Fridge cyber attack turns up heat on demand for cyber triggered physical damage cover

Commercial businesses in the UK’s food supply chain were hit by a cyber attack on 2 November 2026, which disrupted the functionality of fridges and freezers.

The Independent reported that fridges and freezers had been hacked, with some thermostats remotely raised as high as 50 degrees celsius or switched to defrost mode.

The National Cyber Security Centre (NCSC) confirmed to Insurance Times that it was aware of a “small number of UK organisations that may be affected by this incident as a result of vulnerabilities on their systems”.

A spokesperson said: “The NCSC is supporting those that may be impacted.

“We continue to liaise with our international partners and the affected sectors to understand and mitigate its impact.”

William Altman, director of cyber threat intelligence services at CyberCube, noted that the attacks reached supermarkets and food shops in six countries - including Belgium, Ireland, Sweden and Estonia – ”linked solely by a class of remotely managed refrigeration controller”.

Altman explained that attackers who infiltrate that remote access have the same reach, which means that ”a single weakness is capable of producing losses at many insureds on the same night”.

He continued: ”Nobody has asked for a ransom, which suggests the point was disruption.

”For modelling, that means the loss depends on how many controllers sit within an attacker’s reach and the value of the stock each one keeps cold.”

Speaking to Insurance Times, Lindsey Maher, head of global cyber development at CFC, said that the attacks on supermarket fridges highlight ”the need for cyber insurance to respond accordingly”.

With cyber and property having largely been treated as separate risks for years, Maher explained that the “distinction makes less sense as more businesses rely on connected technology to operate their premises, machinery and supply chains”.

She continued: ”A cyber incident doesn’t necessarily stay digital – it can damage equipment or lead to loss of physical stock.

“The insurance market needs to think about these risks in the same connected way that businesses experience them. For policyholders, the distinction between a cyber loss and a property loss is largely irrelevant. What matters is whether their insurance responds when a cyber event has a very real, physical consequence.

”Currently, a coverage gap remains for many insureds, which I believe the cyber market is particularly well positioned to close. Cyber insurers already understand the event causing the loss and can easily build understanding of the resulting property exposure, rather than expecting traditional property insurance to become expert in an increasingly complex cyber threat landscape.”  

A ‘warning to businesses’

Coalition’s scanning data identified “1,638 exposed hosts” that were reachable and identifiable by potential attackers.

While retailers have strengthened their defences against ransomware and data breaches, Paul Gooch, deputy departmental head of cyber and enterprise risk at Tokio Marine Kiln, noted that “operational technology such as that used in stores and warehouses is typically configured to prioritise availability rather than security”.

He said that “a security compromise can result in significant operational issues” because of how central these systems are to modern business operations.

In turn, he felt that insurers should expect ”demand to grow for coverage that addresses cyber triggered physical damage”.

He added: “It should come as a warning to businesses with machinery and equipment connected directly or indirectly to the internet, as threat actors increasingly look to exploit control system technology to cause maximum disruption.”