizations prioritize.

It also makes response faster.

If a new vulnerability emerges, the business should be able to quickly understand which locations are affected, which suppliers need to be contacted, and which systems require immediate attention.

Without that information, valuable time can be lost simply working out ownership.

For distributed retailers, visibility therefore needs to go beyond a technical asset inventory.

It needs to connect technology to the business operation it supports.

Cyber Resilience Has to Reflect How Retail Really Works

Cyber incidents do not respect organizational boundaries.

A retailer may have strong corporate security controls, but resilience also depends on what happens across stores, franchisees, suppliers, contractors, and operational systems.

That is why response planning needs to reflect the real operating model.

If the same problem affected dozens of stores at once, would everyone know what to do?

• Would corporate security know who to contact?

• Would maintenance providers know how to respond?

• Would store managers understand what should be isolated and what must remain operational?

The same principle can be seen in wider retail incidents. Ahold Delhaize, for example, temporarily shut down several websites following a cybersecurity issue while physical stores continued to operate. It was another reminder that cyber incidents can affect different parts of the retail business in very different ways.

Good resilience means understanding those dependencies before an incident occurs.

The Brand Still Owns the Customer Impact

There is one final point that matters at board level.

Customers do not see infrastructure ownership.

They see the brand.

They do not know whether a refrigeration system belongs to a franchisee, whether a contractor maintains it, or whether a third party provides remote access.

If stores cannot operate, stock is lost, or service is disrupted, the reputational impact still lands on the retailer.

That is why cybersecurity governance needs to follow business dependency, not simply technology ownership.

Retailers can outsource systems, maintenance, and operational responsibilities.

They cannot fully outsource the consequences.

A Better Measure of Retail Cybersecurity Maturity

The French supermarket incidents are a useful reminder that retail cybersecurity is no longer just about protecting corporate IT.

It is about understanding and managing cyber risk across the full operating ecosystem.

For retail leaders, three questions are worth asking:

• Governance: Do we have consistent minimum security standards across corporate stores, franchisees, contractors, and suppliers?

• Visibility: Do we know which connected operational systems the business depends on, who manages them, and how they are exposed?

• Resilience: Could we coordinate an effective response if the same incident affected multiple locations at once?

The goal is not to remove the flexibility that makes decentralized retail models work.

It is to make sure that flexibility does not create invisible risk.

Because a decentralized operating model should never mean decentralized accountability for cybersecurity.

‍