Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

Hacker attack on the cold storage system: who pays for the spoiled goods?

not covered The goods are usually not insured

Goods spoiled after a hacker attack are probably not insured: The cyber terms exclude property damage, the property terms exclude cyber events. Usually only IT forensics and resetting the control system are covered, because control systems count as IT systems.

As of

AmukI put the cyber terms and the property terms side by side. The goods fall right between them.
On this page
  1. Cyber policy
  2. Property policy
  3. The wave
  4. What helps

What the cyber insurers say

9 answers: 6 not covered, 3 no information AXA, SME insurance, cyber insurance module (same content: «Cyberversicherung Unternehmen»): not coveredSunrise (AXA), Business Cyber Insurance (option for KMU SecureConnect, Sunrise Ethernet and others): not coveredMobiliar, Cyber insurance for companies (first-party loss, third-party loss, assistance, IT Assistance, legal protection): not coveredZurich, Zurich Cyberversicherung (variants Basic, Optimum, Premium): not coveredHelvetia, Helvetia Cyber-Versicherung – KMU-Spezial (variants ECO, SMART, TOP): not coveredChubb, Cyber Enterprise Risk Management (Cyber ERM) V2.2: not coveredAllianz Suisse, Cyber Risk Versicherung: no informationVaudoise, Additional cover «Cyber and data protection» to the Business One contents and business liability insurance: no informationAIG, CyberEdge: no information
  • not covered6
  • no information3

  • AXA

    SME insurance, cyber insurance module (same content: «Cyberversicherung Unternehmen»)

    not covered

    Condition and source

    Property damage and resulting loss of income excluded. However, controls of machines and installations count as an IT system (E11): data/software of the control system are insured, the spoiled goods are not.

    AXA Versicherungen AG, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. B6, S. 12 · Open document

  • Sunrise (AXA)

    Business Cyber Insurance (option for KMU SecureConnect, Sunrise Ethernet and others)

    not covered

    Condition and source

    Property damage and resulting loss of income excluded. However, controls of machines and installations count as an IT system (E11): data/software of the control system are insured, the spoiled goods are not.

    AXA Versicherungen AG, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. B6, S. 12 · Open document

  • Mobiliar

    Cyber insurance for companies (first-party loss, third-party loss, assistance, IT Assistance, legal protection)

    not covered

    Condition and source

    Generally excluded.

    Schweizerische Mobiliar Versicherungsgesellschaft AG, Ausgabe 01.2024, Ziff. E lit. e, S. 22 · Open document

  • Zurich

    Zurich Cyberversicherung (variants Basic, Optimum, Premium)

    not covered

    Condition and source

    Excluded, except replacement of end-user devices. Control technology counts as part of the network: data/software of the refrigeration system or CNC control are insured, the item itself is not.

    Zürich Versicherungs-Gesellschaft AG, Ausgabe 01/2024 (ZH9513d-2402), Art. 5, S. 6 · Open document

  • Helvetia

    Helvetia Cyber-Versicherung – KMU-Spezial (variants ECO, SMART, TOP)

    not covered

    Condition and source

    Losses arising from property damage are not insured; the module «Defective production» is not part of KMU-Spezial.

    Helvetia Schweizerische Versicherungsgesellschaft AG, Ausgabe Juni 2026 (Dokument 01.07.2026, CH00TLV), Ziff. 3.2.3 lit. b, S. 9 · Open document

  • Allianz Suisse

    Cyber Risk Versicherung

    no information

    Condition and source

    GTC not public, no information found.

    Terms not public, quote via BTAG.

    Allianz Suisse Versicherungs-Gesellschaft AG, abgerufen 06.11.2026 · Open document

  • Vaudoise

    Additional cover «Cyber and data protection» to the Business One contents and business liability insurance

    no information

    Condition and source

    Cyber GTC not public, no information found.

    Terms not public, quote via BTAG.

    Vaudoise Allgemeine Versicherungs-Gesellschaft AG, abgerufen 06.11.2026 · Open document

  • Chubb

    Cyber Enterprise Risk Management (Cyber ERM) V2.2

    not covered

    Condition and source

    Bodily injury and property damage excluded.

