“Hospitals, hotels, pharmaceutical and vaccine cold chains, and food manufacturers could all face comparable exposures. The common thread is that many operational systems were built to run for decades and were only later connected to the internet to enable remote monitoring and management. In some cases, the cyber controls around these systems may not have kept pace with their increasing connectivity, creating potentially significant exposures.”Monica Tigleanu, Lead Cyber Underwriter at MS Amlin
London: Monica Tigleanu, Lead Cyber Underwriter at MS Amlin, said the recent attack on supermarket freezers across Europe is a reminder that cyber incidents can result in direct physical losses.
On Monday, fridges and freezers in supermarkets from Sweden to Belgium and France were hit by hacking attacks which exposed vulnerabilities in IT systems, leading to stores having to throw away large amounts of food.
While the immediate consequence was spoiled stock, the incident also had the potential to create wider building-safety risks. It highlights the increasingly blurred boundary between cyber and property exposures, and the importance of understanding how different policies and wordings would respond,added Tigleanu..
Although supermarkets were targeted in this case, the implications extend far beyond the freezer aisle. The same combination of remotely managed equipment, long equipment lifespans and contractor access can be found across many industries” she pointed out.
“Hospitals, hotels, pharmaceutical and vaccine cold chains, and food manufacturers could all face comparable exposures. The common thread is that many operational systems were built to run for decades and were only later connected to the internet to enable remote monitoring and management. In some cases, the cyber controls around these systems may not have kept pace with their increasing connectivity, creating potentially significant exposures,” elaborated Tigleanu.
“Operational technology remains something of a blind spot for both businesses and insurers. Cyber underwriters do not always have sufficient visibility of these systems through company-level portfolio analysis, making it harder to assess physical loss potential. That needs to change, she said.
Tips for businesses:
-Check your cover. Work with your broker to check whether you have Cyber Property
-Damage cover and whether perishable stock counts as Insured Property, because standalone cyber policies typically exclude physical damage.
-Take assets off the internet. Use private, secured remote access.
-Add an independent limit. Fit a thermostat or cutout on the equipment that ends heating and alarms on its own measurement, whatever the supervisor says.
-Know what you run. Inventory controllers, patch supported ones, and set a date to replace or isolate anything past support.
-Audit contractor access. Find out who can reach your sites remotely and whether one credential opens everything.
-Plan for manual detection. Make sure staff can spot and respond to temperature excursions if the alarm system can’t be trusted.
“While better visibility will help insurers assess these exposures, businesses also have an important role to play in preventing a cyber intrusion from developing into a physical loss. They should not wait for an incident to test either their operational resilience or their insurance cover. They need to understand which systems are exposed, who can access them and whether independent safeguards would prevent a cyber intrusion from becoming a physical loss,” suggessted Tigleanu.
Meanwhile, Britain’s cybersecurity chief said a cyberattack on supermarket fridges across Europe is just an early sign of what are likely to be increasingly frequent disruptions as old technology fails to keep pace with hackers,
Richard Horne, head of Britain’s National Cyber Security Centre, which is part of the GCHQ spy agency, said the incident was “just the foothills, as it were.”
“There are so many vulnerabilities out there that in some ways you could say are waiting to be exploited,” he said following a speech to coincide with the release of his agency’s annual report. “The most serious risk we face in the short term is just a huge rise in the volume of incidents.”
The NCSC’s annual report says artificial intelligence is expected to enhance the capabilities of hackers in coming years. NCSC officials have said that in the case of the refrigerator attacks advanced AI probably would not have been needed, as the attacks targeted known vulnerabilities in old tech.
But Horne said AI will make it increasingly easy to find such old vulnerabilities, and exploit them on a huge scale.
“We must be clear that is not because AI has invented new ways to attack us, but because vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable,” Horne said.
‘Tech on the Cheap’
Too many organizations and supply chains in Britain had got away with “doing tech on the cheap” for decades,which had left them vulnerable, Horne said.
“When food isn’t on shelves, when lights aren’t on, businesses have gone under, we may have to explain that we saw the warning signs, understood the risks and still didn’t make the right choices.”
In its annual report, the NCSC said it was highly likely there would be a ransomware cyberattack involving AI-powered malware by 2028 on Britain’s critical infrastructure.
Horne said Russia was making sustained attempts to penetrate UK military networks, while Iran was carrying out malicious cyber operations globally, including against the UK.
“We know that China highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets with their activity representing the most sophisticated and sustained cyber challenge the UK faces,” he said.
Moscow, Beijing and Tehran have all repeatedly denied similar accusations of malevolent cyber actions in the past.