Die Hard 4.0 or Real Life? Hackers Turn Supermarket Fridges into Heaters
When a cyberattack causes physical damage, will your insurance actually respond?
Remember Die Hard 4.0?
In the 2007 Bruce Willis film, a disgruntled cybersecurity specialist launches a coordinated attack on America’s infrastructure, turning the country’s own technology against itself. Traffic systems are manipulated, utilities are disrupted and everyday infrastructure becomes a weapon. At the time, it seemed like typical Hollywood exaggeration. Nearly 20 years later, some of those scenarios are beginning to feel rather familiar.
In October 2026, reports emerged of hackers targeting refrigeration systems in French supermarkets, allegedly manipulating temperature controls and turning commercial fridges and freezers into heaters.
Temperatures reportedly reached 50°C (122°F), resulting in spoiled food, significant financial losses and reports of fires.
It sounds like something straight out of Die Hard 4.0. Unfortunately, the potential consequences for businesses are very real.
What happened in France?
The reported attacks targeted internet-connected refrigeration equipment used by supermarkets. Modern refrigeration systems are increasingly sophisticated. Many can be monitored, adjusted and maintained remotely, allowing engineers to manage temperatures, identify faults and carry out maintenance without attending the premises. That convenience, however, also creates another potential entry point for cybercriminals.
In this case, attackers reportedly interfered with refrigeration controls, causing equipment to operate at dangerously high temperatures.
The consequences extended well beyond a conventional IT disruption:
- Refrigerated and frozen stock was spoiled.
- Fires and equipment damage were reported.
- Supermarkets experienced operational disruption.
- Businesses faced potentially substantial financial losses.
The incident highlights an increasingly important distinction: cyberattacks do not have to involve stolen data or ransomware to cause serious damage to a business.
Sometimes, the damage is physical.
Cyberattacks are no longer just about computers
When most businesses think about Cyber insurance, they tend to think about ransomware, stolen customer information, fraudulent payments or an inability to access their computer systems. Those are all genuine risks, but modern businesses rely on technology for much more than administration. Manufacturers use digitally controlled machinery. Warehouses operate automated storage systems. Food businesses rely on connected refrigeration equipment. Commercial buildings use remotely managed heating, ventilation and security systems. These systems are often referred to as operational technology (OT), as opposed to traditional information technology (IT).
When cybercriminals interfere with operational technology, the consequences can extend beyond lost data to damaged machinery, destroyed stock and potentially even fire.
And this creates an interesting insurance question.
Would a Cyber insurance policy cover the damage?
Not necessarily. This is an area where businesses can mistakenly assume they have more protection than they actually do.
Traditional Cyber insurance policies are generally designed to respond to losses arising from cyber incidents, including data breaches, ransomware, cyber-related business interruption and associated recovery costs.
However, physical damage caused by cyber interference is not automatically covered under a standard Cyber insurance policy. Some insurers can provide cover for physical damage resulting from a cyberattack, including damage to equipment and potentially consequential losses such as stock deterioration and Business Interruption. The important distinction is that this cover is not universally available and, where offered, is frequently provided as an optional extension, potentially subject to separate limits, exclusions and conditions.
It is therefore something that needs to be specifically considered when arranging Cyber insurance.
But surely the Property insurance would cover it?
Again, not necessarily. A business might reasonably expect its Commercial Property insurance to respond if refrigeration equipment is damaged or stock is destroyed. However, many Property policies contain cyber-related exclusions, which can restrict cover where the underlying cause of the damage is malicious interference with computer systems or electronic controls.
This creates the potential for an uncomfortable gap:
The Property insurer may exclude the cyber cause, while the Cyber insurer may exclude the resulting physical damage.
Whether either policy responds will depend on the exact wording, the circumstances of the incident and any extensions purchased. The fact that a business holds both Property and Cyber insurance does not automatically mean every consequence of a cyberattack is insured.
What about Business Interruption?
This is another important consideration. Imagine a food manufacturer whose refrigeration system is compromised, destroying thousands of pounds of stock and forcing production to stop.
The immediate loss of stock could be substantial, but the financial consequences may go much further. There could be lost revenue, replacement stock costs, equipment repairs, additional operating expenses and delays in fulfilling customer orders.
A traditional Property Business Interruption policy may require an insured material damage event before responding. Meanwhile, a Cyber Business Interruption section may respond to certain interruptions to computer systems but exclude losses arising from physical damage.
Even where cyber-triggered physical damage is insured, it is important to establish whether the extension also covers the resulting Business Interruption. These are separate considerations and should not be assumed to come together automatically.
Could this happen to your business?
The French supermarket incident is a particularly striking example, but the underlying exposure is relevant to a much wider range of industries. Food manufacturers, cold-storage operators, pharmaceutical companies, engineering firms, logistics businesses and even commercial property owners may rely on connected equipment that could be vulnerable to interference.
The more businesses automate their operations and connect machinery to external networks, the more important it becomes to consider the physical consequences of a cyberattack.This does not mean businesses should avoid connected technology. It means their risk management and insurance arrangements need to keep pace with how they operate.
The Clarke Williams view
At Clarke Williams, we believe Cyber insurance should be considered alongside a business’s wider insurance arrangements rather than treated as a completely separate product. For businesses that rely heavily on machinery, refrigeration, automated processes or other connected equipment, we would recommend considering three questions:
- Does your existing Property insurance contain exclusions relating to cyber incidents?
- Does your Cyber insurance provide any cover for physical damage caused by cyber interference, or could an appropriate extension be added?
- If a cyberattack damages equipment or stock and stops your business trading, would the resulting Business Interruption be insured?
The answers may be very different depending on the insurer and policy wording.
The lesson from France is that a cyberattack can become a physical damage claim remarkably quickly.
And while Die Hard 4.0 might have been Hollywood fiction, the idea of hackers turning everyday infrastructure against the people who rely on it no longer seems quite so far-fetched.
If you would like us to review how your Property and Cyber insurance policies work together, or explore whether cyber-triggered physical damage cover is available for your business, please contact Clarke Williams.
