Hackers took remote control of refrigeration systems at around 350 French supermarkets on the night of 11-12 October, raising temperatures in connected fridges and freezers to 50 degrees Celsius.
The food losses could run to tens of millions of euros nationally, according to Thierry Cotillard, president of Les Mousquetaires, owner of the Intermarché chain, who said a legal battle over liability has already begun.
What will not resolve that battle quickly is insurance. Cyber policies typically do not cover physical losses from attacks, four insurance brokers told Reuters. Intermarché confirmed to AFP that its insurance did not cover this type of incident.
There is a further complication on attribution. If a state actor is identified behind the hack, cyber policies could exclude coverage entirely under war exclusions - a scenario a Lloyd's underwriter, speaking anonymously to Reuters, said could complicate supermarkets' claims. Whether failing to update the affected software - supplied by Danish firm Danfoss, along with Copeland and Dixell, according to France's cybersecurity agency - would affect policy response depends on individual contract terms, though Paul Gooch, deputy departmental head at Tokio Marine Kiln, told Reuters that outdated software is not usually, by itself, grounds for rejecting a claim.
Tiago Henriques, chief underwriting officer at Coalition, told Insurance Business the incident was foreseeable - and preventable.
"Before the fridges heated up, warning signs were visible," he said. In August 2026, Claroty's Team82 published research identifying multiple critical vulnerabilities in the web-accessible admin panels embedded in Danfoss AK-SM 800A refrigeration controllers, including hidden authentication bypass mechanisms (CVE-2025-41450) and command injection vulnerabilities (CVE-2025-41451). Danfoss released a firmware update (R4.3.1) to address them following coordinated disclosure.
Coalition's own scanning found the patches had not been applied at scale. Between September 7 and October 6, 2026 - weeks after the fixes were released - its sensors identified 1,506 unique IP addresses still publicly exposing a Danfoss StoreView web admin panel. Of those, 820 (54%) were associated with French networks, and 89% served a web interface built before 2026.
"Our scans counted at least 2,624 refrigeration controllers from the named brands with a login page open to the internet," Henriques said. "An unpatched device featuring a web-accessible admin panel can act as a major entry point."
Coalition's scanning was strictly external - no intrusion tests were conducted, and the identified addresses are not confirmed as the affected stores. But the picture it paints of internet-exposed, unpatched operational technology is the attack surface the hackers exploited.
"For brokers and their clients, the takeaway is clear: digital risk extends far beyond workstations and email servers," Henriques said. "Operational technologies and connected devices driving daily operations represent critical links that benefit from continuous monitoring. Identifying these exposed access points before they are targeted can directly contribute to preserving business continuity."
The attack's insurance implications extend well beyond France. David Molony, head of cyber and financial sponsors at Aon, told Reuters he recommends specific cover for perishable goods for companies in retail and pharmaceuticals - cover that goes beyond standard cyber policies. "Given the increasing digitisation of operational technology and connected systems, this is an area that businesses should review carefully," he said.
Aon has been arranging "high-value towers" in the London market that include perishable stock cover, reflecting growing demand from large retailers. Standard cyber policies that respond to data breach, business interruption, and PR costs will not fill this gap. A separate endorsement or specialist product is required - and most UK retailers do not currently have one.
Emma Pleut, head of cyber for France at WTW, noted that insurers typically require policyholders to declare their software update policies and commit to critical patches within specific timeframes. Where those commitments are not met, coverage disputes become more likely - even where outdated software is not, in principle, an automatic bar to a claim.
Sydonie Williams, head of international cyber risks at Beazley, told Reuters that recent cyberattacks in France and Britain could push premiums higher for the retail sector: "I absolutely think that could happen."
This is not a remote European problem for UK brokers. As Insurance Business reported this week, Phase Eight owner TFG London was itself hit by a cyber incident on October 11 - the same day as the French attack - and the UK retail sector has now had four significant incidents in a fortnight. The French case is the clearest illustration yet of what operational technology exposure means in practice when cover has not been designed for it.
