A cyberattack that caused widespread food spoilage across French supermarkets has highlighted potential gaps between cyber and property insurance, with Lockton warning that businesses may face uncertainty over coverage when digital incidents cause physical losses.
The attack, which affected hundreds of stores in October, saw hackers manipulate connected refrigeration systems, triggering defrost cycles and causing temperatures to rise. Retailers were forced to discard large quantities of fresh and frozen food, disrupting operations and generating substantial losses.
Two supermarkets in Alsace reportedly recorded €270,000 in merchandise losses, while Intermarché’s chief executive warned that nationwide losses could reach tens of millions of euros in a single day.
In an analysis of the incident, Lockton Australia's national manager for cyber and technology, Mark Luckin, and head of corporate for Queensland, Andrew Curl, highlighted how cyberattacks can create financial losses extending beyond data breaches and ransomware.
Cyber insurance typically covers incident response, system restoration and certain business interruption losses, while property insurance generally responds to insured physical damage and associated interruption.
However, coverage becomes less straightforward when a cyberattack causes equipment to malfunction, resulting in spoiled inventory and lost revenue. Traditional cyber policies may exclude physical damage, while property policies can contain exclusions or restrictions relating to cyber events.
Australian businesses can also purchase deterioration of stock insurance, although whether it responds to cyber-induced refrigeration failures depends on policy wording. Specialist cyber-physical damage insurance offers another option, with Aon’s analysis of cyber-physical exposures identifying products designed to address gaps between conventional cyber and property cover.
Lockton said businesses with significant physical assets, perishable inventory or complex supply chains should assess how their insurance arrangements would respond to such incidents, particularly when financial losses continue after affected systems have been restored.
The French attack also exposed vulnerabilities in operational technology supplied by third parties. Reports linked the disruption to refrigeration management systems supplied by Danish manufacturer Danfoss, with affected equipment reportedly running outdated firmware.
Multiple supermarket groups, including Carrefour, Monoprix and Intermarché, were affected, illustrating how weaknesses in widely used technology can disrupt otherwise separate businesses.
Such dependencies can complicate insurance arrangements, particularly where an incident originates outside a policyholder’s own technology environment. Some cyber policies provide contingent business interruption coverage for third-party disruptions, although protection depends on the circumstances and policy terms.
The exposure extends beyond food retail. Manufacturers, warehouse operators and logistics providers increasingly depend on connected systems to maintain production, storage and distribution.
Australia’s operational technology cyber security guidance also identifies supply chain security and the protection of connected industrial systems as important considerations in managing these risks.
Beyond spoiled inventory, Lockton noted that affected businesses may face emergency response expenses, additional logistics costs, lost revenue and expenditure required to restore normal operations.
These losses can accumulate after the initial disruption has been contained, making the eventual financial impact difficult to establish immediately.
