Refrigeration sabotage: who pays for spoiled stock?

The war on ordinary machines · Part 5 of 7

Cooling resumes, food remains unsaleable and suppliers still expect payment. Policy documents and a worked example reveal how the loss, the cash needed to recover and potential legal claims fit together, with different sums attached to each.

Among the technical recommendations for compromised refrigeration controllers, one sentence turns to insurance. France’s CERT-FR asks operators to check their policy conditions before interrupting the flow of data to their refrigeration contractor. The alert was issued on 12 October 2026 and updated on 16 October. A decision about securing equipment therefore also involves a contract. 1

That detail opens the fifth instalment of this investigation. Earlier articles followed machine controls, contractors’ access and the evidence needed to establish sabotage. This one follows the money: inventory written off, trading that never takes place, spending required to reopen, and the amount eventually recoverable from an insurer or a responsible party. Several figures can accurately describe the same incident while answering different questions.

The research draws on EU rules, French law and insurance documents. Victims’ signed policies, coverage decisions and payments remain outside the collection. Historical wordings and commercial examples retain their dates and geographical scope, allowing their mechanisms to be compared.

Stock can lose its value while the investigation continues

Restoring the cold chain and releasing food for sale require different decisions. EU Regulation 178/2002 bars unsafe food from the market, including food that is injurious to health or unfit for consumption. It also addresses traceability and, in the relevant circumstances, withdrawal, notification of authorities and recall. Restarting equipment therefore leaves a separate question about the affected batches. 2

Our proposed approach to documenting the loss starts with the batch rather than an announced sum. Which goods were held in which cabinet or cold room? What observations establish their condition? What decision was made, on what basis and for what quantity? These questions connect technical evidence with commercial records. They set no food-safety threshold: the product decision requires appropriately qualified people and procedures.

It helps to preserve the distinction between an observation and the action taken because of it. An alarm provides information to investigate. A food assessment may lead to sales being blocked. The inventory record translates that decision into product references and quantities. Purchase invoices supply another fact: what the business paid. Together, these records allow a specific loss to be discussed through a verifiable history rather than a headline amount detached from its goods.

Method and scope

An l0g documentary framework informed by Regulation 178/2002, articles 14, 18 and 19; IAS 2 solely as an IFRS reference; and French Civil Code article 1353. No food-safety threshold or universal settlement rule. No victim data.

Operational decisions and financial validation may happen at different times. Investigation or loss adjustment can continue after goods have been withdrawn. A useful documentary question is how authorised staff coordinated food-safety decisions with evidence requirements. Urgent protection and food-safety decisions retain priority; evidence for loss adjustment should be assembled through the authorised professional process.

This is where the CERT-FR warning acquires economic significance. A connection may support monitoring that also matters to contractual commitments. The inference to test at each installation is specific: when access is secured, which monitoring continues, who performs it and how is it recorded? The alert itself establishes neither an applicable policy clause nor the consequences of an interruption for a particular victim. 1

Lost stock drains the cash needed to reopen

A coherent calculation starts with a valuation basis. Under IFRS, IAS 2 measures inventory at the lower of cost and net realisable value, with inventory losses recognised as expenses when they occur. That is an accounting reference point. The framework used by a particular French retailer and the valuation basis in its insurance policy must be established separately. 3

A shelf price already includes more than the goods purchased. It must also support the business and leave a margin. Adding the full retail value of spoiled goods to all the sales lost during an interruption can therefore count the same value twice. Comparing two business paths over an identical period makes the overlap easier to see.

The following example is entirely fictional. All figures exclude VAT. We isolate one department and one interruption period, without assigning it a real-world duration. Before the incident, the retailer has already paid €20,000 for its opening stock. Without an interruption, it would collect €40,000 in sales during the period. Variable costs would total €30,000, comprising the opening stock and €10,000 in other sales-related expenses. The resulting €10,000 contribution would go towards unchanged fixed costs and then profit.

