When the Refrigeration Fails: Lessons from the Cyber Attacks on European Supermarkets

Cyber risk is commonly associated with stolen data, ransomware demands and system outages. As high-profile attacks on UK retailers have shown, those incidents can cause serious disruption, but their effects often reach the public indirectly and over time, through delayed orders, suspended services or compromised personal data. The recent attacks on supermarket refrigeration systems are different – they struck directly at the physical systems on which businesses and their customers depend.

Overnight on 11-12 October 2026, hackers interfered with refrigeration systems across hundreds of French supermarkets, causing significant quantities of food to spoil, leaving shelves empty and disrupting the supply of everyday essentials. Less than three weeks later, a second wave of attacks raised temperatures in refrigeration units at supermarkets in Belgium, Sweden and Luxembourg. The UK’s National Cyber Security Centre (NCSC) has confirmed that some UK freezers were also affected.

Cyber risk: beyond data breaches and ransomware

The attacks are a stark example of cyber risk becoming physical. In France, up to 700 stores are reported to have been affected, and Intermarché reported that some of its refrigeration units reached 50°C for six hours, resulting in fresh and frozen products being discarded. Small fires were also reported in some locations, and the Paris prosecutor’s office has opened an investigation into the attack.

For affected supermarkets, the consequences were immediate and highly visible: loss of stock, supply-chain disruption, an inability to service customers, damage to reputation and, in some locations, a potential safety issue. The financial losses have been estimated in the millions of euros.

From cybersecurity to business resilience 

Insurance forms an important part of a wider cyber resilience strategy and, subject to its terms, may respond to:

• Business interruption: loss of income arising from operational disruption, store closures or the unavailability of products.

• Physical damage and stock losses: spoiled inventory and damaged equipment, where the policy extends to physical damage resulting from a cyber event. Early commentary has questioned whether cyber policies held by affected businesses will respond to food losses, underlining the importance of checking the scope of cover before an incident occurs.

• Incident response costs: the costs of forensic investigation, legal advice, public relations support and system restoration.

• Third-party claims and regulatory exposure: claims brought by customers or commercial partners, and the costs of responding to regulatory investigations and enforcement action.

Key takeaways 

The attacks demonstrate that the consequences of a cyber incident can extend far beyond the loss of data.

Businesses should:

• identify business-critical connected equipment, including systems outside the core IT environment and those managed by suppliers;
• understand the consequences and test the response, including what happens if that equipment becomes unavailable, unsafe or damaged; 
• review insurance cover with brokers, paying particular attention to physical damage, stock loss and business interruption arising from a cyber event; and
• review relevant supplier contracts, including responsibility for security, maintenance and incident response, and the allocation of cyber-related losses.

If you have any questions in relation to the issues raised in this article, please contact Matthew Kaltsas-Walker and Amy Khodabandehloo, or your usual Burges Salmon contact. 

This article was written by Isabel Cairns and Amy Khodabandehloo.