    Terms not public, quote via BTAG.

    Chubb European Group SE, 01/2022, Exclusion 4.8 · Open document

  • AIG

    CyberEdge

    no information

    Condition and source

    GTC not public.

    Terms not public, quote via BTAG.

    AIG Europe S.A., Zweigniederlassung Opfikon, geändert 20.08.2026 · Open document

What is covered anyway

  1. Control systems of machines and installations count as part of the IT system: forensics and restoration of the control software are covered (AXA E11; Zurich Art. 102.1 names medical, production and control technology).

    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 102.1

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

And property insurance?

  1. Property insurance usually does not help:refrigerated goods are insured there only as an add-on and only in the event of a technical defect or power interruption (AXA property B8, Allianz C6.3.3); AXA excludes operating errors (B8.5) and, in the catch-all provision, hacker attacks (let. s), Mobiliar All Risks excludes cyber risks (section 3).

    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Sachversicherung, Ausgabe 06.2024 (16373DE – 2024-06), Nicht genannte Gefahren, lit. s

    «Schäden verursacht durch Schadprogramme, Hacker- und Denial-of-Service-Angriffe sowie andere Cyber-Ereignisse.»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Sachversicherung (opens in a new window), retrieved 06.11.2026

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

The wave of attacks on cold storage since October 2026

Since October 2026, attackers in several European countries have been manipulating refrigeration systems via the internet. In France, Belgium, Sweden and Germany, temperatures in hundreds of supermarkets and at least two butcher’s shops rose to 50 degrees and more; food had to be destroyed.

What we checked (16 findings with sources)

At the beginning of November 2026, a business in Switzerland was hit for the first time: in a butcher’s shop in Köniz, the temperature in the freezer rose to 50 to 70 degrees. The systems affected are refrigeration control systems connected to the internet without protection.

Essentially correct, but not mainly for butcher’s shops. Since 12 October 2026, a wave of attacks on internet-accessible refrigeration control systems (mainly Danfoss, plus Copeland and Dixell) has been under way in Europe: France (more than 230 supermarkets), Belgium and Luxembourg (around 60 supermarkets), Sweden, Germany (Bavaria, North Rhine-Westphalia), plus an attempt at the French blood donation service. Temperatures were set to 50 to 150 degrees, and in Belgium alone goods worth around 100'000 euros were destroyed. Two butcher’s shops are documented: the Belgian chain De Laet en Van Haver and a butcher’s shop in the Upper Palatinate (five-figure loss, discovered in time). Since 05.11.2026, a Swiss case has also been known: at the butcher’s shop Lüthi's Fleischwaren in Köniz, the temperature in the freezer rose to 50 to 70 degrees, some of the meat was as if cooked, and the shop remained closed (V-CH-2026-038). This means that spoiled goods are also documented at a butcher’s shop. By 06.11.2026, the NCSC had published neither a case nor a warning. Before the wave, we found no documented case of this kind.

  • Wave confirmed by the authorities: on 12.10.2026, the French authority CERT-FR reported numerous compromised remote controls of refrigeration systems. The Danfoss AK-SM and AK-SC series as well as Copeland and Dixell xweb are affected. Further attacks are likely. Recommendation: disconnect devices from the internet immediately, check defrost schedules, access only via VPN, update firmware, change default passwords; do not operate devices without updates on the internet any longer. Notable for policyholders: CERT-FR advises checking the insurance conditions before cutting the connection to the refrigeration technician.
    Where does it say so?

    CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 2026-10-12, aktualisiert 13. und 16.10.2026

    «Des campagnes d'attaques sont probablement toujours en cours visant ces équipements.»

    Open document: CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (opens in a new window), retrieved 06.11.2026

  • France, night before 12.10.2026: around 150 Intermarché branches, 80 Carrefour sites and Coopérative U shops. The systems were switched to defrost mode, for around six hours at up to 50 degrees. Meat, frozen goods and vegetables were disposed of. Mostly older Danfoss control systems (AK-SM 800, AK-SC 355) without security updates were affected. The Paris public prosecutor’s office and ANSSI are investigating.
    Where does it say so?