In the attack scenario, all opening stock is lost with no salvage value. Sales disappear for the period. The other €10,000 of variable expenses are avoided. Additional recovery expenses, assumed to be fully consumed, amount to €5,000. Before fixed costs common to both paths, the result falls from +€10,000 to −€25,000. The economic loss is €35,000: €20,000 of destroyed inventory, €10,000 of lost contribution and €5,000 of extra expenses. Calculation A

This illustrates the reasoning behind business-interruption loss. France Assureurs describes traditional cover in terms of gross profit supporting continuing fixed costs and lost profit, with certain additional expenses. The insured scope, deductibles and indemnity period depend on the wording. Our simplified contribution explains the economics; an insurance policy may define its insured gross profit differently. 4

Method and scope

Original l0g model, entirely fictional, in EUR excluding VAT, over an unspecified period. Opening stock of €20,000 was paid before the period. Normal case: €40,000 collected sales and €30,000 variable costs, comprising that stock and €10,000 other costs; zero closing stock. Incident: no sales, opening stock destroyed, €5,000 extra expenses paid and consumed, and €20,000 replacement stock paid and still unsold. Identical fixed costs omitted. Assumptions exclude insurance, receivables, payables, salvage, VAT and finance charges. The €55,000 gap compares period cash flows; €25,000 isolates two recovery outflows. Peak borrowing and total funding needs remain unknown. Extra closing stock of €20,000 reconciles the cash gap with the €35,000 economic loss.

Replenishment creates another opportunity for double counting. In our example, the retailer buys €20,000 of replacement goods at the end of the period. Cash leaves the business, but inventory of the same value arrives and remains unsold at the calculation’s closing date. Treating that purchase as another destruction would artificially raise the loss to €55,000. The replacement asset needs to remain in the picture.

The €25,000 of recovery disbursements, comprising replacement stock and extra expenses, answers a narrower question. It measures two selected cash outflows. Once missing receipts are included, the cash deterioration relative to the normal path is €55,000: without the incident, €40,000 comes in and €10,000 goes out during the period; after the incident, €25,000 goes out and nothing comes in. The extra €20,000 of closing inventory reconciles this cash difference with the €35,000 economic loss. Calculation A

This distinction matters before insurance enters the discussion. A retailer may have to finance more than its accounting loss because it must also rebuild an asset. Its actual bank funding requirement would depend on available cash, other flows, supplier payment terms and any advance payments. None is observed here. The example measures neither a peak overdraft nor any victim’s financing need.

Where physical damage fits in the insurance wording

For spoiled goods, the coverage question sits at the intersection of two definitions: which property is insured and which causes of damage are covered. Stock protection needs to be read alongside insured events, exclusions and endorsements. A cyber policy, meanwhile, may fund the IT response while drawing a different boundary around physical damage.

Hiscox’s 2019 CyberClear CC1219 general conditions provide a historical example. General exclusion 7 addresses physical damage and consequential financial loss; the policy schedule can take precedence. The document illustrates a contractual structure, rather than current availability or any attacked retailer’s cover. 5

The other side of that boundary appears in a 13 November 2019 Lloyd’s Market Association bulletin presenting model property cyber clauses, including an exclusion. The LMA explicitly describes them as illustrative and open to amendment. Holding both property and cyber insurance consequently leaves a practical question about how their wordings interact. 6

Some products expressly advertise resulting physical-damage cover. On its UK page, FM Affiliated describes proVision as covering physical property damage caused by a cyberattack, subject to exclusions, and the associated interruption. That commercial description is a useful counterexample, not evidence that any French victim’s groceries are insured. The signed contract remains the document to establish. 7

Method and scope

Analytical diagram, not a coverage estimate. Three documents with distinct statuses: historical 2019 Hiscox general conditions, illustrative LMA models and FM’s UK commercial description. No victim policy is available. Connections indicate questions to verify, not established entitlements.

One way to read the documents is to carry a specific scenario through them: identified goods became unsaleable following an established event; which insuring clause responds, which valuation applies and which condition limits payment? The answer should point to a clause, a definition and any endorsement changing them. This exercise distinguishes a broad sales proposition from an applicable contractual commitment.

Alleged negligence requires similar care. Under French Insurance Code article L113-1, loss caused by an insured’s fault is addressed subject to formal and limited exclusions, while also excluding the insured’s intentional or dolosive fault. A shortcut from “weak password” to automatic refusal goes beyond that provision. Facts, declarations and wording require their own examination. 8

The present research has neither the affected retailers’ insurers’ decisions nor their reasons. A public exclusion provides grounds for a focused question. It does not establish that a claim has already been refused.

