A freezer is supposed to be the most boring appliance in a store. Last weekend, hackers made it a weapon. French supermarkets are facing losses of millions of euros after a cyberattack on internet-connected fridges and freezers forced them to throw away food, Reuters reported. Insurers say the crisis is not typically covered by cyber policies, though it could still push premiums higher in the future.

The Key Points at a Glance

Cyber policies may cover costs such as internal investigations, but state involvement could complicate claims because policies typically exclude acts of war, a cyber underwriter said. Danish software supplier Danfoss AS said many of the affected appliances had reached the end of their service life and no longer receive software or security updates.

350 Stores, 50 Degrees Celsius

Hackers, whose identity remains unknown, took control of cooling units at around 350 French supermarkets Sunday night. They raised the temperature of internet-connected fridges and freezers to 50 degrees Celsius (122 degrees Fahrenheit).

A Bill in the Tens of Millions

Thierry Cotillard, president of Intermarché owner Les Mousquetaires, estimated Monday that total costs could reach tens of millions of euros nationwide. He said supermarkets will begin a legal battle over who is responsible for the losses.

Why Insurance May Not Help

Cyber insurance typically does not cover physical losses from attacks, and supermarkets’ claims could be affected if they lacked the latest software updates, four insurance brokers told Reuters.

The War Exclusion Problem

If a state actor turns out to be behind the hack, claims could become more complicated, because cyber policies typically do not cover acts of war, according to a cyber underwriter who requested anonymity because they were not authorized to speak publicly.

A Growing Attack Surface

As companies embrace the Internet of Things, the growing connectivity of once largely mechanical equipment has exposed them to new security threats, compounded by technological advances including AI. Between 2020 and 2025, cyberattacks in France, Germany, Italy and Spain cost more than €300 billion in economic losses, insurance broker Howden estimates.

Advice From the Brokers

David Molony, head of cyber and financial sponsors at Aon, said he recommends specific cover for perishable goods stored in tightly controlled physical conditions for companies in some sectors, including retail and pharmaceuticals. “Given the increasing digitisation of operational technology and connected systems, this is an area that businesses should review carefully,” he said.

What Policies Typically Cover

Supermarkets’ cyber policies may cover some costs, such as internal investigations or hiring PR advisers, but typically exclude physical losses. Intermarché told AFP on Monday that its insurance did not cover this type of incident. Les Mousquetaires did not disclose its insurance arrangements when asked by Reuters. Carrefour, Monoprix, Coopérative U and E.Leclerc did not respond to requests for comment.

Whose Software Was It?

The hack affected fridges using software supplied by Danfoss, as well as Copeland and Dixell, France’s cybersecurity agency said. Danfoss said many of the appliances were using out-of-date software or had “reached end of life and no longer receive software or security updates.”

Whether failing to update could affect coverage depends on the contract, insurers said. Emma Pleut, head of cyber for France at WTW, said a company buying a cyber policy typically declares its update policy, for example committing to critical updates within a set period. Paul Gooch of Tokio Marine Kiln said outdated software is not usually in itself a reason to reject a claim.

Higher Premiums, New Products

Retailers are increasingly seeking cyber insurance that covers physical damage, Molony said. Such policies are already used in the energy, marine cargo and defense sectors. Aon has advised large retailers and other clients to buy cover extending to “perishable stock,” and has recently arranged “high-value towers,” policies with large maximum payouts, in the London market with such cover included.

Premiums May Rise

Recent cyberattacks on retailers in Britain and France could also lead to higher premiums, underwriters said. Asked whether European retailers could face higher prices, Sydonie Williams, head of international cyber risks at Beazley, said: “I absolutely think that could happen.”

Gooch said he expects greater focus on products that specifically address physical losses from attacks. “The recent cyberattack impacting refrigeration systems across France should act as a wake-up call to those who underestimate the potential physical consequences of cyber incidents,” he said.