French supermarket fridge hack exposes cold

Hackers took control of refrigeration systems at hundreds of French supermarkets overnight on Sunday and cooked the stock inside. For Australian brokers with food retail and cold storage clients, the attack raises a question few policies have been tested on: who pays when the target is the stock rather than the data?

On the night of 11-12 October, attackers got into refrigeration controls supplied by Danish manufacturer Danfoss and forced cabinets into a continuous defrost cycle, pushing temperatures towards 50C. Paris prosecutors have opened an investigation and said the reported damage includes lost food and fires.

Intermarché owner Les Mousquetaires said 150 of its stores were hit for roughly six hours, and all fresh and frozen food in those stores was thrown out. Coopérative U said close to 100 of its outlets were affected. French broadcaster BFM TV reported that E.Leclerc, the country’s biggest grocer, was also hit. French press reports put losses across the sector in the millions of euros.

Prime Minister Sébastien Lecornu has directed France’s national cybersecurity agency, ANSSI , to investigate. His office said other European countries could also be exposed.

Read : Falling cyber alerts may not mean lower risk at renewal

Flaws flagged in August

A source close to Lecornu said ANSSI had traced the attack to a vulnerability in Danfoss software. Danfoss said the incidents involved “a limited number” of systems running outdated firmware, and that it had long urged customers to update and replace older equipment.

In August, Claroty’s Team82 research unit published details of flaws in two supervisory controllers widely used in commercial refrigeration, the Danfoss AK-SM 800A and the Copeland XWEB Pro. The researchers found an attacker could change cooling settings while the system kept displaying normal temperatures, meaning stock could spoil without triggering an alarm. Both manufacturers have released fixes. Investigators have not said whether these specific flaws were used in France.

Danfoss says it has more than 50,000 food retail installations worldwide. It has not published a figure for Australia, and there is no indication any Australian site has been affected.

Six hours versus the waiting period

Intermarché has already warned that some of its policies may not cover this kind of in-store incident.

The French attack lasted six hours. Waiting periods on Australian cyber business interruption cover commonly sit between eight and 12 hours . An attack of that length could do most of its damage before business interruption cover begins.

Most of the loss in France was physical, in spoiled stock and fire-damaged equipment. Standalone cyber policies often do not cover physical damage, and many industrial special risks (ISR) and commercial property policies now exclude cyber events. A loss like this can fall between the two, which is the silent cyber problem insurers have been trying to close for years.

Claroty’s latest survey puts the average cost of an operational technology cyber incident for Australian and New Zealand organisations at US$2.04 million, almost double the global average. APRA data shows cyber gross written premium has never exceeded $73 million in a quarter, and made up less than 0.2% of total industry premium as of March 2026.

Emergence Insurance chief underwriter Jeffrey Gonlin has called the low uptake “a real mystery”. He told Insurance Business that because cyber risk seems less concrete than natural perils, buyers show “no sense of urgency”.

Read : Data breach victims are staying silent, leaving insurers with less visibility

Food is critical infrastructure in Australia

Food and grocery is one of the sectors covered by Australia’s Security of Critical Infrastructure Act. The Australian Signals Directorate has warned that operational technology systems are prime targets for attackers, and that many were never designed to withstand a cyber incident. Since May 2025, businesses with turnover of $3 million or more have had to report ransomware payments to the ASD within 72 hours.

Les Mousquetaires has reportedly said the affected systems were managed by Danfoss. If that holds, insurers that pay claims may look to recover their costs from the supplier.

Brokers with supermarket, cold storage or food logistics clients may want to check whether refrigeration controllers can be reached from the internet and whether they run patched firmware. It is also worth checking whether the property or ISR wording excludes spoilage caused by a cyber event, and whether an affirmative cyber physical damage extension is available. The cyber business interruption waiting period should be compared with how long the client’s stock would last without refrigeration.

Read : What attacks on the UK’s retail sector mean for the global cyber insurance market