Complaints and insurance: the information that starts the deadlines

Financial evidence is assembled within a legal timetable. In the professional circumstances covered by French Insurance Code article L12-10-1, insurance payment for losses caused by the specified cyber offences is conditional on a complaint filed within 72 hours of the victim learning of the attack. Establishing that starting point requires its own chronology. 9

Notice to the insurer follows a different provision. Article L113-2 requires notification upon awareness of the loss, within the contractual deadline. As a general rule, the stipulated period must allow at least five working days, with statutory exceptions including theft and livestock mortality. That minimum constrains the wording; it is not a reason to wait five days before notifying. 10

Method and scope

French law reviewed on 3 November 2026. Article L12-10-1 applies within its professional and offence scope. L113-2: notice as soon as the claim event is known, no later than the contractual deadline; a general minimum of five working days for the stipulated period, subject to statutory exceptions including theft and livestock mortality. L113-5: agreed benefit and timing. Arrows are schematic; starting points are not assumed simultaneous. No actual dates or common time scale.

A careful reconstruction therefore dates the information actually received, the notifications made and the evidence available at those times. An abnormal temperature, knowledge of a compromise and identification of damage may be different observations. In an actual claim, their legal significance is for the professionals handling it to assess. No awareness date is assigned to a victim here.

Payment has a timetable of its own. Article L113-5 links performance and timing to the benefit and deadline agreed in the contract. Identifying potential cover, discussing a sum, accepting an amount and receiving a transfer are distinct claim stages. The provision supplies no uniform payment delay for refrigeration incidents. 11

For cash management, that distinction suggests a useful record: separate amounts requested, amounts confirmed and money actually received, with dates attached. An expected recovery can inform financing decisions, but its degree of confirmation belongs beside the number. A single figure labelled “insurance” removes exactly the information needed to judge whether the next bills can be paid.

An insurer that pays may pursue another responsible party

Coverage and liability can draw on some of the same evidence while asking different questions. French contractual-liability law addresses non-performance or delay, with its force-majeure exception. The obligation actually undertaken therefore has to be identified before assigning a failure to the party expected to perform it. 12

In the documentary record proposed here, manufacturer documents, maintenance agreements and operational decisions help establish who was supposed to do what. The connection to the damage must then be demonstrated. Contractual duties follow the obligations undertaken and the operational decisions made. Establishing a company’s liability requires assessment of the individual case.

After paying, the insurer may become a claimant in its own right. Article L121-12 provides for subrogation: the insurer takes over the insured’s rights against the third party responsible for the damage, up to the amount paid. The transfer enables recovery proceedings. Their outcome, duration and the third party’s ability to pay remain separate questions. 13

Method and scope

French-law relationship diagram, notably based on L121-12. Solid arrow: payment if coverage is due. Dashed arrows: conditional legal recovery, depending on established liability and collection. No amounts, durations, success rates or actual third party. Any uninsured loss requires separate assessment, without duplicate compensation.

Recovery proceedings redistribute the financial burden of damage that has already been recognised. For property insurance, article L121-1 states the indemnity principle and permits a retained share for the insured. Amounts claimed, indemnified and later recovered should remain traceable to the same underlying loss, without turning successive payments into additional destruction. 14

The documentary stakes therefore extend beyond the first reimbursement. Civil Code article 1353 connects a claim for performance to proof of the obligation, and an alleged discharge to proof of payment or another extinguishing event. The allocation of proof in a specific dispute requires legal analysis. For economic research, the principle already points towards maintaining the connection between a monetary demand and its supporting records. 15

A useful loss figure comes with a defined scope

Further reporting on actual losses should ask what each published amount measures and how far the claim has progressed. Is it the value of withdrawn batches? Lost contribution over a defined period? Recovery expenses? An amount submitted to an insurer, accepted under the policy or already received? Those distinctions would make company disclosures comparable without adding incompatible measures.

The documents reveal a practical difficulty: securing equipment, deciding what happens to food and funding recovery rely on partly overlapping evidence and contracts. Their consistency can be prepared before an incident and tested after it. The clearest evidence of financial recovery will be a reconciliation between replacement goods, resumed trading, bills paid and insurance proceeds actually received.

Calculation A · Fictional example and reconciliation

All figures are euros excluding VAT. Opening inventory, already paid: 20,000. No credit terms, salvage, insurance proceeds, tax or financing costs. Fixed costs are identical and omitted from both paths. Normal path: sales receipts 40,000; opening stock consumed 20,000; other variable cash costs 10,000; contribution 10,000; closing stock zero; period cash flow +30,000. Incident path: opening stock destroyed 20,000; zero sales; other variable costs avoided; extra expenses consumed and paid 5,000; replacement inventory purchased and paid at period-end 20,000, remaining unsold. Result before fixed costs −25,000; closing inventory 20,000; cash flow −25,000. Economic loss: 10,000 − (−25,000) = 35,000. Cash deterioration relative to the normal path: 30,000 − (−25,000) = 55,000. Reconciliation: 55,000 − 20,000 extra closing assets = 35,000. Selected recovery disbursements: 20,000 + 5,000 = 25,000; not the total funding requirement.

