Overnight on 11 to 12 October, refrigeration units across hundreds of French supermarkets were remotely switched into a defrost cycle. Some of the units reportedly reached temperatures around 50°C. Fresh and frozen stock was lost, some equipment caught fire, and the Paris prosecutor’s office opened a cybercrime investigation.
For most people, a cyber-attack means stolen data or a locked computer. This incident reminds us that cyber-attacks can cause physical damage too, and that the cyber insurance question that follows can be harder than you’d expect.
What happened in France
The attackers targeted refrigeration management systems supplied by Danish manufacturer Danfoss. These systems let store operators monitor and control cooling equipment remotely over the internet, typically know as Internet of Things (IoT) technology. The attackers did not cut the power. They reportedly used a routine maintenance setting to lock the fridges into continuous defrost.
Whilst Danfoss said the affected systems were mostly older models running outdated firmware, the US authorities had reportedly warned about an authentication flaw in Danfoss equipment back in 2025.
The scale of the incident is still being established, but according to the French Government, estimates range from around 150 stores at one chain, to a national figure of about 700 supermarkets, and a cost of tens of millions, underlining the potentially significant real-world financial impact of a cyber event.
Is it a property damage loss covered under a cyber policy?
Most cyber policies were built around data and provide cover for breach response, notification and regulatory defence. They were not designed for,in this case, rotting stock and fire-damaged equipment.
A typical Property policy would sit on the other side of this incident where it’s usually designed to respond to physical loss or damage caused by insured perils.
Over recent years, Property policies have added exclusions for cyber-triggered damage.
A loss like this can fall between the two: clearly caused by a cyber event, but not clearly covered by either type of policy. Insurers call this silent cyber, and it has been a growing concern across the market.
NOTE: In this scenario the insurance gap and any potential financial claim only exists if there is both a cyber and property insurance policy in place. If there isn’t a cyber policy in place, , and cyber related losses are excluded from a Property Insurance policy, then there may be limited or no cover for this type of event.
Some retailers have already been caught out. Intermarché told French journalists that its insurance did not cover this type of incident. For a business owner, that is the warning: discovering a coverage gap after the loss is the worst time to find it.
Is this scenario isolated to French Supermarkets or retail business?
No. Whilst this incident has happened to French supermarkets, the scenario is equally applicable to other businesses and industries that use remote management of equipment over the internet, to control their business operations, e.g;
- HVAC engineers
- Farmers
- Cleaning and Facility Management
- Manufacturing
- Wholesale
The supplier question
With regard to this incident, who ultimately pays depends on who is responsible for the vulnerability, what insurances are at play and the contracts between the affected customers and Danfoss.
If the failure traces to Danfoss software or equipment then they could end up paying for the damage due to contractual indemnities with their customers OR, the insurers could look to pass on the cost of the claims they’ve paid to their affected policy holders.
This process and is called subrogation and recovery by the insurers takes time, and is rarely certain.
What can you do to reduce your risk.
Operators should consider the following:
- Is there a documented IoT and connected API inventory?
- Are default credentials (passwords) prohibited?
- Is MFA enabled to access cloud resources linked to IOT’s and API’s?
- Are third-party vendor accounts strictly controlled?
- Is remote access to IOT’s and connected API’s protected by a VPN and MFA?
- Are privileged credentials giving access to IOT networks, cloud resources and associated API’s unique, vaulted and rotated?
- Are IoT devices segmented from the corporate network (helps to prevent a cyber criminal travelling laterally across your network)
- Is certificate-based authentication used (instead of legacy authentication protocols) used for IoT’s and API’s and is it up to date?
- Is all traffic encrypted?
- Are there web application firewalls in place?
- Do the API’s have rate limiters (reducing the risk of DDOS and BOT attacks)
- Are the API’s keys properly protected?
- Are updates and patches implemented in accordance with recommendations?
- Is there an API gateway in place (helps to manage and monitor access and activity)
Have you read your Cyber Insurance and Property Insurance policies line by line and does it cover you for damage to stock or property arising from a cyber event arising either on your own network, or supplier side?
The key takeaway
Cyber risk is no longer confined to screens and data stolen. When operational technology is connected to the internet, a cyber event can spoil food, damage equipment and interrupt trade in the physical world.
Potential gaps in cover often stays hidden until a claim is made. If your business relies on connected equipment, we recommend reviewing your policy wording, while there is still time to find an insurance solution for your business.
This article is general information, not legal or financial advice. If you’re in any doubt, get in contact with Jensten Insurance Brokers and we’ll review your existing policy to see if any gaps in cover exist are and where we can help provide a tailored insurance solution to meet your businesses needs..
Article sources: