Supermarket chains hit by this autumn's wave of refrigeration cyberattacks will have to absorb the damage themselves, because property insurance excludes losses caused by hacking, insurance experts warned on 4 November 2026.
The warning follows Monday's attack on a Selver supermarket in Estonia, where hackers raised a freezer to +50°C. No stock was lost in that incident, but a repeat could leave chains paying for spoiled food out of their own pockets, according to reporting by RTE.ie, drawing on Estonian public broadcaster ERR.
A Europe-wide attack on the food supply
The Selver incident forms part of a coordinated wave of attacks on supermarket refrigeration systems across Europe this autumn. France and the Netherlands were hit in October. Sweden, Belgium and Luxembourg followed on Monday, and by Tuesday Romania, Germany and the UK had joined the list. Some Swedish stores were forced to throw away spoiled stock.
The EU has warned that the attacks appear to be a deliberate attempt to disrupt the food supply chain. No group has claimed responsibility, and the motive remains unknown.
Estonia's Information System Authority said it had received one notification of the attacks, from Selver, and that more than 30,000 devices in Estonian cyberspace carry known vulnerabilities. Kitman Coldtech, which manufactured the freezer units affected on Monday, said other Estonian clients had also been hacked, and that older Danfoss refrigeration controllers were the most exposed equipment.
Why insurance will not pay out
Helen Evert, a cyber insurance expert at the insurer IIZI, told ERR's Aktuaalne kaamera programme that property insurance policies specifically exclude compensation for property damage caused by cyberattacks, while cyber insurance covers only damage related to information systems and data.
That leaves retailers in a harsh position.
In that case, you have to have money set aside in your bank account for such crises and accept that you will have to bear the damage yourself. This situation is not unique to Estonia, as international markets have already reported exactly the same information regarding international insurance policies.
The gap is not a quirk of the Baltic market. Insurance Business America reported that Howden, commenting on the French attacks, warned that stock losses and physical damage arising from cyber events often fall outside standard policies unless those exposures have been specifically addressed, with property and cyber programmes bought separately and definitions that do not align. The French chain Intermarché told AFP its insurance did not cover this type of incident, according to Insurance Business America.
Whether Estonian insurers begin offering this kind of coverage depends on the international market. If they do, it will come at a price.
As attacks are becoming increasingly frequent, it is clear that insurance premiums will also rise in the near future.
Who is responsible for the open door?
Kaspar Hioväin, IT director of Coop stores, which recently took over outlets formerly run by Prisma, said responsibility for this kind of security rests with the stores themselves.
As at the moment, this is actually a case of negligence on the part of the company itself, as it were. Doors have been left open through which malicious actors have entered, bringing with them damage of an unknown extent.
Coop was not hit, Hioväin said, but the chain has reviewed its systems. He named maintenance partners as the biggest weakness.
The biggest risk is maintenance partners. Unfortunately, these devices are managed by third-party companies, generally refrigeration companies or security companies. And they do not have that kind of cyber security expertise either.
Erki Sirel, chairman of the Eesti külmaliit, the national refrigeration association, pushed back against that framing.
There can always be a threat from that direction, although in reality cooperation involves several parties. Installers do not typically act without agreeing with the equipment owner.
A growing market with a widening gap
Cyber insurance is one of the fastest-growing segments in the industry. A report released on 21 October, cited by TT News, found that US cyber insurance policies have nearly tripled since 2020. Yet much of the economic damage from cyber incidents remains uninsured, widening the global protection gap as threats grow more sophisticated.
For workers and consumers, the consequences are not abstract. When a freezer fails, food is destroyed, shifts are disrupted, and prices come under pressure. The bill lands on companies that chose not to secure their systems, and ultimately on shoppers. The EU's warning about the food supply chain suggests the stakes reach beyond any single supermarket aisle.
Neither Rimi nor Lidl would comment on the issue to ERR. Selver declined to disclose its future security plans, citing security reasons.
FAQ
Will property insurance cover food spoiled in a cyberattack?
No. Helen Evert of IIZI confirmed that property insurance specifically excludes compensation for property damage caused by cyberattacks, while cyber policies cover only information systems and data.
Which countries were hit by the refrigeration attacks?
France and the Netherlands in October 2026, then Sweden, Belgium and Luxembourg on Monday, followed by Romania, Germany and the UK, alongside the attack on Selver in Estonia.
Who is behind the attacks?
No one has claimed responsibility. The EU has warned the attacks appear to be a deliberate attempt to disrupt the food supply chain, but the motive remains unknown.
Could insurers start covering this kind of loss?
Possibly, but it depends on the international market. Helen Evert said that as attacks become more frequent, insurance premiums will rise in the near future.