Hackers Push Fridges to 50°C at About 350 French Supermarkets, and Insurers Say Standard Cyber Cover Is Unlikely to Pay for Spoiled Food

A cyberattack on French supermarkets in October 2026 has become a test of what cyber insurance does and does not cover. According to Insurance Journal, which reported on October 15, hackers whose identity is not known took control of the cooling units at around 350 supermarkets on a Sunday night and pushed internet-connected fridges and freezers to 50°C, or 122°F. The reporting draws on statements from France's cybersecurity agency, the retailers and brokers and underwriters. This article summarises that report. The publication does not give the exact date of the attack beyond saying it happened on a Sunday night in October, and we could not find a second independent account of the incident, so the details below should be read as reported by Insurance Journal.

The technical side is simple to describe and hard to defend against. Modern refrigeration equipment often has network connections so that operators can monitor and adjust temperatures remotely. If those connections are not protected, or if the control software has known weaknesses, an attacker can change settings. According to the report, France's cybersecurity agency said that the affected units used software from three suppliers: Danfoss, Copeland and Dixell. Danfoss said that many of the appliances ran outdated software or had reached the end of their life and no longer received software or security updates. This matters for insurance, because it raises the question of whether the owners of the equipment kept it up to date.

The commercial impact is potentially large. Thierry Cotillard, president of Les Mousquetaires, the group that owns the Intermarché chain, estimated that total costs could reach tens of millions of euros. Supermarkets expect a legal dispute over who is responsible, which would involve equipment makers, installers and store operators. Intermarché told the news agency AFP that its insurance does not cover this type of incident. Les Mousquetaires did not disclose its insurance arrangements, and the other chains approached, including Carrefour, Monoprix, Coopérative U and E.Leclerc, did not respond to requests for comment.

Why might the insurance not pay? The report quotes brokers and underwriters who explain that cyber policies typically exclude physical losses. A cyber policy is designed to cover the costs of a digital event, such as investigating a breach, restoring data, notifying customers and handling public relations, and sometimes lost income during an outage. Food that spoils because a fridge overheated is a physical loss of stock, which is normally the territory of property insurance, and property policies commonly exclude damage caused by cyberattacks unless the wording says otherwise. This creates a potential gap in which neither policy responds. The market refers to this as a silent or grey area, and the French case shows how it can arise.

There are further complications. Four brokers told Insurance Journal that claims could be affected if the supermarkets had not installed the latest software updates, although this depends on the terms of each policy. Emma Pleut of the broker WTW said that policyholders usually declare their update practices when they buy cover, for example by committing to apply critical updates within a set time. Paul Gooch of Tokio Marine Kiln said outdated software is not usually the only reason to reject a claim. An anonymous underwriter noted that if a state actor was responsible, claims could be complicated by exclusions for acts of war, which cyber policies typically contain in some form. No attribution of the attack has been reported, so that issue is hypothetical.

The market response may be to create or promote products for physical damage from cyber events. David Molony of Aon recommended specific cover for perishable goods for retail and pharmaceutical firms, and said Aon had arranged high-value policies in London that include such cover. The report notes that similar policies already exist in the energy, marine cargo and defence sectors, where physical consequences of cyber incidents have long been a concern. Sydonie Williams of Beazley said European retailers could face higher premiums after recent cyberattacks, and Gooch expects more attention on products that address physical losses from attacks. The broker Howden estimates that cyberattacks in France, Germany, Italy and Spain caused more than €300 billion in economic losses between 2020 and 2025, a figure we report as stated and have not verified.

The case also connects to a wider debate. As we report separately this week, the head of Marsh has warned that broad exclusions for artificial intelligence could create confusion for policyholders, and the same concern applies to cyber: clarity of wording matters more when losses cross between digital and physical categories.

What should businesses with connected equipment do? First, ask the broker for a written explanation of how the cyber and property policies respond to a cyber-caused physical loss, and whether there is a gap. Second, keep an inventory of connected devices, apply security updates and replace end-of-life equipment, because insurers may ask about this and because it reduces the chance of an attack. Third, consider separate cover for stock spoilage and business interruption that explicitly includes cyber causes. Fourth, keep supplier contracts under review, since liability for defective or unsupported software may rest partly with manufacturers.

For the insurance market, the episode is a reminder that cyber risk is increasingly physical. How the French claims are resolved, and whether the supermarkets win compensation from insurers or suppliers, will influence the pricing and wording of retail cyber cover in Europe.