A large-scale cyber-attack targeting supermarket refrigeration systems across Europe has demonstrated how cyber incidents can quickly translate into physical damage and product spoilage losses. The incident affected multiple leading retailers and disrupted operations across hundreds of stores.
While the incident resulted in physical losses, it also raises important questions around insurance coverage for cyber-triggered property damage.
What happened?
Hundreds of stores across multiple French supermarket chains have reportedly been hit by a cyber-attack, causing their fridges and freezers to heat up, and spoiling fresh and frozen food.
Attackers compromised the software used to manage refrigeration units remotely, before forcing temperatures in some of those units to rise to as high as 50°C.
The attack resulted in widespread food spoilage worth potentially millions of euros, and reportedly even started small fires at some locations.
Multiple French supermarket chains have been affected by the attack.
The incident is not believed to be limited to France, with reports suggesting that organisations in Spain, Portugal, Poland, Germany and Belgium were also affected.
Why should businesses be concerned?
The incident highlights a growing cyber-physical threat facing food and beverage organisations that rely on connected operational technology, industrial control systems, or IoT devices. These technologies create opportunities for threat actors to cause tangible operational disruption beyond traditional data breaches or ransomware events.
Confirmed and potential impacts of the recent attack include:
Spoilage of refrigerated or frozen goods
Business interruption and lost revenue
Product recall and disposal costs
Property damage resulting from equipment malfunction and subsequent fire
Supply chain disruption and contractual liabilities
Is exposure limited to food retailers?
No – the exposure extends far beyond food retailers. Pharmaceutical manufacturers, life sciences companies, healthcare providers, chemical businesses, hospitality operators, and any organisation handling temperature-sensitive or perishable products face similar risks.
When insurance may not respond
While this may appear to be a traditional property loss, it highlights a critical and often overlooked insurance gap. Nearly all property policies exclude cyber-related losses, meaning that spoilage, stock deterioration and resulting business interruption arising from a cyber event are unlikely to be insured under a standard property programme.
Conversely, traditional cyber policies often exclude physical damage and resulting losses, creating a potential coverage gap.
Addressing the coverage gap
To address this gap, businesses can access specialist cyber property damage solutions designed to respond when a cyber incident causes physical damage, spoilage, stock deterioration, or business interruption. These policies aim to bridge the disconnect that can arise between traditional property and cyber insurance programmes.
These policies can be purchased on a standalone basis, or as an extension to your traditional cyber policy. Cover for cyber property damage and spoilage is available up to a limit of £650m.
Reviewing your exposure
The French supermarket attack serves as a real-world example of how cyber incidents disrupt operations and compromise product integrity.
As organisations become increasingly reliant on connected operational technology, now may be an appropriate time to review whether existing insurance arrangements respond adequately to cyber-triggered spoilage and other cyber-physical losses.
For more information, reach out to a member of our Cyber & Technology team.
