A cyberattack targeting connected refrigeration systems at French supermarkets is exposing a significant gap in corporate cyber insurance after retailers were forced to discard large quantities of food that may not be covered by conventional policies.
Hackers took control of internet-connected refrigeration equipment at roughly 350 French supermarkets, raising temperatures inside refrigerators and freezers to as high as 50 degrees Celsius.
The attack forced affected stores to dispose of spoiled food and could generate losses totaling tens of millions of euros nationwide.
The incident is significant because the damage crossed the boundary between digital disruption and physical economic loss.
Traditional cyber-insurance policies generally cover expenses such as incident investigation, system restoration, legal costs and crisis management.
Physical losses resulting from a cyberattack, however, are frequently excluded.
Insurance brokers said claims could also depend on whether affected companies maintained required software updates and complied with cybersecurity conditions contained in their policies.
France’s cybersecurity agency said affected refrigeration equipment included systems using software supplied by Danfoss, Copeland and Dixell.
Danfoss said many affected appliances were operating outdated software or had reached the end of their supported life and no longer received security updates.
The attack illustrates a growing vulnerability created by the expansion of the Internet of Things.
Equipment that was once largely mechanical—including refrigeration, industrial machinery, building controls and energy systems—is increasingly connected to corporate networks and the internet.
That connectivity creates operational efficiencies but also gives attackers additional pathways for causing physical disruption.
The insurance industry is beginning to respond.
Some businesses are seeking policies specifically covering physical damage and perishable inventory resulting from cyber incidents. Similar coverage already exists in parts of the energy, marine-cargo and defense industries.
The French incident could accelerate that shift across retail, pharmaceuticals and other industries dependent on temperature-controlled products.
For companies, the lesson extends beyond conventional cybersecurity.
As physical infrastructure becomes digitally connected, cyber risk increasingly becomes operational and financial risk as well.
