Insurers warn spoilage from fridge hacks may fall outside cover

• Hackers changed settings on refrigeration controllers at UK food suppliers this week, the National Cyber Security Centre and a meat trade body said.
• Brit said a single flaw in widely used refrigeration software could cause spoilage, property and business interruption losses across a whole portfolio.
• An Estonian insurance broker said property policies there exclude damage caused by cyber attacks, leaving retailers to bear spoilage losses.

Insurers are warning that food spoiled by hacked fridges and freezers may not be covered by either property or cyber policies, after a second wave of attacks on refrigeration controls spread across Europe and reached UK food suppliers this week.

Hackers remotely raised temperatures or forced defrost cycles at supermarkets in at least 11 countries from Monday 2 November, AFP reported, weeks after a similar attack spoiled stock at hundreds of French stores. No one has claimed responsibility.

In the UK the targets were food suppliers rather than supermarkets. The National Cyber Security Centre said it was aware of "a couple of instances where vulnerable technology had been exploited," the BBC reported. The Association of Independent Meat Suppliers told the BBC that two members saw fridges begin to defrost and a third saw cold units rise to 100C, though the units were empty and no produce was lost. Paul Chichester, the NCSC's director of operations, said: "At the moment, the impact is minimal."

The three meat suppliers were attacked through Copeland XWEB supervisory controllers, the trade body told Recorded Future News. Copeland ended software support for its XWEB EVO range on 16 March, including security patches, according to a product bulletin.

The cover question has followed the attacks from France. After the October wave, insurers told Reuters that cyber policies typically do not cover physical losses, and four brokers said claims could be affected if retailers lacked the latest software updates, Insurance Journal reported. Intermarché told AFP its insurance did not cover that type of incident.

Lloyd's insurer Brit said on its website that the attacks raise "a growing aggregation concern". "A vulnerability within a widely deployed refrigeration platform, building management solution or industrial control product could create simultaneous loss across multiple sites," it wrote in a note by cyber underwriting consultant Tim Hodgkins, adding that one event could trigger property, spoilage and business interruption losses across an entire portfolio.

In Estonia, where a Selver supermarket freezer was raised to 50C on Monday, Helen Evert, a cyber insurance expert at insurance broker IIZI, said property insurance specifically excludes property damage caused by cyber attacks, ERR reported via RTÉ. "As attacks are becoming increasingly frequent, it is clear that insurance premiums will also rise in the near future," she said.

Related coverage: French supermarket fridge hack leaves retailers facing a cover gap; Coalition found 1,506 exposed fridge panels before French store attack.

Sources

• AFP: At least 11 European countries snared in freezer cyberattacks (3 November 2026)
• BBC News: UK also affected by cyber-attack which hit European fridges (3 November 2026)
• Recorded Future News: British businesses caught in Europe-wide supermarket fridge attacks (3 November 2026)
• Copeland Controls: End of software support for the XWEB EVO family (product bulletin, March 2026)
• Insurance Journal (Reuters): French supermarkets' cyber insurance unlikely to cover food losses (15 October 2026)
• Brit: Spoilage: when cyber attacks open the fridge door
• RTÉ / ERR: Insurance won't cover cyberattack damage to stores, experts warn (4 November 2026)

CoverWire is a news and information service. Nothing here is investment advice.