In the early hours of Monday, 2 November 2026, refrigerators and freezers in
By Tuesday, reports also identified affected businesses in Italy, Portugal, and Germany.4 In Italy, at least four Coop supermarkets in Sicily were affected, although the government described the impact as very limited.4 In Portugal, the Mosqueteiros Group linked problems at seven Intermarché stores to an attack that appears to have targeted an outside company managing their refrigeration.4 In Germany, one Rewe supermarket reported having its refrigeration disrupted by an attack on its system provider, Danfoss.4
This was the second wave in a month. On the night of 11 October 2026, attackers got into the controls of refrigeration systems at hundreds of French supermarkets.5 Reuters reported police linked that attack to fires as well as food losses,6 and the president of Les Mousquetaires (owner of Intermarché) estimated the total cost could run to tens of millions of euros.7
The method appears to have been the same in both instances. Stephan Moelans, who runs Sabcobel, the Belgian firm that operates Delhaize's refrigeration, explained the attackers had put its units' evaporators into defrost mode,1 which is a routine cycle that clears ice from the coils by warming the units. Reuters reported that some of the affected units used Danfoss controls, as in France.6 As of the reports cited here, no one has claimed responsibility, nor has any ransom or other purpose behind all of this chaos been made clear.6
What Happened in France
The October attack was bigger than this week's. France's finance minister, Roland Lescure, put the number of affected supermarkets at about 700, out of roughly 10,000 (7%) in the country, with temperatures staying as high as 50°C (122°F) for about six hours.8 The stores belonged to unrelated retail groups without a common owner. In the retailers' early counts, Intermarché and its Netto brand had at least 300 stores hit, Coopérative U more than 100, Carrefour 80, Monoprix about 5% of its roughly 490 stores, and E.Leclerc was affected too.9 In some cases, the attack also caused fires,9 so a number of these claims will involve damaged property as well as stock.
Warnings about this kind of equipment came in August 2026, when cybersecurity firm Claroty published research on flaws in Danfoss systems that might allow an attacker to get past the login.9 After the attack, Prime Minister Sébastien Lecornu ordered France's national cybersecurity agency, ANSSI, to investigate, and a source close to him said the agency had found a vulnerability in Danfoss software.9 On the evening of 13 October, ANSSI warned that the attacks were probably still under way and told stores to reconnect their refrigeration only through a secure VPN or protected network. Stores were still restocking the following day.8
The losses were uneven even within a single store. At Intermarché La Villette in Paris, a 4 a.m. alert to a supplier came in time to save most of the fresh fruit and vegetables, but the freezers had already reached nearly 40°C and the frozen stock was lost.8 That kind of split, with a total loss in one department and very little in the next, is why the stock and timing evidence discussed below matters. On 1 November, Insurance Business reported that property insurers had started to receive claims from the French attack.5 Those claims are about three weeks ahead of the ones that will follow this week's attacks, so how they are handled is worth watching.
Why These Claims Will Be Different
Most cyber business interruption claims begin with encrypted servers or a failed technology provider. Here there has been no financial demand, which a SentinelOne researcher said points toward sabotage,6 and nothing reported so far suggests any data was taken. The attackers went after the equipment that keeps the stock salable. Much of each loss is therefore physical stock rather than lost trade, spread across dozens of stores with different owners and different insurance programs.
In September, Mike Milne wrote about five recurring damage measurement debates in cyber business interruption claims.10 Several apply here, but this event brings problems of its own. These are the issues we expect to come up first.
1. Which Policy Responds?
The first question on most of these claims will be which policy responds. After the French attack, four insurance brokers told Reuters cyber policies generally do not pay for physical losses, and Intermarché stated that its own insurance would not respond to an incident of this kind.7 Property cover has its own problem. Insurance Business reported property policies held by French retailers often cover refrigerated stock that spoils but usually exclude cyber events as well, so a loss caused by someone tampering with a computer system can fall between the two.5
The practical answer is to split each store's loss into its component parts from the start. Spoiled stock, lost gross profit, clean-up and emergency costs, repairs to refrigeration equipment, and the cost of the technical investigation may each fall under a different insuring clause or a different policy. A blended figure will have to be taken apart later, which is slower and more expensive than building it in pieces. Each store also needs its own calculation, even where one attack hit forty of them in a single night.
Where the attack came in will matter too. At Delhaize, the refrigeration is run by an outside contractor.1 ICA said the stores involved sat outside its central network,1 and Kesko told Bloomberg the equipment in its affected stores was not covered by its central security controls.11 An analysis published in Insurance Journal noted many cyber policies only extend contingent business interruption cover to a business the insured has a written contract with, and some only to IT service providers.12 Whether the intrusion came through a contractor's remote access platform or a controller on the store's own network could change which clauses and limits apply.
