France’s attribution of supermarket refrigeration hacks to Iran’s Revolutionary Guards is sharpening questions about how businesses insure cyberattacks that damage stock and equipment, as connected operating systems bring physical losses into cyber risk discussions.
French Foreign Minister Jean-Noël Barrot said Monday that the Revolutionary Guards were responsible for October’s attacks and that France would pursue European sanctions. His statement followed Reuters reporting that French officials suspected Iranian state-backed hackers were behind the incidents.
The October 11 attack overrode refrigeration temperature controls at hundreds of establishments. Reuters reported that some affected units were obsolete or running outdated firmware.
A report published Monday by France’s cyber crisis coordination center said the attack targeted refrigeration controllers at about 700 retail sites overnight on October 11-12. Attackers altered defrost settings to high temperatures, causing substantial inventory losses and at least 15 fires.
Affected retailers included Carrefour, Intermarché and Leclerc. Authorities also identified victims elsewhere in the food industry, including small butcher shops, a slaughterhouse and cooperative food-processing factories.
The French report attributed the operation to Shahid Kaveh, a cyber unit affiliated with the Revolutionary Guards. Investigators cited connections between the attack infrastructure and other activity associated with the unit, alongside traces of Farsi recovered from that infrastructure.
The damage illustrated how interference with a digital controller can quickly become a physical loss. Reuters reported that some affected refrigeration units were obsolete or running outdated firmware.
Further incidents followed in early November. Reuters reported that refrigeration systems at stores in eight European countries were tampered with around the same time that three regional French blood banks suffered a cyberattack affecting cold storage monitoring and controls.
Separately, US military investigators said they were examining suspected refrigeration hacks at military commissaries; a connection to the European incidents has not been established.
Read more: Pentagon investigates freezer failures as French attacks expose coverage gaps
The incidents highlighted a concerning scenario for insureds: a remotely manipulated system can leave spoiled inventory, damaged equipment, interrupted operations, and other losses.
Ashley Jones, SVP, AI Risk and Advisory, Cyber & Technology Practice at Lockton told Insurance Business in an earlier interview that the internet of things, or IoT, deserves greater attention in discussions about companies’ defenses.
“The IoT has been a conversation in cyber underwriting for a long time. I think that is an area that will and should come to the forefront of the conversation when we talk about the defensive position that companies need to have,” Jones told Insurance Business.
Her concern is also tied to the expansion of artificial intelligence tools, and how interconnected technology expands the systems attackers can manipulate. “You could have manufacturing lines that are integrated with AI, allowing an entry point or a target for a threat actor to cause some mishap that could result in bodily injury, first-party property damage, third-party property damage,” she pointed out.
That range of potential harm gives brokers a reason to involve colleagues handling property and liability coverage alongside cyber specialists. A useful starting point, Jones said, is to map a client’s connected equipment against the consequences of losing control of it, then examine the relevant policy wording and limits.
The discussion also needs to account for an attacker seeking disruption without demanding payment or stealing information. Jones said threat actors’ motivations range from hacktivism to financial gain, with different objectives shaping the losses they may cause.
“It's always a cat and mouse game, but we have to be very creative in thinking of what these threat actors want to accomplish and how might they accomplish them,” Jones said.
