Insurance Daily News

European Supermarkets Hit by Second Refrigeration Cyberattack

A coordinated cyberattack on refrigeration units has disrupted supermarkets in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland, a month after a similar incident crippled hundreds of stores in France. Around 40 Delhaize outlets in Belgium and Luxembourg were impacted, along with a handful of stores from Carrefour, Colruyt Group, Ikea, Musgrave Group, ICA, Coop and other local retailers.

The Belgian manufacturer Sabcobel, which supplies and operates Delhaize’s refrigeration, reported that the attackers forced evaporators into defrost mode, causing freezer temperatures to climb as high as 50 °C. Sabcobel’s chief executive Stephan Moelans said the breach required physical modifications to the units rather than a simple software patch. The same method was identified in the October French attack.

Losses are already materialising. One Delhaize branch in Belgium estimated stock damage at €100,000, not counting revenue lost while the store remained closed. Lockton has previously recorded €270,000 of stock loss at two French stores, highlighting a gap between cyber and property insurance coverage. Cyber policies often exclude physical spoilage, while property policies may contain cyber exclusions, leaving retailers exposed.

Regulators are responding. The UK’s National Cyber Security Centre is working with international partners, while Belgian and Swedish cybersecurity agencies monitor the situation. Legal expert Philip James linked the attacks to broader regulatory efforts, citing the EU’s NIS2 Directive, Cyber Resilience Act, Critical Entities Resilience Directive and the UK’s product security rules and proposed Cyber Security and Resilience Bill. He noted that retail and food businesses are now mapping digital dependencies much like financial firms have under the EU’s Digital Operational Resilience Act.

For insurers and reinsurers, the multi-country spread raises aggregation concerns. If the perpetrators are identified as state-backed actors, war exclusions in cyber policies could be triggered. The need for physical hardware changes also questions policy conditions around patching and security standards. Although no UK stores have been hit, the proximity of Ireland’s market to the UK intensifies the risk for British insurers.

Industry brokers are urged to review clients’ coverage: confirm whether property spoilage clauses contain cyber exclusions, verify that cyber policies address stock loss and physical damage, and assess whether perishable-goods endorsements are in place. Additionally, they should ascertain who manages refrigeration controls, whether those systems are internet-connected, and whether suppliers have implemented safeguards since the French incident.

Why it matters

The attacks expose a growing insurance gap between cyber liability and physical spoilage loss for retailers across Europe.

FAQ

Which supermarkets were affected by the second refrigeration cyberattack?
Delhaize stores in Belgium and Luxembourg, Carrefour, Colruyt Group (Spar), Ikea, Musgrave Group (SuperValu), ICA, Coop, and various smaller retailers in the Netherlands, Estonia and Finland.

What method did the attackers use to disrupt the refrigeration units?
They switched the evaporators to defrost mode, causing freezer temperatures to rise up to 50 °C.

What financial impact was reported by a Delhaize branch in Belgium?
The branch estimated stock losses of €100,000, excluding lost trade while closed.

What regulatory frameworks are relevant to these attacks?
The EU’s NIS2 Directive, Cyber Resilience Act, Critical Entities Resilience Directive, and the UK’s product security rules and proposed Cyber Security and Resilience Bill.

Source: Insurance Business UK. See the original source for full details.