Research scope

Documentary research checked on 3 November 2026. The numerical example is wholly fictional; calculation A states its assumptions and reconciliation. Victims’ signed policies, coverage decisions and payments remain outside the collection. The historical Hiscox 2019 wording and FM’s UK description retain their contexts. Applying the French rules cited requires assessment of the individual case.

Further reading

• Part 1: supermarket freezers become a target.
• Part 2: who actually controls the machines?.
• Part 3: remote maintenance and contractor access.
• Part 4: industrial sabotage and attribution.

Sources

Documents checked on 3 November 2026. The notices identify versions, relevant passages and the scope of each example.

1. [1] · ANSSI / CERT-FR · 12 October 2026; last version 16 October 2026 · Checked on 3 November 2026Security incident targeting remote refrigeration controllers

   Advice to check contractual insurance terms before interrupting reporting to the refrigeration contractor.

   Passages and scope

   Solutions for both equipment states; revision history. The alert identifies a contractual precaution and supplies no policy or coverage decision. Official page read directly; HTML copy received with HTTP 200 on 3 November 2026.

2. [2] · European Union / EUR-Lex · 28 January 2002; consolidation 1 January 2026 · Checked on 3 November 2026Regulation (EC) No 178/2002, consolidated version of 1 January 2026

   Food safety, traceability, withdrawal, notification and recall in the circumstances specified.

   Passages and scope

   Articles 14, 18 and 19. Each article has its own conditions; the text supplies no universal temperature threshold. Official consolidated French and English content read through the web index on 3 November 2026; direct retrieval met a JavaScript challenge.

3. [3] · IFRS Foundation · Undated page · Checked on 3 November 2026IAS 2 Inventories, official overview

   Lower-of-cost-and-net-realisable-value measurement and recognition of inventory losses as expenses.

   Passages and scope

   About: measurement, cost and expense-recognition paragraphs. An IFRS overview that establishes neither a particular retailer’s accounting framework nor its insured valuation. Official page read directly; HTML copy received with HTTP 200 on 3 November 2026.

4. [4] · France Assureurs · 27 May 2024 · Checked on 3 November 2026Business-interruption insurance for companies

   Traditional business-interruption cover, insured gross profit, extra expenses, deductibles and indemnity period.

   Passages and scope

   Coverage, indemnity-period and deductible sections. An industry federation’s explanation; the actual policy determines triggers and definitions, including for cyber cover. Official page read directly; HTML copy received with HTTP 200 on 3 November 2026.

5. [5] · Hiscox · 2019, historical wording · Checked on 3 November 2026CyberClear by Hiscox, general conditions CC1219

   Historical physical-damage and consequential-loss exclusion, and precedence of the policy schedule.

   Passages and scope

   Printed pages 3, 4 and 17; general exclusion 7. Historical wording, distinct from a current offer or any victim’s policy; internal reference CC1219 differs from the filename. Official PDF downloaded with HTTP 200 on 3 November 2026; pages 3, 4 and 17 extracted, rendered and inspected.

6. [6] · Lloyd’s Market Association · 13 November 2019 · Checked on 3 November 2026Property and Marine Cyber Clauses, LMA19-031-PD

   Model cyber exclusions and endorsements for property and marine policies.

   Passages and scope

   Bulletin LMA19-031-PD, clauses LMA5400–5403 and usage notice. Illustrative models open to amendment; adoption by any insurer or particular policy requires separate evidence. Official page read directly; HTML copy received with HTTP 200 on 3 November 2026.

7. [7] · FM Affiliated · Undated page, UK market · Checked on 3 November 2026proVision policy, Cyber

   Advertised cover for resulting physical damage and associated business interruption, subject to exclusions.

   Passages and scope

   Resulting damage. A UK commercial description; the signed policy determines the property, events, conditions and limits actually covered. Official page read directly; HTML copy received with HTTP 200 on 3 November 2026.

8. [8] · Légifrance, French Republic · Version effective from 8 January 1981 · Checked on 3 November 2026French Insurance Code, article L113-1

   General rule for fortuitous loss and loss caused by the insured’s fault, subject to formal and limited policy exclusions; the insured’s intentional or dolosive fault is excluded.

