Ceci n’est pas un frigo. The cyber-attack on French supermarkets’ chiller cabinets is straight from cyber insurers’ loss scenario playbook for the so-called “internet of things”.   

Hackers used remote-controlled thermostats to dial up or force-defrost fridges in hundreds of stores, in some cases raising the temperatures to 50°C or more. Industrial quantities of fresh food were spoiled. Losses comprising – at least – lost assets, business interruption (“BI”) loss, and forensic investigation and response costs look set to reach tens, or hundreds, of millions of Euros.   

The specific attack vector is presently not in public domain, but it is suggested the bad actor(s) may have exploited outdated firmware e.g. firmware the provider no longer supports.

For insurance coverage, a few points jump out, at least from an English law perspective:

1. Aggregation: Prima facie it seems the losses arise from a single cause: a concerted cyber security breach affecting multiple fridges at multiple supermarket chains at the same time.  Whether the losses comprise a single occurrence is less clear. It appears they happened at the same time, in the same way, with the same underlying intent – but whether they happened in the same place is harder to answer. Physical damage, in the form of spoiled goods, took place at stores across the country. Arguably, however, the “occurrence” was the interference with the thermostats. This may have taken place in a single remote location.

Policyholders, insurers and reinsurers will need to establish the facts, as best they can, and look carefully at policy aggregation clauses to establish how many deductibles and/or limits may apply.

2.  Property/BI cover: The first port of call for the claim for lost assets, and indeed any BI loss, is the supermarkets’ property policies. For “all risks” policies, the scope of any cyber exclusions or sub-limits will obviously be important and, in many cases, the enquiry may end there. A cyber “buyback” clause like LMA5400 only grants cover for fires and explosions that follow a cyber event, not soggy fish fingers. Policyholders and insurers will also want to check what perils are insured: where a property policy only grants cover for particular types of loss, cyber losses may not be covered or may be subject to sub-limits.

If no exclusion applies, the parties will also need to look carefully at any wording relating to machinery breakdown, deterioration of stock or defrosting, all of which could be significant. BI cover is usually only triggered by losses covered under the property section of a policy, but it may be worth checking any BI extension or sub-limit language for utilities.

3.  Cyber cover:  Cyber insurance cover for physical damage is by no means a given: many cyber policies exclude physical damage altogether. Cyber insurance does, however, generally cover a least an element of business interruption. Where cyber cover is most obviously relevant here, however, is the costs of forensic investigation and remediation, which a property policy would not normally respond to.

The parties will, however, need to bear in mind any “war and cyber operations” exclusion.  Depending on what causation information emerges, the facts of this event could test the parameters of cyber policies containing one of the LMA exclusion clauses (LMA5564 – 7 A&B) or similar provisions. For instance, does France qualify as an “impacted state” within the meaning of the relevant exclusion? Has the loss caused a major detrimental impact on the functioning of the state? And so on.

It will also be important to look carefully at any warranty or exclusion that may apply where a policyholder uses unsupported systems – in tandem with the fair presentation position.

4.  Duty of fair presentation: If insurance cover may respond, it may be necessary to consider whether the risk was fairly presented to insurers. Use of outdated firmware may have been material to the risk. If so, was this disclosed to insurers as part of the risk presentation? Most cyber proposal forms will contain a specific question about whether the policyholder uses only software that is supported and patched regularly, and/or a warranty requiring policyholders to use such software. Property insurers with cyber exposure may also need to know this information. If a supermarket was using unsupported systems and did not inform insurers then, depending on the policy wording and the facts of the placement, compliance with the duty of fair presentation may come into focus.

5.  Third parties/subrogation: Once the facts of the attack are established, it may become necessary to consider whether a security breach of a third party’s system is covered and/or whether any rights of recovery arise as against third parties. Any international insurers involved will need to remember that France allows so-called “action direct”, whereby insurers can be joined as named parties to litigation.  

Regardless of the coverage position under specific policies, this high-profile event is a paradigm illustration of a cyber peril that causes property damage. It is likely to be a spur to the insurance market to review the cover it provides in this technical area – and to risk managers to mitigate these risks even more proactively.