French Supermarket Attack Highlights Gaps in Cyber Insurance

Mashrukh Khan: French supermarket chains are confronting tens of millions of euros in losses after hackers remotely seized control of refrigeration systems at hundreds of stores, forcing the disposal of large quantities of spoiled food. The incident, which unfolded overnight on 11 and 12 October, saw attackers raise temperatures in internet-connected fridges and freezers to as high as 50 degrees Celsius. Fresh and frozen products thawed or effectively cooked over several hours, leaving retailers with no choice but to throw everything out to protect public health. Some stores also reported fires linked to the overheating equipment.

Major groups including Intermarché, Carrefour, Coopérative U and Monoprix confirmed impacts across their networks. Les Mousquetaires, the owner of Intermarché, said roughly 150 of its stores were affected for about six hours. Thierry Cotillard, president of the group, estimated that the nationwide cost could reach tens of millions of euros in a single day. France’s Paris prosecutor’s office described the event as a large-scale attack targeting connected refrigerators at several major food retailers and opened an investigation.

Insurers and brokers have made clear that standard cyber policies are unlikely to respond to the physical losses. Four insurance brokers told Reuters that cyber insurance typically does not cover damage to stock or other physical consequences of an attack, even when the root cause is digital. Policies may help with investigation costs or public relations advice, yet the spoiled inventory itself generally falls outside the cover. Intermarché confirmed to AFP that its insurance arrangements did not extend to this type of incident. A further complication arises if investigators attribute the attack to a state actor, because many cyber policies exclude acts of war. Outdated software on some of the affected systems, supplied by firms including Danfoss, has also been noted, though underwriters indicated that missing updates alone rarely form grounds for a full claim denial.

The episode underscores a growing gap as retailers and other businesses become more dependent on connected operational technology. David Molony of Aon said that companies handling perishable goods in retail or pharmaceuticals should consider specific additional cover beyond standard cyber policies. Brokers expect the event to prompt closer scrutiny of terms and conditions and may contribute to firmer pricing in the cyber market over time as underwriters reassess exposures linked to physical consequences of digital attacks.

The identity of the perpetrators remains unknown and French authorities continue their inquiries. For the supermarket groups involved, the immediate task is clearing shelves, restocking and absorbing losses that appear destined to stay on their own balance sheets. The case is already being watched closely across the insurance sector for what it reveals about the limits of existing cyber protection when digital intrusion produces tangible physical damage.