On the night of 11 October 2026, hackers attacked hundreds of supermarkets across France. They did not steal customer data. They did not demand a ransom, at least not publicly. Instead, they accessed refrigeration systems remotely and set them to defrost. Freezers and refrigerators heated to 50 degrees Celsius for around six hours. Meat, frozen goods, and vegetables had to be thrown out across roughly 150 Intermarché stores, stores belonging to Cooperative U, approximately 80 Carrefour locations, and a number of Leclerc outlets. (Source: Bloomberg, AFP, BFM, October 2026.)
This is what the security industry calls an operational technology attack. And it is a category of cyber risk that most businesses — in Singapore and elsewhere — have not thought through.
In brief
- A cyberattack on French supermarkets in October 2026 disabled refrigeration systems, heating freezers to 50°C and causing widespread stock losses across hundreds of stores.
- Hackers targeted operational technology (OT) — the systems that control physical processes and equipment — rather than data or IT networks.
- The affected refrigeration systems were legacy equipment that was no longer receiving security updates, a common vulnerability across many industries.
- Singapore businesses that rely on temperature controls, industrial machinery, or other physical systems face the same category of risk.
- Cyber insurance can respond to OT incidents, but the scope of cover depends on the policy wording. It is worth understanding what your policy does and does not include before an incident occurs.
What is operational technology, and why does it matter?
Most people think of cyber risk in terms of data: a breach, a ransomware attack, customer records stolen. That framing is correct as far as it goes, but it does not capture the full picture.
Operational technology (OT) refers to the hardware and software that controls physical processes and equipment. Temperature controls in a cold room. Building management systems that regulate air conditioning and access. Industrial machinery on a factory floor. Energy monitoring equipment. In the French supermarket case, the target was a refrigeration controller — a networked device that could be accessed and reprogrammed remotely.
These systems were once air-gapped, meaning they ran on isolated networks with no external connectivity. Increasingly, they are internet-connected for remote monitoring, efficiency, and maintenance. That connectivity brings operational benefits and introduces a new attack surface.
In August 2026, the UK's National Cyber Security Centre warned that hackers were increasingly seeking to cause physical disruption, linking this trend in part to rising geopolitical instability. In the US in July 2026, suspected hackers targeted water facilities in at least seven states, in some cases degrading water operations. Separately, unidentified hackers accessed the propulsion system of an oil and gas tanker off the Texas coast. (Source: Straits Times, October 2026.)
The French supermarket attack is consistent with this pattern. Cybersecurity researchers at Claroty had flagged vulnerabilities in the Danfoss refrigeration controllers used by French retailers as recently as August 2026, identifying a hidden authentication mechanism that could be used to tamper with refrigeration operations. The majority of affected systems were older models — the Danfoss AK-SM 800 and AK-SC 355 — that no longer receive software or security updates. Danfoss confirmed it had long advised customers to migrate legacy systems to current-generation solutions. (Source: Bloomberg, October 2026.)
The lesson here applies well beyond French supermarkets.
Which Singapore businesses face OT risk?
Any business that relies on physical systems controlled by networked software is exposed. The level of risk depends on how critical those systems are to operations, how old the equipment is, and whether it has been secured appropriately.
Sectors with meaningful OT exposure in Singapore include the following.
Cold chain and food storage. Warehouses, distributors, caterers, and food manufacturers that maintain refrigerated or frozen stock. A system failure — whether from a cyberattack, a configuration error, or a compromised vendor — can result in the loss of an entire inventory.
Manufacturing and engineering. Factories with networked machinery, industrial control systems, or automated production lines. An attacker who gains access to a programmable logic controller can disrupt production, damage equipment, or create safety hazards. Industrial all risk insurance addresses the physical asset exposure, but an OT-triggered loss requires a cyber policy that explicitly covers resulting property damage to respond in full.
Facilities and building management. Commercial landlords, data centres, and large office occupiers often run building management systems that control air conditioning, power, access, and fire suppression. These are increasingly internet-connected and represent a meaningful attack surface. Where a system failure affects tenants or third parties on the premises, public liability insurance may also be relevant depending on the nature of the resulting loss.
