Cyber blackout: Sweden got its supermarket tills ready, France published a PDF

On Thursday 29 October, in around twenty minutes, 6.36 billion dollars left the wallets of Binance, the world's largest crypto asset exchange. The intrusion had started from a compromised laptop. Binance suspended deposits and withdrawals, and millions of customers found themselves without access to their funds, at least until this Sunday, the announced date for resumption subject to security checks. The FBI attributed the theft to North Korea on Saturday. Two days earlier, Anthropic had described how its AI model Claude had written, in 53 minutes, an exploit giving remote root access on Linux servers, through a kernel flaw rated 9.8 out of 10 that neither Ubuntu nor Red Hat had yet fixed on 29 October.

A week earlier, on Tuesday 20 October, it was Revolut that had stopped working in several European countries from early morning until 19:39, because its provider Google Cloud was down. Cards declined at the till, transfers blocked, app unreachable, for a bank claiming more than eight million customers in France.

Last Sunday I wrote about my retreat in an ashram in Italy, at the very moment the industry was declaring a CVE bloodbath. What I did not say is that I spent three days there without a phone or internet, and that it was during that deliberate disconnection that the question of a cyber blackout came to me most clearly. Disconnecting for three days costs almost nothing when everything around you keeps working. A cyber blackout reverses the situation: you stay dependent on everything, and it is the world around you that disconnects, the bank card, the petrol pump, the pharmacy, the supermarket.

A cyber blackout in France is possible, and its probability is nothing marginal. Each of the links that would make it up has already given way somewhere over the past ten years. They simply have not given way at the same time.

Every link has already given way

In May 2021, the ransomware that hit Colonial Pipeline led the operator to shut down the pipeline carrying nearly half the fuel for the American East Coast, and six days were enough for whole stations to run dry, mostly because motorists rushed to fill up. In January 2022, on my TEDx stage, I was already using that example to show that cybersecurity produces very real effects, alongside one that had just happened, a New Mexico prison where ransomware had knocked out the surveillance cameras and kept inmates locked in their cells for days. Four years later, the list has grown long enough to cover almost everything a society needs to function.

Back in July 2021, the Swedish chain Coop had to close around 800 stores, an attack on an IT management tool used by its till provider simply preventing it from taking payment. In the spring of 2025, Co-op had empty shelves in the United Kingdom and Marks & Spencer suspended online sales for more than six weeks. In October 2026, it was the cold chain of some 700 of our supermarkets that turned out to be controllable, and disruptable, from the internet.

Healthcare and money have seen the same breaks. In February 2024, the attack on Change Healthcare prevented part of America's pharmacies from processing prescription coverage for weeks. In June, London hospitals deprived of their pathology provider, Synnovis, postponed operations and appealed for O negative blood donors. In July of the same year, a faulty update from the security vendor CrowdStrike blocked 8.5 million Windows computers, and with them airlines, banks and payment terminals.

The networks themselves have given way. On 24 February 2022, the day Ukraine was invaded, the attack on the Viasat satellite network cut off tens of thousands of modems across Europe and left 5,800 German wind turbines without remote monitoring. In December 2023, Kyivstar, Ukraine's largest operator, lost mobile and internet service for its 24 million subscribers for several days, eight years after an earlier attack had cut power to some 225,000 Ukrainian customers. This summer, American officials attributed to Iran attacks on the municipal water networks of at least seven states. At the start of the open war on 28 February, Iran itself fell to 1 to 4 % of its internet connectivity for more than sixty hours, under the combined effect of strikes and cyberattacks, while drones damaged three Amazon data centres in the Emirates.

Some of these episodes come from states, others from organised crime, others still from simple accident, and that is what makes the risk so serious, since it has several routes to becoming real. In February 2024, the American cybersecurity and intelligence agencies wrote that actors linked to China had established themselves in American critical infrastructure networks in order to be able to disrupt them in a crisis or a conflict. North Korea has just carried out the largest theft in the history of crypto assets, and an AI showed this week that it could write, in under an hour, the exploit for a critical flaw in the Linux kernel, the system running most of the planet's servers. As for accident, the Revolut outage showed that one failing provider is enough to produce a comparable effect.

The situation reminds me of the one before 2020. A pandemic appeared as early as 2008 in the French white paper on defence and national security, and we faced it short of masks. A cyber blackout today appears in the risk registers of companies and of the state alike, and almost nobody is preparing for it at the level where it will strike, that of households and shops.

What would a cyber blackout look like in France?

People readily imagine a country plunged into darkness all at once. What we have already lived through looks more like local outages spreading through a shared dependency. A handful of providers of cloud, payment, till software or security equip thousands of companies at a time, and when one of them falls, all its customers stop together. In the continuity plans I review during audits, the scenario where all IT disappears for a week is rarely covered, even though that is the one taking shape.