2. Valuing Stock That Has Already Been Thrown Away
For many stores, spoiled stock will be the largest component of the loss, and this can be more challenging to measure because the freezers may be empty by the time anyone arrives to assess the damage. The BBC reported that a Delhaize store in Hoeilaart, Flanders, put its loss at €100,000 of produce, and its manager said that figure did not include the further losses from closing the shop.1 A Belgian butchery owner estimated he had lost about €15,000 of meat.6 In France, Lockton said two stores alone lost €270,000 of stock.5 The Hoeilaart comment shows why the heads of claim need to stay separate. Stock and the trading loss from a closure are measured differently and may well be insured differently.
Assessing what was in the freezers usually starts from the last reliable stock figure. Deliveries from then are added, till sales are then deducted, and the result is tested against the disposal evidence, such as photographs, waste contractor tickets, and destruction records. Large chains with perpetual inventory systems will have most of this on hand, while smaller operators may not. In the Netherlands, Danfoss said the businesses attacked included butchers and small neighborhood shops.1 Many of these are likely to be relying on periodic stock counts and supplier invoices.
After the quantities and SKUs of lost stock have been identified, it is then necessary to value the product. Where the policy values finished goods at selling price less unincurred costs, that basis should be applied to the lost stock. In the case of supermarkets, the sales value should be easily identifiable from the sales records. Unincurred costs in the case of a supermarket spoilage loss would likely be minimal and could include bags or packaging. When valuing the stock, allowance should also be made for the amount of stock that goes obsolete during the normal course of business (i.e., what is thrown away at the end of the day because it is past its sell-by date). Other normal stock attrition due to theft and damage should also be considered.
It is also important to remember that when stock is valued at selling price, the valuation must be considered in the context of the business interruption loss. By valuing stock at selling price, the insurer is effectively ‘paying’ for stock that would otherwise have been sold by the insured. As a result, this must be deducted from the lost revenue component of the business interruption claim to avoid double counting. Otherwise, the insured would be reimbursed under both components. This may add complexity if there are multiple policies triggered.12
Precautionary disposal raises a separate question, because some policies only pay for stock actually damaged. Musgrave removed some chilled and frozen products from sale at its affected SuperValu stores as a precaution,3 which is a sensible food safety decision, but evidence demonstrating products were outside their safe temperature ranges for long enough to make them unsafe to sell may still be requested. That means showing which temperature and time limits were applied to each product category, what the monitoring records showed, and who made the call.
3. Timing and the Temperature Record
Timing drives almost every number in these claims. For the stock loss, it determines which products went past a food safety limit. For the business interruption, it sets the start of the interruption and decides whether a waiting period has been met. The difficulty is that the main record of what happened inside each freezer was kept by the device the attackers controlled.
The Belgian butchery owner explained that the attackers infiltrated the system that logs the temperature and could reprogram it from a distance, and the SentinelOne researcher said intrusions through an exposed control panel leave hardly any trace for defenders to find.6
Independent evidence usually exists if someone looks for it early: Standalone data loggers, remote monitoring alerts, manual temperature checks, engineer call-out records, door access logs, and the first sale of the day can all help to fix the timeline. Musgrave said its own monitoring flagged the problem,6 and Kesko told Bloomberg automated alerts and staff arriving in the morning prompted its investigation.11 Those records should be preserved before equipment is reset or replaced. The president of Les Mousquetaires has already said French supermarkets will go to court over who should bear the October losses,7 so the same records may end up in front of a judge as well as an insurer.
The interruption itself may be short. By the afternoon of 2 November, Musgrave said the incident was "fully resolved" and restocking was well under way,3 and the ICA store in Sjöbo reopened after closing for part of the day.1 Cyber policies usually apply a waiting period, often measured in hours, before business interruption cover starts. For a store that lost its freezers overnight and was trading again by lunchtime, the business interruption element may be small or may not clear the waiting period at all. In those cases, most of the money is in the stock, and in the question of which policy pays for it.
4. Lost Sales When the Doors Stayed Open
Where there is a business interruption loss, it will often be partial. Delhaize said its fresh and frozen range in affected stores was temporarily limited while its distribution centers kept delivering as normal.3 That’s a departmental loss rather than a whole-store loss. It would be necessary to examine daily sales by department to establish the impact on operations.
One ‘helpful’ feature of this event is that each company lost only a small part of its supermarket chain. Carrefour had 15 affected stores out of 700 in Belgium,2 and Coop had seven out of 800 in Sweden.1 The unaffected stores traded normally the same week and would provide a solid benchmark for what the affected stores would have sold.
When assessing the business interruption losses, it will be important to consider offsets where some lost sales will have moved to other products in the same store or to a sister store nearby, and some will simply have been delayed. The effect can also run the other way, as shoppers who find the freezer aisle closed may take the whole basket elsewhere, so the loss may reach beyond the frozen category. Transaction counts and average basket values, compared with the benchmark stores, should provide solid indicators on these issues.