    Cyberangriff auf französische Supermarkt-Kühlschränke: Hunderte Waren verdorben, 2026-10-12

    Open document: Cyberangriff auf französische Supermarkt-Kühlschränke: Hunderte Waren verdorben (opens in a new window), retrieved 06.11.2026

  • Spread up to the beginning of November: Belgium (around 40 Delhaize, 15 Carrefour, 5 Spar, refrigeration units set to 70 degrees, food worth around 100'000 euros destroyed), Luxembourg (Delhaize), Sweden (ICA, Coop; one shop closed temporarily). In France, all thawed goods were disposed of. The Belgian butcher’s chain De Laet en Van Haver also reported attacked refrigeration units. It has not been confirmed whether the same method was used everywhere. The perpetrators and motive are unknown.
    Where does it say so?

    Kühlschränke in Lebensmittelläden weiterer Länder geknackt, 2026-11-02

    «Sämtliche aufgetauten Lebensmittel mussten aus hygienischen Gründen entsorgt werden.»

    Open document: Kühlschränke in Lebensmittelläden weiterer Länder geknackt (opens in a new window), retrieved 06.11.2026

  • Butcher’s shop in the Upper Palatinate (Bavaria): unknown persons set several cold stores to as much as 150 degrees. The manipulation was discovered in time, and the loss is in the five-figure euro range. The Weiden criminal police are investigating for data alteration, computer sabotage and criminal damage. The report does not say whether goods spoiled. The original report of the Bavarian police could not be found (the list loads dynamically).
    Where does it say so?

    Cyberangriff auf Metzgerei: Kühlanlagen manipuliert, 2026-11-04

    «Der entstandene Schaden liegt im fünfstelligen Eurobereich.»

    Open document: Cyberangriff auf Metzgerei: Kühlanlagen manipuliert (opens in a new window), retrieved 06.11.2026

  • Further German cases: Edeka supermarket in Reisbach (Lower Bavaria), refrigeration systems at 50 degrees, a lot of goods disposed of. The police have not yet confirmed a cyber attack. In addition, there are reports from North Rhine-Westphalia of attacks on freezers. The operator defends the internet connection because it enables round-the-clock remote monitoring. The BSI advises disconnecting systems from the internet.
    Where does it say so?

    Cyberangriffe auf Kühlschränke: Erste deutsche Fälle in Bayern und NRW, 2026-11-03

    «Der wichtigste und zugleich einfachste Schutz ist es, die Anlagen vom Internet zu trennen»

    Open document: Cyberangriffe auf Kühlschränke: Erste deutsche Fälle in Bayern und NRW (opens in a new window), retrieved 06.11.2026

  • Spread to other refrigerated goods: at the French blood donation service EFS, during the night before 2.11.2026, attackers set the target temperature of the plasma refrigeration to 110 degrees. A technician intervened in time, and nothing was lost. According to heise, there were also attempts in pharmaceutical distribution.
    Where does it say so?

    Kühlgeräteangriffe: Bis aufs Blut verwundbar, 2026-11-04

    «Die Angreifer sollen die Zieltemperatur auf 110 Grad Celsius gesetzt haben.»

    Open document: Kühlgeräteangriffe: Bis aufs Blut verwundbar (opens in a new window), retrieved 06.11.2026

  • Germany, BSI: cyber security recommendation BSI-CS 154 of 13.10.2026 is aimed at operators of small installations that are not part of critical infrastructure. As an example of application it names the refrigeration of food; this also concerns butcher’s shops, bakeries and shops. The full-text PDF was not opened.
    Where does it say so?

    BSI-CS 154: Gefährdung durch internet-verbundene OT-Systeme, 2026-10-13

    «Diese Cybersicherheitsempfehlung richtet sich insbesondere an Betreiber kleiner industrieller oder vergleichbarer Anlagen»

    Open document: BSI-CS 154: Gefährdung durch internet-verbundene OT-Systeme (opens in a new window), retrieved 06.11.2026

  • Expert criticism of the manufacturers: an IT security expert from Karlsruhe criticises the fact that control systems are delivered and operated with factory settings and default passwords. He calls this «completely unforgivable». From 11.09.2026, the first reporting obligations of the EU Cyber Resilience Act apply.
    Where does it say so?

