Hackers turned refrigerated cases at hundreds of French supermarkets into something closer to ovens overnight Sunday. They drove temperatures as high as 50C, spoiled fresh and frozen stock and, according to Paris prosecutors, sparked fires.
The attack ran through the night of Oct. 11–12 and hit refrigeration control systems made by Danish engineering group Danfoss. The attackers didn’t simply shut the cooling off. They reportedly hijacked a routine maintenance setting and locked units into a non-stop defrost cycle. Les Mousquetaires, owner of the Intermarché chain, said affected cases ran hot for about six hours.
The group said roughly 150 Intermarché stores were hit and that all fresh and frozen product at those locations was thrown out. Some French media reports put the group’s total closer to 300 once its Netto discount stores are included. Coopérative U said almost 100 of its stores were affected. Broadcaster BFM TV reported that E.Leclerc, France’s largest grocer, was also caught up.
Coopérative U CEO Dominique Schelcher posted on X that targeting equipment essential to keeping the country’s food fresh was “unprecedented” and “unacceptable.”
French press reports cite Les Mousquetaires estimating losses in the millions of euros. Individual store managers have described write-offs from about €50,000 to more than €200,000 per location.
Paris prosecutors have opened an investigation into what they called a “large-scale” attack. Prime Minister Sébastien Lecornu has asked France’s national cybersecurity agency, ANSSI, to investigate. His office said France is coordinating with European partners because other countries may also be exposed.
A source close to Lecornu said ANSSI had found a vulnerability in Danfoss software. Danfoss said it was aware of incidents affecting “a limited number” of French systems running outdated firmware. It added that it had long urged customers to update and retire legacy equipment.
The weak spots weren’t secret. Danfoss has published a run of security advisories for its AK-SM 800A system managers, the units that coordinate supermarket refrigeration. In August this year, researchers at Claroty’s Team82 unit detailed further flaws in the platform, which Danfoss has since patched, and reported thousands of the controllers reachable from the open internet. Investigators haven’t said whether any of those specific flaws were used in France.
That matters here. Danfoss has operated in Canada since the early 1950s and runs a sales and service headquarters in Oakville, Ont., covering its refrigeration business among others. There’s no indication any Canadian store has been hit, and no public data on how many Canadian grocers run the affected controllers.
Intermarché has already warned that some of its policies may not cover this kind of in-store incident. Canadian policyholders should be asking the same question.
Spoilage cover on a commercial property policy is typically built around power failures or equipment breakdown. But carriers have spent years tightening cyber exclusions in response to silent cyber concerns. Gallagher’s John Farley has told Insurance Business that traditional property policies often carve out cyber-related physical damage, while standalone cyber policies vary widely on whether they’ll respond to property damage at all. A walk-in cooler full of ruined meat could fall right between the two.
Physical damage caused by a cyber attack can be insured, but generally only when the business buys that cover deliberately, through an endorsement or a dedicated cyber-property product.
There’s a subrogation angle, too. Les Mousquetaires has reportedly said the systems were managed by Danfoss. Any carrier that pays a claim may look at recovering its costs from further up the chain.
Read next: Sobeys cyberattack projected to cost $25 million after insurance
Canadian food retail has been hit before, though on the IT side. The November 2022 attack on Sobeys parent Empire Co. knocked out pharmacy services and self-checkouts. Empire initially put the hit at $25 million net of insurance and later raised its estimate to about $32 million over two fiscal years. It also warned that the “complexity” of cyber insurance coverage would delay its recoveries.
That was a data and systems event, and even then the claims took time to work through. A cyber attack that destroys physical stock raises a harder question: which policy responds to the loss, if any?
Brokers with grocery, cold storage and food distribution clients may want two answers this week. Is the refrigeration control equipment connected to the internet, and is it patched? And which policy pays if someone sets it to 50C? The Canadian Centre for Cyber Security publishes guidance on securing operational technology.
Read next: What UK retail data breaches mean for the global cyber insurance market
