The Cost of Losing Your Cool: Tally the Losses of a Supermarket Cyberattack

Insurance and Financial Implications of France‘s Supermarket Refrigeration Cyberattack

Keeping things cool is generally a good idea in the supermarket business. When a cyberattack reportedly interferes with refrigeration systems, the consequences can extend well beyond a few melted ice creams. The recent incident affecting French supermarkets raises complex questions about insurance coverage and, just as importantly, how to put a price on the resulting financial losses.

What happened?

In a cyberattack that exposed how vulnerable internet-connected systems can be, attackers took over the refrigeration equipment in hundreds of French supermarkets. Working through the units’ direct internet connections, the attackers manually changed the temperature settings on refrigerators belonging to several supermarket groups. Some reports suggest that the hackers were able to raise the temperature of the refrigerators remotely, and in some cases the units got up to 50°C (122°F) and even sparked fires. This is a somewhat rare example of a cyber incident causing a physical loss.

To date, no ransom or other demand has been made, and no group has publicly claimed responsibility. About 350 supermarkets in France were affected. The refrigeration units ran software from the Danish company Danfoss. Many of the compromised units were past their end of life, meaning they no longer received software or security updates, or they were running outdated firmware.

A similar attack hit a retailer in the Netherlands. That Dutch company also operates several U.S. grocery chains, including Stop & Shop and Giant Food.

Which insurance applies: Cyber, Property, Both or Neither?

Is this loss insured under cyber coverage or property coverage? Possibly both—or neither. Many property policies now contain cyber exclusions, some with carveouts for resulting fire damage. Spoilage of refrigerated stock is often covered only by endorsement or under equipment breakdown coverage, which may carry its own cyber-related limitations.

To the extent the answer is cyber, the threshold question is whether these grocers purchased such coverage. Sources suggest that the uptake for cyber insurance in France lags the U.S. by a considerable margin, particularly for smaller businesses. Even in the U.S., small business uptake on cyber insurance is estimated in the range of 50%.

Stock losses, business interruption and increased costs

The most obvious consequence of a refrigeration failure is spoiled stock. Putting a value on the damage is not necessarily as straightforward as counting the contents of the freezers. This raises a host of questions: Should the stock be valued at the cost to the grocer? Should it be valued at retail price? Does it have salvage value? And how is a double recovery avoided if insurers are also paying for lost business interruption losses?

Establishing business interruption losses under such circumstance could prove challenging for insureds, particularly where supermarkets have remained open while certain departments were temporarily closed or operating at reduced capacity.

After all, a customer unable to buy frozen pizza might opt for a fresh one instead, visit another supermarket (possibly within the same retail group), or simply return when the freezers are back in action. Not every lost sale of frozen food necessarily translates into a euro-for-euro drop in profit.

Nor can a reduction in turnover simply be multiplied by the supermarket’s accounting gross margin to arrive at the insurable loss. Depending on a policy wording, adjustments may be needed for uninsured working expenses, savings in variable costs, and differences in contribution margins between product categories.

Even when the refrigeration equipment is back up and running, the financial consequences may linger. Replenishing stock, restoring product ranges and returning to normal trading can take time, while temporary refrigeration, expedited deliveries and other mitigation measures may add to the bill.

Exclusions, business interruption triggers and attribution

Cyber policies often exclude “physical damage and bodily injury.” Does this exclusion apply to the stock loss or the physical damage caused by resulting fires or physical damage to the equipment itself? Some cyber policies have exceptions to such exclusions that would restore coverage for “bricked” hardware rendered unusable by an attack. If that language were present here, it might respond to damage to the controllers, if not the refrigeration units themselves. Under U.S. law, depending on the state and the policy wording, this issue could implicate the efficient proximate cause doctrine and lead to questions as to whether the predominant cause of the damage was the cyberattack or the loss of cooling or an intervening fire. The affected grocers’ policies, however, are likely governed by French law, under which exclusions must be clear and limited (“formelle et limitée”) to be enforceable.

This incident also raises questions as to whether the grocers’ income loss would fall within direct business interruption coverage or contingent business interruption coverage. It is not yet clear whether this was a coordinated, potentially automated attack against refrigeration controllers installed at individual stores or whether this was a breach of the manufacturer’s central software infrastructure. The former would implicate direct business interruption coverage, while the latter would be a contingent business interruption issue. Early reports cut both ways: French supermarket chain E.Leclerc has attributed the disruption to an attack on one of its refrigeration equipment suppliers, while Danfoss has pointed to outdated equipment at customer sites.

For contingent business interruption, many cyber policies require a written contract between the insured and the dependent business that experienced the security breach, and some limit coverage to providers of IT services. Whether a refrigeration manufacturer qualifies may depend on whether it hosts or operates the remote monitoring platform. Presumably, these grocers had written contracts with the refrigerator manufacturers when the units were purchased. But do they now?

Danfoss, the manufacturer of the affected controllers, has said that most of the affected units were legacy models that no longer receive software or security updates, and that it had long advised customers to update or replace them. Have these customers let their contracts expire? Are they simply operating the remote systems on their own without an active contract with the manufacturer? That could impact coverage if the attack vector is at the manufacturer level. Conversely, if the attackers exploited unsupported or unpatched equipment at the store level, insurers may point to policy conditions or exclusions addressing unsupported software or failure to apply available security patches.

Attribution may also matter. No group has claimed responsibility, but if the attack is ultimately attributed to a state actor, insurers may invoke war or state-backed cyberattack exclusions, which Lloyd’s has required in standalone cyber policies since 2023.

Separating incident losses from normal trading

One of the challenges in assessing these claims will be distinguishing losses genuinely attributable to the incident from the usual ups and downs of supermarket trading. Seasonality, promotions, pricing changes and underlying sales trends can all affect turnover, whether or not the freezers are working.

A forensic accounting assessment may therefore involve examining point-of-sale data, departmental margins, historical trading patterns and comparable unaffected stores to establish what the incident actually cost, rather than simply valuing lost stock or comparing projections to actuals.

Subrogation and recovery against third parties

The story may not end with the insurance claim. If investigations establish grounds for recovery against equipment manufacturers, maintenance contractors, or technology providers, the financial consequences could extend further down the chain. The further upstream a vulnerability lies, the more businesses a future attack could affect, and the more parties could face recovery claims as a result.

A broader operational technology problem

While some officials are characterizing this event as an attack on France’s food supply, the attack could be part of a broader trend of hackers testing the security vulnerabilities of various operational technologies. In many businesses, operational technology (OT) may be less secure than IT systems.

The risk extends well beyond supermarkets: There are documented concerns that U.S. water utilities also run critical systems on outdated software that is directly connected to the internet. These critical systems are vulnerable to the same type of remote attack and manipulation that could alter water chemistry or pressure and cause physical damage.

The Bottom Line

This incident raises important questions about the intersection of cyber and property risk. And it highlights the problem with operational technology being outdated and connected to the internet. When hackers can access physical equipment, the risk is more than lost data and business interruption; it can impact health and safety.

From the lens of insurance coverage, a clear understanding of the losses, their causes, and their financial consequences will be essential to navigating the claims and recovery process.

Topics Cyber Profit Loss