The attackers accessed refrigeration controllers reachable from the internet. They switched units to defrost or heating mode and, in some cases, moved the setting from -27°C to over 50°C. By the time staff arrived, the stock was ruined.There was no ransom demand and no data was taken. It was pure sabotage. So where does the loss sit?
Rupert Hills, Partner in Oneglobal’s Financial Lines team in London
Over the past month, supermarkets across Europe have opened in the morning to find their freezers running hot.
France was hit first, in October.
On 2 November, a second wave reached Belgium, Luxembourg, Ireland, Sweden, Finland, Estonia and the Netherlands, and Germany, Italy and Greece followed.
The attackers accessed refrigeration controllers reachable from the internet. They switched units to defrost or heating mode and, in some cases, moved the setting from -27°C to over 50°C. By the time staff arrived, the stock was ruined. In France, some stores had fires.
There was no ransom demand and no data was taken. It was pure sabotage.
So where does the loss sit? It’s the question I’ve been asked most this week. The honest answer is that it probably isn’t where most retailers think.
Is it cyber liability?
A standalone cyber policy should respond well to the incident itself: incident response, forensics, restoring systems, and possibly business interruption. But most cyber wordings exclude physical loss of or damage to tangible property. Spoiled chilled and frozen stock is tangible property, so the largest claim amount may fall outside the policy.
Is it cyber physical damage?
This is where the market has been pointing for “cyber-physical” risk, and the French fires will test it. But in most stores, the refrigeration plant wasn’t damaged. It did exactly what it was told to do. Property policies also increasingly carry cyber exclusions (LMA5400 and similar). These remove loss caused by malicious use of a computer system unless cover has been written back.
Where it actually sits: deterioration of stock
Most retail and food property programmes include a deterioration of stock or spoilage extension. That’s the natural home for this loss, because the stock spoiled due to a temperature change in refrigerated plant.
The trigger is where it can go wrong. Many extensions respond to “breakdown”, “mechanical or electrical failure” or “failure of the public supply”. A remote attacker changing a setting isn’t a breakdown, because the machine worked perfectly. Add a cyber exclusion over the whole property policy, and an extension that looks clean can fail on two counts.
What should clients do now?
-Read the deterioration of stock wording and the property cyber clause together, not separately.
-Ask insurers to confirm in writing that a malicious or unauthorised change to temperature settings, including one made through a computer system, is a covered trigger.
-Check the limit. Spoilage extensions are often sub-limited for one compressor failing, not 40 stores in a single night.
-Check whether the cyber policy has a tangible property or “bricking” buy-back, and how the two policies fit together, so you don’t end up stuck in a dispute between them.
-Take the controllers off the open internet. Insurers will ask.
This is where cyber is heading: a cheap attack on operational technology, no data involved, and the loss landing on physical goods. The question isn’t “do we have cyber?” It’s “which policy pays, and have we made sure one of them does?”