After cyber attacks: supermarkets are threatened with the next bad news

Who pays the damage?

After the hacker attack: supermarkets are threatened with the next bad news

Supermarkets had to throw away tons of food after the attack, and the damage ran into the hundreds of thousands. Whether the insurance pays depends on one detail.

Now comes the next piece of bad news. Whether the insurance company covers the damage depends heavily on the respective contract. An evaluation by the insurance broker CyberDirekt, which specializes in cyber insurance, now shows that cyber insurance does not always pay for spoiled refrigerated goods, even if the supermarket operator has one.

Of the 21 tariffs examined, 15 generally do not replace spoiled goods. Of the remaining six tariffs, only one pays the full amount of the damage. So-called sublimits apply to the other five tariffs. The amount of damage that the insurer covers is capped in these cases – for the tariffs examined it is 50,000, 100,000 or 250,000 euros.

In other cases the damage is even greater. A Delhaize supermarket in Flanders, Belgium, estimated the damage at 100,000 euros, while French supermarkets are reporting damage in excess of 200,000 euros. Here too, in most cases the damage is unlikely to be covered by insurers.

The reason: Cyber ​​insurance is designed to cover data breaches, business interruptions, extortion and liability risks. Spoiled goods, on the other hand, are considered property damage, which many tariffs do not cover or only cover to a limited extent. Classic property insurance often excludes damage caused by cyber attacks. “This can lead to critical coverage gaps for retailers,” writes CyberDirekt.

Insurance claims settlement could also be made more difficult if it turns out that state actors are behind the hacker attack. Acts of war are generally excluded from insurance coverage – attacks by state-affiliated actors are often viewed as such by insurers. However, it is still unclear who is responsible for the attack.

In the past few days, supermarkets in Belgium, Estonia, FinlandIreland, Italy, Luxembourgthe Netherlands, Portugal, Sweden and Germany, tampering with cooling and freezing systems was reported. Weeks earlier, hackers had already gotten in France slammed. In Germany, supermarkets from the Rewe, Edeka and CAP chains were among those affected. In Bavaria, a butcher’s shop also fell victim to the unknown perpetrators.