Cyberattack on French supermarkets in October disrupted refrigeration systems across hundreds of stores, forcing retailers to discard fresh and frozen food and raising questions about insurance coverage for cyber-related losses.
The intrusion started during the night of October 11-12, when perpetrators allegedly activated a remote forced-defrost command. On October 13, Finance Minister Roland Lescure informed parliament that roughly 700 supermarkets were impacted, according to the Associated Press, while assuring that the country’s overall food supply remained safe.
Retailer Response and Financial Impact
Intermarché initially reported that between 150 and 200 stores were affected, while Coopérative U confirmed fewer than 100 outlets. Both retailers stated that affected fresh and frozen products had to be discarded, resulting in food waste and financial losses.
Thierry Cotillard, head of Intermarché, estimated that the nationwide cost could reach tens of millions of euros. Dominique Schelcher, chief executive of Coopérative U, denounced the assault on the vital food-preservation gear and said that crews were collaborating with refrigeration experts to bring stores back to normal as swiftly as possible.
Stores hit by the incident must first re-establish secure temperature settings and evaluate any spoiled inventory. They will also need to restock both fresh and frozen product lines. The episode shows how critical dependable refrigeration is for food safety and the routine functioning of supermarkets.
Insurance Coverage Scrutinized
The financial impact has raised questions about whether retailers can recover the cost of spoiled stock through their insurance policies. According to insurance brokers, standard cyber policies generally omit coverage for tangible damage, and any compensation for spoiled produce hinges on the specific wording of each contract and the details of the event.
Intermarché reported to AFP that its policy did not extend to this scenario. This nuance is important because expenses tied to the cyber-inquiry, equipment repair and inventory replacement could be allocated to separate sections of a policy. The case also prompts discussion about who should bear the duty of safeguarding networked hardware—whether the retailer, the technology vendor, or the service contractor might be liable when refrigeration systems are breached.
Investigation and Equipment Suppliers
The Paris prosecutor’s office launched a probe, delegating it to France’s Office for Combating Cybercrime (OFAC). Officials indicated that investigators will catalogue the affected parties and determine connections between the hack and the reported harms, such as lost food and fire incidents. The first statement did not clarify the origins or magnitude of the blazes.
Initial coverage pointed to Danfoss, the Danish maker of refrigeration controllers, as the source. Subsequent statements from the French cybersecurity authority indicated that equipment from Copeland and its daughter company Dixell had also been infiltrated, though Copeland refrained from verifying the claim, emphasizing its focus on safeguarding client operations. Danfoss added that a large share of the compromised units ran obsolete or unsupported software.
Simply naming the hardware vendors does not prove how the intruders entered the network, nor does it show that the manufacturers’ own central systems were penetrated.
Operational Risks of Connected Equipment
The incident illustrates that tampering with a store’s digital infrastructure can inflict tangible harm and halt retail activity even when payment platforms or consumer data are untouched. Networked refrigeration controllers let merchants and service teams track temperature levels and tweak settings from afar. Should malicious actors seize these capabilities, they could disrupt the mechanisms that preserve perishable goods.
