When a Cyberattack Becomes a Property Loss

Why companies should test their insurance program against one connected chain of events

Key takeaways

• A cyber event can create digital, physical and operational losses at the same time.

• Those losses may fall under different policies, and cyber exclusions in property wordings can change the outcome.

• Testing the full program against one realistic scenario shows where gaps and retained losses sit.

A recent cyberattack on refrigeration systems in European supermarkets shows how quickly a digital incident can become a physical and financial loss.

According to public reporting [add source link], attackers gained control of software used to regulate refrigeration temperatures and forced some systems into continuous defrost cycles. Temperatures rose and affected retailers reportedly discarded significant quantities of fresh and frozen food.

The immediate loss was spoiled stock. An incident of this nature can also involve investigation costs, restoration of control systems, inspection of equipment, interruption of operations, waste disposal, additional operating expenses and lost revenue.

In our experience, this is where insurance programs are often least tested.

“Most companies can tell you which cyber and property policies they buy. Far fewer have tested how the program responds when a cyber incident causes physical damage, stock loss and business interruption all at the same time.”
Mikkel T. Mortensen, Head of Account Management, Corporate, Aon Denmark

One event, multiple losses

A refrigeration incident of the type European supermarkets experienced can generate:

• incident response and forensic investigation costs;

• cost for restoration of systems and operational data;

• spoiled or contaminated stock and loss of stock value;

• equipment inspection or repair costs;

• business interruption and additional costs of working; and

• potential claims from customers or contractual counterparties.
  

Those losses may have the same underlying cause, but they do not necessarily fall under the same policy.

Property insurance may respond to physical damage and resulting business interruption. Cyber insurance may address incident response, system restoration and certain forms of cyber-triggered interruption. Machinery breakdowns and liability policies may also become relevant.

The challenge is usually not buying policies. It is understanding how they respond when the same event triggers more than one of them.

Handling the incident and why property cyber exclusion matters

One of the first documents we would ask to see in a scenario like this is the cyber exclusion attached to the property policy.

Many property programs now contain specific cyber exclusions or cyber endorsements. LMA5400, the Property Cyber and Data Endorsement, excludes broadly defined Cyber Loss but includes a limited writeback for physical loss or damage caused by an ensuing fire or explosion directly resulting from a Cyber Incident, subject to the remaining policy terms. By contrast, LMA5401 adopts a broader exclusionary approach and does not contain the same fire and explosion write-back. The distinction can be important where a cyber event leads to physical consequences.

The distinction matters.

If temperatures rise because of deliberate manipulation of a control system, the analysis may be very different from an accidental system failure. Equally, stock spoilage resulting from increased temperatures is not the same as physical damage arising from an ensuing fire or explosion.

LMA5400 and LMA5401 are only examples. Insurers may use amended LMA clauses, bespoke exclusions or negotiated writebacks. The point is not which clause number appears on the schedule. The point is understanding what the property wording does when a cyber event causes a physical consequence.

A simple question often reveals whether the program has been properly tested:

• If manipulation of an operational system causes stock loss, equipment damage or business interruption, does the property wording preserve cover, or does the cyber exclusion remove it?
  
  

Where the gaps can appear

For businesses that depend on operational technology, several areas deserve particular attention.

• Stock spoilage. Temperature-sensitive stock may become unusable even though the refrigeration equipment itself has suffered no permanent damage. Companies should understand whether spoilage, deterioration or contamination can satisfy the relevant property triggers.

• Business interruption. A company may shut down operations while systems are investigated and validated. That decision may be operationally correct, but the resulting interruption does not automatically satisfy the triggers required under property business interruption cover.

• Digital restoration versus physical repair. The same event may require cyber specialists to restore systems and engineers to repair or inspect equipment. Depending on the wording, those costs may be treated very differently.

• Multiple locations and shared suppliers. A single compromised supplier account or remote-access platform may affect several sites simultaneously. That creates additional questions around deductibles, waiting periods, limits and event definitions.

• Evidence and causation. In a claim involving both cyber systems and physical operations, system logs, temperature data, maintenance records and operational decision-making may all become important. Evidence preservation should therefore form part of the incident-response process from the outset.
  
  
  

These potential gaps cannot be assessed by the insurance function alone. They sit at the intersection of operational technology, cyber incident response, business continuity and insurance. Management therefore needs a shared understanding of how a digital disruption could develop into physical loss, which decisions would have to be made during the incident, and where the financial consequences would ultimately fall.

“The question is rarely whether a company has insurance. The question is whether management has tested how the program responds when a cyber event becomes an operational event.”
Jens Erik Nielsen, Head of Aon Global Risk Consulting, Denmark

Test the event, not the policy

Traditional insurance reviews often start with individual policies.

We believe a better approach is to start with a realistic operational scenario and follow the consequences through the entire insurance program.

For a retailer, that scenario could involve loss of refrigeration controls. For a manufacturer, it could involve manipulation of production equipment. For an energy company, it could involve unauthorized access to operational technology.

For each stage of the loss, management should ask:

1. What loss has occurred?

1. Which policy is expected to respond?

1. What trigger and evidence are required?

1. What limits, deductibles, waiting periods or exclusions apply?

1. Which part of the loss may remain with the company?

This exercise should involve operations, IT, finance, legal, risk management and insurance. Each function sees a different aspect of the event, and assumptions that appear reasonable in isolation can look very different when assessed across the full program.

What management needs to know

Before considering whether to buy a larger cyber limit, management should understand:

• which physical operations can be controlled or disrupted digitally;

• which suppliers have privileged or remote access;

• which stock, equipment and production processes could be affected;

• how losses may develop after 24 hours, seven days and 30 days; and

• which parts of the exposure are expected to be insured, and which are being retained.
  
  

The response may involve operational changes, stronger segmentation between IT and operational technology, tighter supplier access controls, additional resilience measures or changes to the insurance program.

Having both cyber and property insurance does not necessarily mean the gap between them has been addressed.

The real test is whether management understands how the program responds when the same event creates digital restoration costs, physical loss and operational interruption.

In our experience, scenario testing is often the most effective way to make that gap visible. It brings cyber exclusions, writebacks and policy triggers into the same discussion before a claim occurs rather than afterwards, when coverage is already being assessed.

Next step

We would be glad to help you test your own program. Mikkel T. Mortensen and Jens Erik Nielsen offer a scenario-testing workshop that follows one realistic event through your cyber, property and business interruption cover. Contact your Aon representative to arrange a conversation.

This article is for general information only and does not constitute insurance, legal or other professional advice. Coverage depends on the specific policy wording, terms and conditions. Please consult your Aon representative regarding your own circumstances.