In practical terms, the first day would see cards declined at tills and pumps, pharmacies unable to process prescriptions and cash machines besieged. By the next day, the restocking orders, which go through the same systems, would stop going out and the fresh shelves would empty. After a few days, those with cash would buy for those without, and mobile networks would gradually go dark as the batteries in the masts ran down, as happened in Spain and Portugal during the great power cut of April 2025.

The supermarket, through which the population feeds itself, nonetheless escapes most obligations. In the food sector, the European NIS2 directive covers only wholesale distribution and industrial production, so the store whose cold rooms were thrown out of range on 12 October has no cybersecurity obligation of its own. Its ability to operate without a network depends entirely on its own choices.

What the state wrote without saying it

The risk is not ignored at the top. On 20 November 2025, the General Secretariat for Defence and National Security published « Tous responsables », a twenty-seven page guide recommending that every household be able to last 72 hours self-sufficiently, mentioning cyberattacks and advising people to keep cash in case the cash machines fail. The content holds up. The guide was nonetheless put online with little campaigning and without being delivered to letterboxes, which amounts to entrusting a survival manual for life without a network to the one piece of infrastructure that will have disappeared the day it is needed.

Sweden chose a different path. Since 1943, with a long interruption after the Cold War, it has sent every household a booklet on preparing for crisis and war, reissued in 2024. Above all, it settled the question of the till. Since 1 July 2026, under the direction of the Riksbank, its central bank, a physical bank card and its PIN allow food, medicines and fuel to be bought even when communications are cut, for interruptions of up to seven days. The Swedish government has proposed obliging grocery shops and staffed pharmacies to accept cash, and the Riksbank advises every adult to keep around 1,000 kronor at home. A country that pays for almost everything by card has taken seriously the possibility of no longer being able to.

How do you last ten days without a network?

I am a survivalist by nature. I took my first aid certificate with the Red Cross, and there is a bag at home ready for an emergency departure, with clothes, cash and copies of my documents. I often say at conferences that whenever the power goes out in a building, you find two kinds of neighbour, the one who has candles and lends them, and the one who knocks next door to ask whether there might be one going spare. I have always preferred being the one with candles in stock.

It is in that spirit that I give here the advice I follow myself. The official guide aims at 72 hours, whereas a crisis of this type would most likely last longer, and Germany already recommends ten days of supplies. My advice therefore aims at ten days, and can be put in place over a weekend.

Money

Cash becomes the last means of payment again, provided you have some before the cash machines stop. A week of groceries in small denominations is enough, because nobody will give change on a fifty euro note by the third day. I also keep a little gold in small format, 5 or 10 gram bars and no more, because they remain easy to use and to convert if needed. A second account at another bank, ideally of a different kind, a traditional bank for a neobank customer and the other way round, avoids depending on a single infrastructure: on 20 October, Revolut customers who had another card were able to carry on paying. For the same reason, emergency savings have no business sitting on a crypto asset platform, where withdrawals can be suspended overnight, as at Binance on 29 October. The physical card and its PIN must stay within reach, since phone payment depends on the network and the backup arrangements, where they exist, go through the chip and the PIN. A recent statement for each account, downloaded or printed, and the numbers for your bank and its card-blocking service written on paper complete the set.

Water, food and energy

Water pumping and treatment stations are remotely operated and run on generators for only a limited time, which makes water the first reserve to build. The official guide counts six litres per person for three days, so around twenty are needed for ten days, more with children or animals. For food, the simplest approach is to stock what you already eat, tins, pasta, rice, enough to do without a fridge, rotating the stock. A gas stove, lamps, batteries, a charged power bank and a small folding solar panel for the phone and the radio cover energy. It is also better never to let the car's fuel tank drop below half, since in 2021 the East Coast stations emptied well before the fuel itself ran out.

Health

Two weeks' head start on regular treatments, if your doctor agrees, and a paper copy of each prescription avoid the situation American patients faced in 2024, with pharmacies that had the medicines on the shelf without being able to process the coverage. For anything that must stay cold, insulin in particular, a cool box and ice packs will do. The question is worth asking your pharmacist now: how do they work when their software stops responding?

Information and family

When mobile and internet go down, a battery or hand-crank radio remains the only reliable source, and it is through it that the authorities' instructions will come. Important numbers, family, doctor, school, employer, bank, must exist on paper, since nobody knows them by heart any more. It is worth agreeing a family meeting point in case nobody can be reached, as mobile masts last only a few hours on battery.

Documents and data

Paper copies of identity documents, the health insurance card, insurance contracts and bank details avoid depending on an online portal, and the simplest thing is to keep them in a bag ready to go, with some clothes and a little cash. Important photographs and documents are worth backing up to an external drive that you then unplug. The recovery codes for your email's two-factor authentication, printed and kept with the documents, will let you get everything back once the crisis has passed.