5. Extra Expense and Betterment
Getting back to normal can involve overtime for emptying and cleaning freezers, waste disposal, temporary refrigeration, extra deliveries, refrigeration engineers, and IT forensic support. In France, it also meant fire damage at some stores.9 Moelans said Sabcobel had been working all night and morning to disconnect the affected units from the network.1
The harder question is the cost of fixing the underlying weakness. Danfoss said after the French attack many of the affected units ran outdated software or were old enough that they no longer received security updates.7 Moelans said many units needed physical modifications, not just software updates.1 Replacing an unsupported controller with a supported one might look more like an improvement than a repair, although work done urgently to stop the loss recurring may be partly arguable as reasonable mitigation. As Mike Milne’s September article noted, the usual test is whether the spending was reasonable and proportionate to the loss it avoided.10 To the extent it is possible, invoices should separate emergency work from the upgrade so each can be considered on its own terms.
6. Why the Second Attack Matters
The November attack came three weeks after the French attack, and that gap is likely to feature in the claims. After the October attack, Danfoss said it had long advised customers to keep their systems updated and replace older equipment.9 Sabcobel said most of its customers had already switched to a secure connection.1 Ken Munro, a security researcher, emphasized supermarkets should have taken their refrigeration systems off the internet, asserting "I don't accept any other excuse."2
Insurers will be curious to know what each business did between 12 October and 2 November. Brokers for the French retailers told Reuters after the French attack that missing software updates could cause problems with claims, although Paul Gooch of Tokio Marine Kiln said running outdated software would not normally be enough on its own for a claim to be declined.7
The repeat also raises aggregation questions, as Carrefour was hit in France in October and in Belgium in November,6 and Bloomberg reported on an October cyberattack that left Ahold Delhaize stores in the Netherlands with service outages and empty shelves for several days.11 Whether two incidents are one event or two will affect how many deductibles apply and how limits are shared, especially where a policy renewed in between. For our purposes, as it’s still early days, keeping each event and store in a separate calculation until the coverage position is settled will save time and avoid additional expenditure of potentially having to separate measurements later.
7. Attribution and the War Exclusion
The EU's agriculture commissioner, Christophe Hansen, called the attacks a deliberate effort to disrupt the EU's food supply,6 while researchers quoted by Politico disagreed on whether the repeat pointed to a hostile state or a copycat.2 A cyber underwriter told Reuters after the French attack that claims could get harder if a state actor proves to be responsible, since cyber policies generally exclude acts of war.7 Lloyd's has also required standalone cyber policies to carry exclusions for state-backed attacks since 2023.12 None of this should hold up the quantification, however, as the loss can be measured on its own facts now and the coverage position applied once it is known. Currently, though, attribution is still open and may stay that way for a while.
What Affected Businesses Should Do Now
Most of the evidence these claims depend on is easiest to collect in the first few days. For affected businesses and their adjusters, these steps will make a real difference:
Path Forward
A cyberattack does not need to touch data to cause a large loss, and refrigeration is only one example. Insurance Business pointed out heating, ventilation, and other building systems are now commonly managed remotely as well, often using equipment put in years ago when cyber risk got far less attention.5 The same publication noted the US is the biggest single market for Danfoss,5 and the BBC reported that US investigators, working with their French counterparts, are trying to establish whether refrigeration failures at several American military bases in August are connected.1
Brokers are already adjusting. Aon's David Molony told Reuters he’d advised retailers and businesses in some other sectors to buy dedicated cover for perishable stock.7 For the attacks that have already happened, the outcome will turn on evidence: what was in the freezers, when it spoiled, what trade was lost, and what it cost to put right. Businesses capturing that evidence in the first few days will find their claims far easier to support than those trying to rebuild the picture months later.
This blog was coauthored by Michael Milne, Hannah Dingley, and John Balsamo.
Sources
BBC News, "Shop freezers in seven European countries hit by cyber-attack," 3 November 2026.
Politico Europe, "Europe's supermarkets hit by new wave of cyberattacks targeting fridges," 2 November 2026.
Associated Press, "Supermarket freezers in several European countries hit by apparent cyberattacks," 2 November 2026.
BBC News, "Europe on alert after supermarket freezers hit by cyber-attacks in 10 countries," 3 November 2026.
Insurance Business, "French fridge hack tests line between cyber and property cover," 1 November 2026.
Reuters, "New cyberattack on supermarket fridges sweeps across Europe," 2 November 2026.
Reuters, "French supermarkets' cyber insurance unlikely to cover food losses, insurers say," 15 October 2026.
Associated Press, "French cybersecurity authority warns attack may be ongoing as stores scramble to restock," 14 October 2026.
Al Jazeera, "Hundreds of supermarkets in France hit by 'unprecedented' cyberattack," 13 October 2026.
Michael G. Milne, "Five Recurring Damage Measurement Debates in Cyber Business Interruption Claims," Meaden & Moore Investigative & Forensic Accounting Blog, 10 September 2026.
Bloomberg, "Supermarkets Across Europe Report New Suspected Freezer Hack," 2 November 2026, as published by Insurance Journal.
Insurance Journal, "The Cost of Losing Your Cool: Tallying the Losses of a Supermarket Cyberattack," 22 October 2026.