“Hospitals, hotels, pharmaceutical and vaccine cold chains, and food manufacturers could all face comparable exposures. The common thread is that many operational systems were built to run for decades and were only later connected to the internet to enable remote monitoring and management. In some cases, the cyber controls around these systems may not have kept pace with their increasing connectivity, creating potentially significant exposures.”Monica Tigleanu, Lead Cyber Underwriter at MS Amlin
London: Monica Tigleanu, Lead Cyber Underwriter at MS Amlin, said the recent attack on supermarket freezers across Europe is a reminder that cyber incidents can result in direct physical losses.
On Monday, fridges and freezers in supermarkets from Sweden to Belgium and France were hit by hacking attacks which exposed vulnerabilities in IT systems, leading to stores having to throw away large amounts of food.
While the immediate consequence was spoiled stock, the incident also had the potential to create wider building-safety risks. It highlights the increasingly blurred boundary between cyber and property exposures, and the importance of understanding how different policies and wordings would respond,added Tigleanu..
Although supermarkets were targeted in this case, the implications extend far beyond the freezer aisle. The same combination of remotely managed equipment, long equipment lifespans and contractor access can be found across many industries” she pointed out.
“Hospitals, hotels, pharmaceutical and vaccine cold chains, and food manufacturers could all face comparable exposures. The common thread is that many operational systems were built to run for decades and were only later connected to the internet to enable remote monitoring and management. In some cases, the cyber controls around these systems may not have kept pace with their increasing connectivity, creating potentially significant exposures,” elaborated Tigleanu.
“Operational technology remains something of a blind spot for both businesses and insurers. Cyber underwriters do not always have sufficient visibility of these systems through company-level portfolio analysis, making it harder to assess physical loss potential. That needs to change, she said.
Tips for businesses:
-Check your cover. Work with your broker to check whether you have Cyber Property
-Damage cover and whether perishable stock counts as Insured Property, because standalone cyber policies typically exclude physical damage.
-Take assets off the internet. Use private, secured remote access.
-Add an independent limit. Fit a thermostat or cutout on the equipment that ends heating and alarms on its own measurement, whatever the supervisor says.
-Know what you run. Inventory controllers, patch supported ones, and set a date to replace or isolate anything past support.
-Audit contractor access. Find out who can reach your sites remotely and whether one credential opens everything.
-Plan for manual detection. Make sure staff can spot and respond to temperature excursions if the alarm system can’t be trusted.
“While better visibility will help insurers assess these exposures, businesses also have an important role to play in preventing a cyber intrusion from developing into a physical loss. They should not wait for an incident to test either their operational resilience or their insurance cover. They need to understand which systems are exposed, who can access them and whether independent safeguards would prevent a cyber intrusion from becoming a physical loss,” suggessted Tigleanu.
Meanwhile, European supermarkets targeted in a second wave of cyberattacks that cranked up fridge and freezer temperatures were rushing on Tuesday to upgrade their systems and protect themselves against further hacking attempts.
Stores in eight European countries were forced to throw away vast quantities of food after hackers tampered on Monday with their fridges, in an attack identical to one that swept dozens of supermarkets in France three weeks ago.
In Sweden, supermarket chain Coop said it was switching systems to 5G networks and modern modems, instead of 4G connections – a process that had already started since the French incident.
The seven stores hit by the attack are back up and running but their refrigeration systems have been disconnected from the internet, a spokesperson said.
“We are looking quite thoroughly and deeply into the status of the entire network of stores to see if we risk any vulnerability anywhere in the entire network,” the spokesperson added.
Software provider Danfoss, whose systems were again among those targeted, said it has been in close contact with customers over the past three weeks to help them manage the situation, and recommended that systems should not be directly accessible via the internet.
“Retailers need to act now. They should identify whether their refrigerator controllers are vulnerable, check if they are connected to the internet, ensure they’ve got the latest security updates and are supported by the manufacturer. And if they don’t even know, then remove them from the public internet immediately,” said Frank Groenewegen, cybersecurity expert at Deloitte in The Hague.
Sponsored by SPG Environmental
“With disconnecting, you haven’t fixed the root cause but you’ve at least isolated those systems so that an attacker is not able to do this anymore.”
‘Heightened Alert’
Many European supermarkets are run by independent business owners in a cooperative structure, meaning systems are not the same across stores.
Swedish grocer ICA said all 23 stores hit in Monday’s cyberattack had equipment connected outside the chain’s centrally managed store network.
ICA store owner Christian Olofsson said he felt even more frustrated about the cyberattack given he was in the process of changing the security systems at his stores in Tomelilla and Sjobo in Sweden when they were hacked.
A Swedish police spokesperson said around 10 police reports had been filed since Monday and they expected more.
German supermarket operator Edeka, which had fridges hacked at a store in Reisbach, Germany, told Reuters there are no standardized refrigeration systems across its network of stores run by independent retailers.
Even integrated supermarket groups were not immune: Carrefour, which had 80 franchised stores in France hacked three weeks ago, suffered the same cyberattack again at 15 stores in Belgium on Monday.
EU cybersecurity agency ENISA said the large-scale nature of the cyberattacks targeting retail across several member states “underscores the importance of European cooperation, rapid information-sharing and coordinated responses to cyber incidents.”
In Britain, hackers tried to target small meat-processing firms but the impact was minimal, said Richard Horne, chief executive of the National Cyber Security Centre (NCSC).
The NCSC is working with organizations to spot vulnerabilities and close them before somebody exploits them, Horne said. “We’re obviously on heightened alert.”
The attack on supermarket fridges is just an early sign of what are likely to be increasingly frequent disruptions as old technology fails to keep pace with hackers, Horne said.
Britain’s cybersecurity chief said a cyberattack on supermarket fridges across Europe is just an early sign of what are likely to be increasingly frequent disruptions as old technology fails to keep pace with hackers,
Richard Horne, head of Britain’s National Cyber Security Centre, which is part of the GCHQ spy agency, said the incident was “just the foothills, as it were.”
“There are so many vulnerabilities out there that in some ways you could say are waiting to be exploited,” he said following a speech to coincide with the release of his agency’s annual report. “The most serious risk we face in the short term is just a huge rise in the volume of incidents.”
The NCSC’s annual report says artificial intelligence is expected to enhance the capabilities of hackers in coming years. NCSC officials have said that in the case of the refrigerator attacks advanced AI probably would not have been needed, as the attacks targeted known vulnerabilities in old tech.
But Horne said AI will make it increasingly easy to find such old vulnerabilities, and exploit them on a huge scale.
“We must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable,” Horne said.
‘Tech on the Cheap’
Too many organizations and supply chains in Britain had got away with “doing tech on the cheap” for decades,which had left them vulnerable, Horne said.
“When food isn’t on shelves, when lights aren’t on, businesses have gone under, we may have to explain that we saw the warning signs, understood the risks and still didn’t make the right choices.”
In its annual report, the NCSC said it was highly likely there would be a ransomware cyberattack involving AI-powered malware by 2028 on Britain’s critical infrastructure.
Horne said Russia was making sustained attempts to penetrate UK military networks, while Iran was carrying out malicious cyber operations globally, including against the UK.
“We know that China highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets with their activity representing the most sophisticated and sustained cyber challenge the UK faces,” he said.
Moscow, Beijing and Tehran have all repeatedly denied similar accusations of malevolent cyber actions in the past.