Sometimes it's not your data that's at risk. It's your inventory, operations and revenue.
When most people think about cyber risk, they picture ransomware demands, compromised email accounts, stolen customer information or a data breach making headlines.
Few would expect a cyber event to start with a supermarket freezer.
Yet recent events in France demonstrate just how unexpected the source, and consequences, of a cyber incident can be.
Hundreds of supermarkets were affected after attackers reportedly manipulated connected refrigeration systems, triggering forced defrost cycles and causing temperatures to rise. Fresh and frozen products had to be discarded, stores faced disruption and significant financial losses began accumulating.
On the surface, it sounds almost absurd.
Much like the widely referenced casino breach reportedly linked to a connected fish tank sensor, it is the kind of scenario that challenges our assumptions about what cyber risk looks like and, importantly, where it might be sitting within a business.
Behind the unusual headline, however, is a much more serious risk story.
The real story isn't the hack. It's the chaos that followed.
Consider what a refrigeration failure means inside a supermarket.
Temperatures rise. Fresh and frozen food becomes unsafe to sell. Shelves and refrigerators need to be cleared. Stock has to be discarded. Deliveries and replenishment plans are disrupted. Staff are diverted from their normal roles. Refrigeration specialists and crisis teams are mobilised. Customers arrive to find products unavailable.
Now multiply that across hundreds of stores.
At some affected locations, the financial consequences were immediate. Two supermarkets in Alsace reportedly recorded €270,000 in merchandise losses alone, while the CEO of Intermarché reportedly warned that nationwide losses could run into tens of millions of euros in a single day.
And spoiled inventory is only part of the equation.
There can be lost revenue, emergency response and remediation costs, additional logistics expenses, interruption to supply, reputational consequences and considerable management time devoted to containing the situation and returning operations to normal.
The technology failure might happen quickly. The financial consequences can continue well after it has been fixed.
That is where the conversation around cyber and business interruption becomes particularly important.
Looking for cyber risk in unexpected places
For many organisations, the cyber conversation naturally centres around information: protecting data, defending against ransomware and meeting increasingly complex privacy obligations.
But the supermarket incident highlights just how much connected technology can sit outside those traditional areas of focus.
Refrigeration controls are one example. Depending on the organisation or industry, connected technology can also extend across manufacturing equipment, warehouse automation, sensors, building management systems, security infrastructure and industrial control environments.
Many of these systems perform physical functions that are fundamental to keeping a business operating.If they are compromised, the consequences can therefore be very physical too.
Stock can spoil. Production can stop. Equipment can become unavailable. Services can be disrupted. Revenue can be lost.
It is a very different consequence to the type of cyber incident organisations may instinctively prepare for, but exactly the type of scenario that deserves consideration when assessing where critical technology dependencies sit across a business.
One vulnerability, many businesses
There is another important dimension to the French incident: third-party dependency. Reports indicate the affected refrigeration equipment included legacy products that no longer receive software or security updates, while multiple major French supermarket groups were affected by the attack.
That raises an important issue for organisations assessing their own cyber exposure.
A business can invest significantly in protecting its own technology environment and still remain dependent on software vendors, equipment providers, cloud platforms, logistics partners and other third parties to keep critical operations running.
A weakness outside the organisation can therefore become a very real interruption inside it.
This is not simply theoretical. Cyber claims insights also point to increasing third-party involvement in incidents, with third-party incidents accounting for 14% of claims in 2026 in one insurer's data, up from 10% in 2025.
Understanding critical dependencies, and the consequences if one of them becomes unavailable, should therefore form an important part of the broader cyber risk conversation.
Where insurance comes in
Incidents such as the French refrigeration attack also demonstrate why cyber insurance discussions need to extend beyond data breach response.
Contemporary cyber policies can provide protection for a range of first-party losses arising from cyber events, including incident response, forensic and legal expenses, system restoration, cyber extortion and business interruption. Depending on the structure and wording, cover can also extend to contingent business interruption arising from disruption to suppliers or other third parties.
Business interruption deserves particular attention.
Claims data shows it can be one of the more unpredictable and severe costs arising from a cyber event, with losses potentially developing over time as the full operational impact becomes apparent.
But incidents that cross from digital disruption into physical consequences can also create more complex insurance considerations.
Traditional cyber policies commonly focus on system availability, data, incident response and resulting financial loss, while property policies may contain their own provisions or restrictions around cyber events. Where a cyber event causes physical damage or subsequent interruption, how different policies interact becomes an important consideration.
For businesses with significant operational technology, physical assets, perishable inventory or complex supply chains, this makes scenario testing particularly valuable.The question is not simply,
"Do we have cyber insurance?"It is whether the insurance program has been considered against the ways a cyber event could actually interrupt the business.
The lesson isn't really about freezers
It is easy to look at a story about hackers manipulating supermarket refrigeration systems and think it is an unusual incident with little relevance outside food retail.
That would miss the bigger point.
The freezer is simply where the vulnerability became visible.
In another organisation, it could be a sensor, production line, warehouse system, building control or piece of connected equipment that receives comparatively little attention in the traditional cyber conversation.That is what makes the French supermarket incident such a useful risk management case study.
The most significant cyber exposure within a business may not necessarily be attached to the data organisations are most concerned about protecting. It could be attached to the technology they depend upon every day to manufacture, store, move, sell or deliver their products and services.The fish tank and the supermarket freezer might make unusual headlines.
But the disruption, financial loss and insurance implications behind them are anything but funny.
Contact us
If you'd like to understand how these exposures could impact your organisation, speak with Lockton's Cyber team or our and Food and Beverage specialists about your cyber, operational resilience and business interruption risks.
The contents of this publication are provided for general information only. Lockton arranges the insurance and is not the insurer. While the content contributors have taken reasonable care in compiling the information presented, we do not warrant that the information is correct. The contents of this publication are not intended as a legal commentary or advice and should not be relied on in that way. It is not intended to be interpreted as advice on which you should rely and may not necessarily be suitable for you. You must obtain professional or specialist advice before taking, or refraining from, any action based on the content in this publication.
© 2026 Lockton Companies Australia Pty Ltd.