Marine and offshore operations. Vessels and platforms with networked navigation, propulsion, or monitoring systems face OT risk at sea, where the consequences of system failure are compounded by the difficulty of rapid response. Businesses with goods in transit should also review whether their marine cargo insurance responds to losses arising from a cyber-related incident on a vessel.
Healthcare and laboratory settings. Equipment that maintains controlled environments for samples, medications, or research — including cryogenic storage — is subject to the same category of risk.
What does cyber insurance cover in an OT incident?
Cyber insurance is designed to respond to losses arising from a cyber incident. Whether a specific OT attack triggers cover depends on the policy wording, and wordings vary materially between insurers.
Areas where cyber insurance commonly responds in an OT incident include the following.
Business interruption. If the attack disrupts operations — production is halted, a cold chain fails, a facility becomes inoperable — a cyber policy with business interruption cover can respond to the revenue loss during the period of disruption.
Physical asset loss. Where the cyberattack causes direct damage to equipment or stock — as in the supermarket case, where the product losses were immediate and tangible — some cyber policies include cover for the resulting property damage. This is not universal, and the policy wording determines whether such losses are included or excluded.
Incident response costs. The costs of investigating the breach, restoring systems, and engaging specialist forensic or technical support are typically covered under a cyber policy.
Third-party liability. Where an OT incident affects customers, tenants, or other parties — for example, if a building management failure affects a tenant's operations — a cyber policy may respond to resulting third-party claims.
The important caveat is that coverage for physical damage arising from a cyber incident is an area of ongoing development in the market. Some policies explicitly include it; others exclude it or leave it ambiguous. A policy that covers data breach losses may not automatically cover the destruction of refrigerated stock or the cost of repairing a damaged industrial controller.
This is not a reason to assume cyber insurance does not apply to OT risk. It is a reason to read the wording carefully and to discuss the specific exposure with your intermediary before a claim arises.
What the French supermarket case tells us about vendor and supply chain risk
One detail of the French case deserves attention. The refrigeration systems were not managed directly by the supermarkets — they were managed by Danfoss, a Danish refrigeration technology supplier. Mousquetaires, the group behind Intermarché, stated that it would be up to Danfoss to file a complaint with authorities, suggesting that the access point was within the supplier's systems or the supplier-managed devices.
This is a supply chain cyber risk scenario. The supermarkets were affected not because their own IT systems were breached, but because a supplier's equipment and management systems were compromised.
For technology vendors, system integrators, and managed service providers, this scenario also raises the question of liability to clients. Where a supplier's systems or managed devices are the point of compromise, and that compromise causes loss to a client, the supplier may face claims for the resulting damage. Technology liability insurance responds to this category of exposure — covering the legal costs and damages arising from a technology failure or breach that affects a client's operations.
For Singapore businesses on the buyer side, the practical implication is similar. The cyber risk exposure of your business is not limited to what your own team manages. It extends to every vendor, contractor, or service provider who has remote access to your systems or who manages equipment on your premises. Legacy equipment from suppliers who no longer issue security updates, as was the case with the affected Danfoss controllers, represents a documented and foreseeable vulnerability.
Reviewing the security posture of critical technology suppliers — and understanding which of your systems are managed remotely by third parties — is a reasonable starting point for any business that has not done so recently.
The practical question
The French supermarket attack caused immediate, visible financial loss. Stock was destroyed. Revenue was lost for the duration of the shutdown. Stores had to reopen and restock. The operational consequences were real and measurable.
For any Singapore business that relies on temperature-controlled storage, connected machinery, or physical systems managed through networked software, the relevant questions are: what happens to operations if those systems are accessed and disrupted remotely, how quickly can the business recover, and does the existing insurance programme respond to that scenario?
If the answers are uncertain, that uncertainty is worth resolving before an incident rather than after.
This article provides general information only. It is not insurance advice. Policy availability, terms, conditions, and exclusions vary by insurer and product, and cover is subject to the full policy wording. Please contact TZY CO for advice on your specific situation.