   Passages and scope

   Both paragraphs; amendment by the 7 January 1981 Act, article 28. This provision determines neither a particular policy’s cover nor the legal character of conduct. It does not establish automatic denial because a password was weak. Official article read on Légifrance; version effective on 3 November 2026 checked.

9. [9] · Légifrance, French Republic · Version effective from 24 April 2023 · Checked on 3 November 2026French Insurance Code, article L12-10-1

   For legal entities and individuals acting professionally, payment under the clause covering the specified computer-system offences is conditional on a complaint within 72 hours after the victim becomes aware of the attack.

   Passages and scope

   Both paragraphs; offences referred to in Criminal Code articles 323-1 to 323-3-1; 24 January 2023 Act, article 5. The starting point depends on the individual facts. A complaint is distinct from notice to the insurer. No victim awareness date or coverage decision is assumed. Official article read on Légifrance; version effective on 3 November 2026 checked.

10. [10] · Légifrance, French Republic · Version effective from 1 April 2018 · Checked on 3 November 2026French Insurance Code, article L113-2

    Notice to the insurer upon awareness of a potentially covered loss, within the contractual period; the general minimum is five working days, subject to statutory exceptions.

    Passages and scope

    Paragraph 4 and following provisions: theft, livestock mortality, extensions and conditions for forfeiture due to delay. Five working days is the minimum stipulated period, not a universal deadline or a reason to wait. Contractual forfeiture for delay requires, among other conditions, prejudice established by the insurer; other qualifications and exceptions must be considered. Official article read on Légifrance; version effective on 3 November 2026 checked.

11. [11] · Légifrance, French Republic · Version effective from 8 January 1981 · Checked on 3 November 2026French Insurance Code, article L113-5

    Upon occurrence of the risk or contractual maturity, the insurer must perform the contractually defined benefit within the agreed period.

    Passages and scope

    Complete article, within chapter III on the insurer’s and insured’s obligations. The provision establishes neither a universal settlement period nor assured payment under an individual policy or claim. Article read in the current official Légifrance chapter. Direct retrieval of the individual article returned 403.

12. [12] · Légifrance, French Republic · Version effective from 1 October 2016 · Checked on 3 November 2026French Civil Code, article 1231-1

    Framework for damages arising from non-performance or delayed performance of an obligation, with the stated exception where force majeure prevents performance.

    Passages and scope

    Complete article; 10 February 2016 Ordinance, article 2. The obligation, breach, damage, causal connection and defences require case-specific analysis. No manufacturer, contractor, operator or insurer is found liable here. Official article read on Légifrance; version effective on 3 November 2026 checked.

13. [13] · Légifrance, French Republic · Version effective from 25 June 2025 · Checked on 3 November 2026French Insurance Code, article L121-12

    An insurer that has paid is subrogated, up to the indemnity, to the insured’s rights and actions against third parties responsible for the relevant damage; statutory qualifications apply.

    Passages and scope

    All three paragraphs, especially the first on payment and its limit; 23 June 2025 Act, article 3. The transfer establishes neither liability, solvency, successful collection nor its duration. The provision includes qualifications concerning specified persons related to the insured and conduct by the insured preventing subrogation. Text read in the official Légifrance chapter; the same version was cross-checked in the official code tree effective on 3 November 2026. Direct article retrieval returned 403.

14. [14] · Légifrance, French Republic · Version effective from 21 July 1976 · Checked on 3 November 2026French Insurance Code, article L121-1

    Indemnity principle for property insurance: a limit tied to the insured property’s value at the loss date, with stipulated retained shares or deductibles possible.

    Passages and scope

    Both paragraphs: property value and amounts or proportions retained by the insured. This property-insurance provision supplies neither a complete business-interruption formula nor the valuation of an individual inventory loss. Official article read on Légifrance; version effective on 3 November 2026 checked.

15. [15] · Légifrance, French Republic · Version effective from 1 October 2016 · Checked on 3 November 2026French Civil Code, article 1353

    A party seeking performance must prove the obligation; a party asserting discharge must establish payment or the extinguishing event.

    Passages and scope

    Both paragraphs; 10 February 2016 Ordinance, article 4. A general evidential framework. Rules applying to a particular dispute, exclusion or presumption need separate legal analysis. Official article read on Légifrance; version effective on 3 November 2026 checked.