Insurance Daily News

UK retailers hit by fridge hack, insurance gaps exposed

A cyberattack that switched supermarket refrigeration units into defrost mode has now affected UK retailers, highlighting a significant insurance coverage gap. Richard Horne, chief executive of the National Cyber Security Centre, told BBC Radio 4’s Today programme that his team worked through the night to alert firms with vulnerable technology. The British Association of Independent Meat Suppliers confirmed that some members were impacted, though none reported inventory loss.

The attack follows a pattern that began in France on the night of 11-12 October, when hackers disrupted refrigeration at around 350 supermarkets, causing losses estimated in the tens of millions of euros, according to Les Mousquetaires president Thierry Cotillard. A second wave hit supermarkets in seven countries, including Ireland, and a Belgian Delhaize branch reported stock losses of €100,000 before accounting for lost trading time. UK businesses have now joined that list.

Insurance policies have struggled to address the damage. Standard property policies with spoilage cover often carry cyber exclusions, and Intermarché told AFP its insurance did not cover the incident. Four insurance brokers confirmed the same across the sector to Reuters. Typical cyber policies focus on data breach, business interruption and PR costs, not on stock destroyed by a remotely triggered temperature change. A specialist endorsement or standalone perishable-goods cover is required, but most UK retailers lack such protection, according to David Molony, head of cyber solutions for EMEA at Aon.

The method used by the hackers is simple: fridges were connected directly to the internet with default passwords, as Horne explained. Martin Riley, CTO of cyber-security firm Bridewell, said refrigeration equipment is especially exposed because it holds perishable goods and relies on tightly controlled temperatures. A temperature change overnight can destroy the value of everything inside within hours, with no backup to restore.

Legal experts note that operational technology (OT) is a cybersecurity blind-spot. Retailers have historically invested more in protecting payment systems and customer data than in refrigeration and logistics equipment. Legacy OT systems often run without basic security controls, leaving them vulnerable. The Cyber Security and Resilience Bill, moving through Parliament, will extend to critical infrastructure and its suppliers, potentially bringing OT-dependent sectors like retail under stricter regulatory scrutiny.

Why it matters

UK retailers may face uninsured spoilage losses unless they add specialised perishable-goods cyber cover.

FAQ

Which organisations confirmed they were affected by the fridge hack in the UK?
The National Cyber Security Centre alerted firms, and the British Association of Independent Meat Suppliers said some members were affected.

Why did standard cyber policies not cover the losses?
Standard cyber policies typically address data breach, business interruption and PR costs, not physical stock destroyed by temperature changes, and many include cyber exclusions for spoilage cover.

What security flaw allowed the attackers to control the fridges?
The fridges were connected directly to the internet with default passwords.

What legislative change could affect coverage for such attacks?
The Cyber Security and Resilience Bill, progressing through Parliament, will extend to critical infrastructure and its suppliers, potentially bringing OT-dependent sectors like retail into its scope.

Source: Insurance Business UK. See the original source for full details.