On the night of 11–12 October 2026, hundreds of French supermarkets fell victim to a cyberattack targeting their refrigeration systems. By taking control of temperature regulation devices, the attackers caused temperatures to rise artificially, resulting in the destruction of several tonnes of food products.
A cyberattack with very tangible consequences, raising a fundamental question: who bears the losses when a cyberattack causes physical damage?
In an article published on 15 October 2026, entitled “Cyberattaques de supermarchés : les trous dans la raquette de l’assurance” (Supermarket Cyberattacks: The Gaps in Insurance Coverage), journalists Clément Daniez and Sandra Mathorel of l’Opinion interviewed Jocelyn Pitet, partner and co-founder of Entropy, to discuss the legal and insurance challenges raised by this unprecedented attack.
Cyber Insurance and Property Damage: A Risk Falling Between Two Policies
As Jocelyn Pitet explains in l’Opinion, the insurance market has historically been structured around two main categories of coverage: cyber insurance on the one hand, and property damage insurance on the other.
The former generally covers incidents affecting IT systems, business interruption losses and crisis management expenses. The latter covers physical damage, such as fires, machinery breakdowns or damage to goods.
But what happens when a cyberattack results in the destruction of food stocks?
This is precisely where difficulties arise. Cyber insurance policies do not necessarily cover physical damage, while property damage policies may contain exclusions for cyber-related incidents.
A company may therefore hold several insurance policies only to discover, when a loss occurs, that its damages are not fully covered.
Compensation will then depend on the wording of the relevant clauses, any applicable exclusions, deductibles and the interaction between the various policies in place. Each situation must therefore be assessed on a case-by-case basis.
Cyberwarfare: An Additional Challenge for Insurers and Businesses
The article also addresses another particularly sensitive issue: how should a cyberattack be legally classified when its perpetrators have not been identified?
Insurance policies traditionally include exclusions relating to acts of war. Yet cyberattacks can now be carried out by criminal groups, organised networks or actors supported by nation-states.
In recent years, the international insurance market has also increasingly tightened exclusions relating to certain cyberwarfare risks.
As Jocelyn Pitet points out, this development raises a major challenge: how can a criminal cyberattack be distinguished from a cyber operation connected to an international conflict?
The technical attribution of a cyberattack may require several months of investigation. Its legal classification can prove even more complex. Moreover, an operation supported by a State does not automatically constitute an act of war.
These uncertainties can have significant consequences for the application of insurance coverage and the burden of proof in insurance disputes.
Another Urgent Priority: Preserving the Right to Compensation
Beyond the scope of insurance coverage, businesses must also pay close attention to the procedural requirements imposed by law.
Since 2023, Article L. 12-10-1 of the French Insurance Code has made certain contractual insurance payments relating to cyberattacks conditional upon filing a criminal complaint within 72 hours of the victim becoming aware of the cyber incident.
This requirement, which applies to the circumstances specified by the legislation, can prove particularly burdensome in the midst of a crisis.
While a company is attempting to restore its systems, preserve its inventory or resume operations, strict legal deadlines may be running simultaneously.
When facing a cyberattack, businesses therefore have two urgent priorities: ensuring business continuity and preserving their right to insurance compensation.
Anticipating Cyber Risk Also Means Anticipating Insurance Coverage
This incident highlights the fact that cyber risk is no longer confined to data or IT systems. It can directly affect industrial equipment, supply chains and companies' physical infrastructure.
In this context, simply purchasing cyber insurance is not enough. Businesses must also ensure that their policies genuinely cover the risks to which they are exposed.
Entropy advises businesses on the review, drafting and negotiation of their cyber insurance policies, particularly to identify gaps in coverage, secure the wording of coverage provisions and exclusions, and ensure consistency between cyber insurance and property damage policies.
The firm also represents businesses in disputes with their insurers, particularly in cases involving denial of coverage, disputed compensation or disagreements over the interpretation and application of exclusion clauses. Entropy defends its clients' interests through both out-of-court negotiations and litigation before the competent courts, seeking to secure the application of insurance coverage and fair compensation for losses suffered.
Our approach combines legal expertise with a technical understanding of cyber risks, enabling us to assist businesses both in anticipating insurance-related risks and in resolving disputes that may arise following a cyber incident.
As this cyberattack demonstrates, the risk may be identified, the damage may be real… yet the insurance coverage may still fall short.
view our expertise