Hackers turned the fridges of hundreds of French supermarkets into something closer to ovens overnight on Sunday. They forced temperatures as high as 50C, spoiled fresh and frozen stock and, according to Paris prosecutors, started fires.
The attack ran through the night of October 11-12 and targeted refrigeration control systems made by Danish engineering group Danfoss. The attackers did not switch the cooling off. Instead they reportedly took over a routine maintenance feature and locked cabinets into a non-stop defrost cycle. Les Mousquetaires, which owns Intermarché, said affected units ran hot for about six hours.
The group said about 150 Intermarché stores were hit and that every affected branch had thrown out its fresh and frozen food to avoid any health risk. Some French media reports put the group’s total closer to 300 once its Netto discount stores are included. Coopérative U said almost 100 of its outlets were affected. Broadcaster BFM TV reported that E.Leclerc, France’s largest grocer, was also caught up, although Leclerc did not immediately confirm this.
Writing on X, Coopérative U chief executive Dominique Schelcher called the targeting of equipment that keeps the country’s food fresh “unprecedented” and “unacceptable”.
The early damage estimates are large. French press reports say Les Mousquetaires has put national losses at several million euros. Individual store managers have described write-offs from about €50,000 to more than €200,000 per site.
The Paris prosecutor’s office has opened an investigation into what it called a “large-scale” attack and listed food losses and fires among the reported damage. Prime minister Sébastien Lecornu has asked France’s national cybersecurity agency, ANSSI, to investigate. His office said France was coordinating with European partners because other countries could also be exposed.
Read next: Your clients aren’t the target - their supplier is
A source close to Lecornu said ANSSI had found a vulnerability in Danfoss software. Danfoss said it was aware of incidents affecting “a limited number” of French refrigeration management systems that were running outdated firmware. It added that it had long advised customers to keep their systems updated and to replace legacy equipment.
There had been clear public warnings beforehand. In August, researchers at Claroty’s Team82 unit published details of flaws in Danfoss supermarket refrigeration controllers, and Danfoss has since released patched firmware. BFM TV reported that the attackers targeted software older than version 4.
Les Mousquetaires has also reportedly said the systems were managed by Danfoss and that filing a complaint was the supplier’s responsibility. That detail could become important once the claims start.
This is where it gets uncomfortable for a risk manager explain the losses. Intermarché has already warned that some of its policies may not cover this type of in-store incident.
The case is a clear example of silent cyber. A cooling failure that spoils stock might normally be covered by a property policy’s deterioration-of-stock or equipment breakdown section. However, Lloyd’s now requires syndicates to state clearly whether cyber is covered or excluded, and the Prudential Regulation Authority has pushed insurers on non-affirmative exposure. As a result, many property wordings now carry broad cyber exclusions. Governance specialist Mactavish warned that this trend was leaving commercial clients under-insured for broadly tech-related losses.
Standalone cyber policies, meanwhile, are usually designed around data breaches, network outages and lost income, not spoiled yoghurt and fire-damaged display cabinets. Physical damage caused by a cyber attack can be insured, but generally only when a business buys it deliberately, for example through dedicated cyber property products. It should not be assumed to sit within an existing policy.
There may also be a recovery angle. If the controllers were managed by the supplier, any insurer that pays out may look at whether it can recover those costs further up the chain.
Read next: Brit doubles cyber consortium capacity to $200 million as ‘silent’ gaps continue to persist
A separate problem emerged in the Netherlands. Ahold Delhaize said it was dealing with a “security issue” and had taken several systems offline. Albert Heijn stores stayed open, but the chain’s app and delivery service went down and electronic shelf labels showed the wrong prices. No link to the French attack has been established.
Nothing so far suggests that UK stores were affected. Still, the attack comes as UK retail continues to deal with the aftermath of the M&S, Co-op and Harrods incidents, which have already fuelled demand for cyber cover. Separate analysis found that four in five of the UK’s top 50 retailers had at least one serious cyber vulnerability.
Brokers handling food retail, cold storage and logistics accounts may want to ask clients two questions this week. First, is their refrigeration control equipment connected to the internet, and is its firmware up to date? Second, if someone turns it up to 50C, which policy responds, if any? The National Cyber Security Centre publishes guidance on securing operational technology.
Read next: Jaguar Land Rover did not finish cyber insurance purchase