Neighbours

Over several days, a building or a street holds up better than an isolated household, and that is where the one with candles becomes useful to the others. It is worth knowing who has a generator, a medical skill or a car, and who lives alone, elderly or dependent, because the most exposed are those with only one channel, the parent who pays for everything with their phone or the neighbour whose medicines arrive day by day.

Afterwards

Every major outage is followed by a wave of fraudulent messages claiming to come from your bank, your operator or the administration, promising a refund or demanding an account verification, exactly as after every major data breach. The rule stays the same: no links, no attachments, you call the official number back yourself, and you watch your accounts over the following weeks.

For shopkeepers

A shop able to sell without its till system stays open when the others close, and it was for lack of that ability that Coop had to pull down the shutters on 800 stores in 2021. A cash float, a printed price list, a sales book and a payment terminal that works offline make it possible to last several days. The refrigeration controller has no business sitting openly on the internet, and nor does any other administration interface.

Defending the banknote

Faced with this kind of risk, the usual answer is to call for more cybersecurity budget. It will not be enough. No budget will make the systems of banks, cloud providers or supermarkets invulnerable, and a country's resilience also rests on what keeps working once they have fallen.

Cash is part of that, and we have been abandoning it for years without thinking. Cash machines are disappearing, some shops refuse notes and contactless has become a reflex. Refusing legal tender nonetheless remains a petty offence in France, rarely punished. A shop that no longer knows how to take payment other than by card will close on the day of the blackout, and a household without cash will depend on others. Sweden, which had gone further than anyone in abandoning cash, is in the process of turning back in the name of crisis preparedness. France should look at the banknote for what it has become, a piece of resilience infrastructure.

What the state must decide now

The Banque de France can reproduce what the Riksbank achieved in nine months, by bringing the card payment group, the banks, the acquirers and the retail sector around an agreement guaranteeing offline card payment for food, medicines and fuel for several days. The Swedish agreement was signed in October 2025 and applied on 1 July 2026, and nothing stops France from keeping to a comparable timetable.

The legislator can, for its part, oblige food shops, pharmacies and staffed petrol stations to accept cash and to know how to operate in degraded mode, with a cash float, a paper procedure and an annual test, in the same way the fire alarm is tested. The supermarket, absent from the scope of NIS2, would thus enter national resilience through the door that matters to the population, the one at the till.

The « Tous responsables » guide, finally, should be printed and sent to every household, with an annual national exercise during which everyone would check, over a weekend, whether they could last ten days without a network.

My three days without a network were my own choice, in a place where everything around me kept working. On 20 October, Revolut customers went through a cut they had not chosen, one day only, with supermarkets open, pumps running and other cards working. Since 29 October, Binance customers have been waiting to get access to their funds back. The day all of that stops at the same time, the difference between those who hold on and the rest will have been made long before, at home.

Further reading

• We fix whatever makes noise
• We accept cyber risk the way we pick the plant in reception
• Parliament has never been your CISO
• The only backup that counts is the one you have already restored
• Free: the fine is being argued at the Conseil d'État, the phishing carries on
• Practical steps to protect yourself on etrecyber.fr

Sources

• iGeneration, Grosse panne chez Revolut : les paiements et d'autres services de retour après une journée d'interruption, and Journal du Geek, Votre carte Revolut est refusée ce matin ?, 20 October 2026.
• CNBC, Binance says 90% of $6.3 billion hack losses are now covered, 31 October 2026, for the FBI attribution; NBC News, Binance targeted in $6.3 billion crypto heist, the largest ever, and CBC News, 30 October 2026, for the amount, the duration and the origin of the intrusion.
• BleepingComputer, Critical Linux kernel flaw allows remote root attacks on MPTCP servers, 30 October 2026; The Hacker News, Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions, 29 October 2026.
• StateScoop and AFP, January 2022, for the Bernalillo County prison in New Mexico.
• CISA, NSA and FBI, joint advisory AA24-038A on Volt Typhoon, 7 February 2024.
• Wikipedia, Cyberwarfare during the 2026 Iran war, October 2026, for the Iranian connectivity recorded by NetBlocks, the Amazon data centres and the attacks on American water networks reported by the New York Times.
• General Secretariat for Defence and National Security, Tous responsables, 20 November 2025, presented on info.gouv.fr.
• Sveriges Riksbank, Offline card payments should be possible no later than 1 July 2026, October 2025, and the Offline payments page; Myndigheten för samhällsskydd och beredskap, Om krisen eller kriget kommer, November 2024.
• Directive (EU) 2022/2555 of 14 December 2022, known as NIS2, Annex II; French penal code, Article R642-3.