French supermarkets face millions in losses after a cyberattack on Sunday night ruined food in 350 stores. Insurers said these policies rarely cover physical damage from hacks. David Molony from Aon said, "Given the increasing digitisation of operational technology and connected systems, this is an area that businesses should review carefully."
LONDON/PARIS, Oct 15 (Reuters) - French supermarkets are facing millions of euros in losses after a cyberattack forced them to throw away food, in a crisis that is not typically covered by cyber insurance policies but could still lead to higher premiums in future, insurers told Reuters.
Hackers — whose identity remains unknown — took control of cooling units at around 350 French supermarkets on Sunday night, raising the temperature of internet-connected fridges and freezers to 50 degrees Celsius (122 degrees Fahrenheit).
Sign up here.
The attack's total costs could add up to tens of millions of euros nationwide, Thierry Cotillard, president of Intermarché owner Les Mousquetaires, estimated on Monday, saying that supermarkets will begin a legal battle over who is responsible for the losses.
Cyber insurance typically does not cover physical losses from attacks and supermarkets' claims could be affected if they lacked the latest software updates, four insurance brokers told Reuters.
If a state actor turns out to be behind the hack, it could complicate supermarkets' insurance claims because cyber policies typically do not cover acts of war, according to a cyber underwriter, who requested anonymity as they were not authorised to speak publicly.
As companies have embraced the so-called Internet of Things, the growing connectivity of once largely mechanical equipment has exposed them to new security threats compounded by technological advancements including AI.
Between 2020 and 2025, cyberattacks in France, Germany, Italy and Spain cost over €300 billion in economic losses, insurance broker Howden estimates.
David Molony, head of cyber and financial sponsors at insurance broker Aon, said he recommended for companies in some sectors, including retail and pharmaceuticals, specific cover for perishable goods that need to be stored in tightly controlled physical conditions.
"Given the increasing digitisation of operational technology and connected systems, this is an area that businesses should review carefully," he said.
CYBERATTACK, PHYSICAL LOSSES
Supermarkets' cyber insurance policies may cover some costs, such as investigating internally or hiring PR advisors, but typically exclude physical losses.
Intermarché told AFP on Monday that its insurance did not cover this type of incident. Asked by Reuters, Les Mousquetaires did not disclose its insurance arrangements. Carrefour, Monoprix, Coopérative U and E.Leclerc did not respond to requests for comment.
The hack affected fridges using software supplied by Danish firm Danfoss, as well as Copeland and Dixell, France's cybersecurity agency said. Danfoss said many of the appliances were using out-of-date software or had "reached end of life and no longer receive software or security updates."
Whether failing to update the software could affect the insurance depends on the details of the contract, insurers said.
Typically a company taking out a cyber insurance policy would declare its policy on software updates, for example committing to critical updates within a particular time period, said Emma Pleut, head of cyber for France at WTW.
Paul Gooch, deputy departmental head at Tokio Marine Kiln, said outdated software is not usually in itself a reason to reject a claim.
HIGHER PREMIUMS, NEW PRODUCTS
Retailers are increasingly seeking cyber insurance which covers physical damage, Aon's Molony said. Such policies are already used in the energy, marine cargo, and defence sectors.
Aon has advised large retailers and other clients to get insurance that extends to "perishable stock", and has recently arranged "high-value towers" — policies with large maximum payouts — in the London market with such cover included, Molony said.
Recent cyberattacks on retailers in Britain and France could also lead to higher premiums, underwriters said.
Asked whether European retailers could face higher insurance prices following cyberattacks, Sydonie Williams, head of international cyber risks at Beazley, said: "I absolutely think that could happen."
TMK's Gooch said that he expected greater focus on insurance products that specifically address physical losses from attacks.
"The recent cyberattack impacting refrigeration systems across France should act as a wake-up call to those who underestimate the potential physical consequences of cyber incidents," he said.