The recent cyber-attack affecting hundreds of supermarkets across France provides a stark illustration of how a digital intrusion can quickly translate into physical damage, stock losses and business disruption.
Around 700 stores were reportedly affected after attackers gained access to internet-connected refrigeration control systems and manipulated their settings. Prolonged defrost cycles caused refrigerators and freezers to heat up, leaving retailers facing spoiled stock, disruption to their operations and the practical challenge of safely cleaning and restarting refrigeration systems.
The incident highlights an increasingly important issue for retailers, insurers and loss adjusters: what happens when a cyber event produces a very tangible property loss?
Connected technology creates physical exposure
Retail businesses have become increasingly dependent on connected technology. Refrigeration, heating and ventilation systems can be remotely monitored and controlled, helping businesses manage temperatures, identify faults and operate more efficiently across multiple locations.
But greater connectivity can also create additional vulnerabilities.
In the French supermarket incident, the point of attack was reportedly the technology controlling refrigeration equipment. The consequence was not confined to IT systems or data. It was felt directly in retail stores through storage temperature changes and spoiled food, supply shortages in dependent businesses such as restaurants and corresponding interruption to normal trading activity.
For insurers and their customers, that distinction matters.
Where does the loss sit?
Several claims have already been notified to property insurers in France, with losses in progress.
French retail property policies commonly include refrigeration spoilage cover. However, they also typically contain cyber exclusions, and the precise wording of those exclusions can differ between insurers and individual policies.
This means that determining the cause of loss will be particularly important.
If an investigation establishes that losses resulted from sabotage, malicious software or another event specifically addressed by a policy's cyber exclusion, that exclusion could potentially affect how a policy responds. This can at worst result in a gap in coverage between traditional cyber and property policies.
The wording of the individual policy, the circumstances of the incident and the causal chain leading to the physical loss will all need careful consideration.
Why wording matters
This is where an apparently straightforward stock deterioration claim can become significantly more complex.
There may be cover intended to protect a retailer against refrigerated stock losses. At the same time, the policy may exclude particular losses resulting from malicious interference with computer systems or connected technology.
Not every insurer uses identical terminology, and that makes close examination of individual policies particularly important.
Rather than asking simply whether an incident was a cyberattack, claims professionals will need to understand what happened, how it happened and precisely how the event resulted in the loss being claimed.
A wider lesson for retailers and insurers
The French attacks demonstrate the increasingly blurred boundary between cyber and traditional property risks.
Connected technology now sits behind many of the systems businesses rely on every day. In retail, that includes refrigeration and building systems, but the same principle extends to a much wider range of machinery and operational infrastructure.
As those connections increase, a cyberattack no longer necessarily produces only a digital loss. It can interrupt physical operations, damage or disable equipment, spoil stock and ultimately affect a business's ability to trade.
For claims teams, insurers and risk managers, incidents such as this underline the importance of understanding those interdependencies before a loss occurs, ensuring adequate cover is in place, as well as establishing causation quickly and carefully afterwards.
The question following a cyber incident is increasingly not simply, "Has the IT system been compromised?" It is also,
"What has happened in the physical world as a consequence, why did it happen and which policy is intended to respond?"
