A cyberattack that has destroyed millions of euros of food across Europe by switching supermarket fridges into defrost mode has now reached the UK, and the coverage gap it exposed along the way has arrived with it.
Richard Horne, chief executive of the National Cyber Security Centre (NCSC), confirmed that UK organisations had been affected, telling BBC Radio 4’s Today programme that his team had worked through the night alerting firms with vulnerable technology exposed. The British Association of Independent Meat Suppliers said some members had been affected, though none had lost inventory.
The attacks follow a pattern that has been building since October. Hackers disrupted refrigeration at around 350 French supermarkets on the night of October 11 to 12, with national losses estimated in the tens of millions of euros, according to Les Mousquetaires president Thierry Cotillard, as City AM reported. A second wave struck supermarkets in seven countries last week, including Ireland, with one Belgian Delhaize branch alone estimating stock losses of €100,000 before accounting for lost trading time. UK businesses have now joined that list.
What has not changed since France is the coverage position. Cyber policies typically exclude physical losses. Property policies with spoilage cover frequently carry cyber exclusions.
Intermarché confirmed to AFP that its insurance did not cover the incident, and four insurance brokers told Reuters the same was true across the sector. Standard cyber policies responding to data breach, business interruption, and PR costs do not reach stock destroyed by a remotely triggered temperature change.
A specialist endorsement or standalone product is required, and most UK retailers do not currently have one, according to Aon’s David Molony, head of cyber solutions for EMEA, who told Reuters he recommends specific perishable goods cover for retail and pharmaceutical clients.
The spoilage cover question is not the only one worth checking. If attackers are found to be state-backed, war exclusions in cyber policies may apply. The fact that Sabcobel, the Belgian company operating Delhaize’s refrigeration systems, said physical modifications rather than software updates were needed to address the vulnerability also raises questions about patching warranties and security conditions in existing policies.
The method being used is not sophisticated. Horne told BBC Radio 4’s Today programme that the French fridges had been “connected directly to the internet with default passwords.”
Martin Riley, chief technology officer at cyber security firm Bridewell, said refrigeration equipment was particularly exposed because its products were perishable and operations depended on tightly controlled temperatures. “A supermarket fridge holds no secrets. It holds a temperature,” Riley told City AM. “Change that temperature overnight and you destroy the value of everything inside it within hours. There is no backup to restore from. The stock is simply gone.”
Ed Hayes, data protection partner at law firm TLT, described operational technology as a “cybersecurity blind-spot,” noting that retailers have historically invested more heavily in protecting payment systems and customer data than refrigeration and logistics equipment. “Legacy OT systems that were never designed with cyber resilience in mind are frequently still in use, running without basic security controls,” Hayes told City AM.
Horne used Tuesday’s NCSC Annual Review launch to sharpen that warning. AI is not creating new attack methods, he said, but it is enabling attackers to discover and exploit existing vulnerabilities at a scale that was previously impossible.
The Cyber Security and Resilience Bill, currently progressing through Parliament, extends to critical infrastructure and the suppliers that underpin it. That framework will increasingly bring OT-dependent sectors into its reach.
The attacks began in France, spread to seven countries, and have now reached the UK. Standard property and cyber programmes were not designed with this scenario in mind, and the businesses finding that out in France and Belgium are finding it out at the point of a claim.
