Claims from the cyberattack on French supermarket refrigeration systems are now reaching property insurers. Establishing the cause of loss is emerging as the central question in deciding which policy, if any, responds.
Attackers took control of internet-connected refrigeration controllers at up to 700 French supermarkets on the night of 11 to 12 October. They triggered prolonged defrost cycles that heated fridges and freezers, spoiling stock. As Insurance Business (IB) reported at the time, some stores also reported fires. The attack exploited controllers that Danfoss said were often running outdated firmware.
French retail property policies commonly include refrigeration spoilage cover, according to claims professionals handling the losses. But they also typically contain cyber exclusions, and the wording of those exclusions varies between insurers and policies.
That creates a potential clash. A policy may be designed to cover spoiled refrigerated stock while also excluding losses caused by malicious interference with computer systems. If an investigation finds the loss resulted from sabotage, malicious software or another event covered by a cyber exclusion, the property policy may not respond. In the worst case, that leaves a gap between cyber and property cover.
Standalone cyber policies don’t necessarily fill that gap. As IB has reported, cyber policies typically cover incident response and restoration but exclude physical loss, and claims could become more complicated if a state actor is identified, because of war exclusions.
Claims teams will need to establish what happened, how it happened, and exactly how the event led to the loss being claimed, rather than simply whether there was a cyberattack.
The scale of individual losses can be significant. Lockton, which has warned of physical loss exclusions after the attack, said refrigeration failures caused €270,000 of stock losses at just two stores.
The attack shows how connected technology turns a cyber event into a physical one. Refrigeration, heating, ventilation and other building systems are increasingly monitored and controlled remotely, often through equipment installed years ago when cyber threats were less prominent.
The exposure is not limited to France. IB’s US coverage noted that the US is Danfoss’s largest single market, and that physical damage from a cyberattack is generally only insured where a business buys that cover deliberately, through a cyber endorsement or a dedicated cyber property product, as IB reported for US grocers.
For brokers with UK retail, food, hospitality or pharmaceutical clients, the attack is a reason to review how property and cyber policies fit together now, not after a loss. Key questions include whether property spoilage cover carries a cyber exclusion, whether the cyber policy covers physical damage or stock loss, and whether there is specific cover for perishable goods.
