French Supermarket Refrigeration Hack Hit About 700 Stores: Why Cyber Policies May Not Pay for Spoiled Food, and What Lockton Says to Check

A cyberattack on supermarket refrigeration has given insurers and risk managers a concrete example of a loss that sits awkwardly between policies. Insurance Journal reported on October 21, 2026 that attacks on internet-connected refrigeration systems disrupted about 700 stores belonging to Intermarché, Coopérative U and Carrefour in France. The Groupement Mousquetaires, which owns Intermarché, said 300 of its stores were attacked, and Carrefour said 80 supermarkets were affected. No group has publicly claimed responsibility.

The mechanism is described in the report. The attackers targeted centralised fridge controllers that are connected to the internet so that contractors can monitor temperatures remotely. They gained access to some systems and changed settings, triggering prolonged defrost cycles that heated refrigerators and freezers. At an Intermarché store in Saint-Symphorien-le-Valois in Normandy, the store manager, Jérémy Béziaud, arrived to find freezers at 40°C and a fish cold-room ventilator at 70°C. "I threw out all the fresh food," he said. His store discarded about €3,000 of products and was running again the same day. Insurance Business Australia, in an article drawing on Lockton, reports that two supermarkets in Alsace recorded €270,000 in merchandise losses, without saying which stores.

The equipment manufacturer is named. Danfoss, a Danish company whose products were among those affected, said most of the compromised devices were obsolete models and that they "no longer received software or security updates." Mousquetaires said its refrigeration supplier is responsible for cleaning up its systems. Experts quoted by Insurance Journal said retail equipment is often 10 to 15 years old and was installed when cyber threats were less prominent, and that remote maintenance and software updates can expose equipment that was traditionally separate from corporate IT networks. No total loss figure has been published. Intermarché's chief executive warned that nationwide losses could reach tens of millions of euros in a single day. For comparison, Insurance Journal cites the 2025 attacks on the UK retailers Co-op, with a sales hit of more than £200 million, and Marks & Spencer, with an estimated £300 million fall in operating profit and online services disrupted for four months.

Lockton's analysis addresses the insurance question. Mark Luckin, national manager for cyber and technology, and Andrew Curl, head of corporate in Queensland, both at Lockton Australia, argue that cyberattacks can cause financial losses well beyond data breaches and ransomware. Businesses with large physical assets, perishable inventory or complex supply chains should check how their policies would respond, they say, "particularly when financial losses continue after affected systems have been restored." Their points about cover are these. Traditional cyber policies typically cover incident response, system restoration and some business interruption, but may exclude physical damage. Property policies generally respond to insured physical damage but can contain exclusions or restrictions for cyber events. Deterioration of stock insurance is available in Australia, but whether it responds to a cyber-induced refrigeration failure depends on the wording. Specialist cyber-physical damage cover can fill the gaps, and the article points to Aon's analysis of such products. Some cyber policies also include contingent business interruption for third-party disruptions, but protection depends on circumstances and terms.

The other losses that follow an incident are listed as emergency response costs, additional logistics costs, lost revenue and the cost of restoring normal operations. The article notes that these can accumulate after the initial disruption is contained, which makes the final impact hard to measure quickly. It also says manufacturers, warehouse operators and logistics providers rely on connected systems in the same way, and points to Australia's operational technology cyber security guidance on supply chain and industrial system protection.

What the sources do not say is as important. No insurer has been quoted on how it would treat these French losses, and the claim that French supermarkets' cyber insurance is unlikely to cover food losses is a headline on a related Insurance Journal article whose text was not available for this report. It would be a mistake to conclude that no cover will respond. Coverage turns on each retailer's policies, which are not public, and on whether the cause is treated as cyber or physical.

Other experts quoted make the broader point. Harjinder Singh Lallie of the University of Warwick said retail is targeted "because they're weak and it can have a massive impact on society." Laura Duncan of PwC asked whether businesses could "do things manually with pen and paper," and Luca Berni of Palo Alto Networks' Unit 42 said retailers "depend on vast networks of interconnected technologies." Experts also warned that AI could help attackers find weaknesses and write convincing phishing messages.

For businesses, the practical steps follow from the coverage: list equipment that is connected to the internet, find out whether it still receives security updates, ask the broker in writing which policy would respond to a cyber-caused spoilage loss, and plan for operating manually during an outage.