    Cyberangriffe auf Kühlsysteme: Hersteller in der Kritik, 2026-11-04

    «Es muss nicht alles ins Internet.»

    Open document: Cyberangriffe auf Kühlsysteme: Hersteller in der Kritik (opens in a new window), retrieved 06.11.2026

  • Switzerland: no case known. As of 06.11.2026, the NCSC has published nothing about the attacks on refrigeration systems, neither in the weekly reviews (weeks 40 to 44) nor under «Current incidents» or «In focus». In the half-year report 2026/I, it states that it is not aware of any sabotage against Swiss targets. We consider a spread to Switzerland plausible because the same control systems are sold internationally (own assessment, not documented).
    Where does it say so?

    Halbjahresbericht 2026/I (Januar–Juni), 2026-08, S. 9

    «In Bezug auf die Schweiz sind dem BACS keine Cybersabotageangriffe gegen Schweizer Ziele bekannt.»

    Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

  • The only earlier Swiss butcher’s shop case: Metzgerei Wechsler, Nebikon LU (50 employees), October 2018. Ransomware came in via the router; labelling scales and delivery notes failed, costs around 20'000 francs. Refrigeration was not affected.
    Where does it say so?

    Metzger Wechsler und die Hacker (Magazinbeitrag, PDF bei Compass Security), 2019-01, S. 7

    «Auch die Fleischwaagen sind mit dem System verbunden und darum ausgefallen.»

    Open document: Metzger Wechsler und die Hacker (Magazinbeitrag, PDF bei Compass Security) (opens in a new window), retrieved 06.11.2026

  • Documented vulnerabilities in cold room control systems: Copeland E3 Site Supervisor has a built-in admin account with a predictable daily password (part of «Frostbyte10», Armis, 2025; severity 9.8 out of 10). For Danfoss, Claroty reported vulnerabilities in August 2026, including a hidden login mechanism; this is documented only via heise, and the original report was not opened.
    Where does it say so?

    CVE-2025-6519 (Copeland E3 Site Supervisor), 2025-09-02, Beschreibung, CVSS 3.1: 9.8

    «E3 Site Supervisor (firmware version < 2.31F01) has a default admin user "ONEDAY" with a daily generated password.»

    Open document: CVE-2025-6519 (Copeland E3 Site Supervisor) (opens in a new window), retrieved 06.11.2026

  • Dixell XWEB-500 (Emerson, now Copeland): a vulnerability allows arbitrary files to be written without logging in, up to and including takeover of the device (9.8 out of 10). The product has not been maintained since 2018. CERT-FR counts Dixell and Copeland xweb among the devices affected by the 2026 wave.
    Where does it say so?

    CVE-2021-45420 (Emerson Dixell XWEB-500), 2022-02-14, Beschreibung, CVSS 3.1: 9.8

    «Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability»

    Open document: CVE-2021-45420 (Emerson Dixell XWEB-500) (opens in a new window), retrieved 06.11.2026

  • Before the wave: the closest documented case of a manipulated temperature was a grain drying silo in Canada (hacktivists, 2025). As early as 2013, perpetrators got into Target’s network using login data of a refrigeration and air conditioning technician. At Americold (2023), Bakker Logistiek (2021), JBS (2021) and Arla (2025), ransomware hit the IT, not the refrigeration.
    Where does it say so?

    AL25-016: Internet-accessible industrial control systems (ICS) abused by hacktivists, 2025-10-29

    «where temperature and humidity levels were manipulated, resulting in potentially unsafe conditions if not caught on time»

    Open document: AL25-016: Internet-accessible industrial control systems (ICS) abused by hacktivists (opens in a new window), retrieved 06.11.2026

  • Outlook on AI: the NCSC expects that, with AI, even perpetrators without specialist knowledge will find and manipulate poorly protected control systems. As an example, it cites an AI-assisted attack on a water supply in Mexico (2026). It is not known whether AI was involved in the refrigeration wave.
    Where does it say so?

    Halbjahresbericht 2026/I (Januar–Juni), 2026-08, S. 9–10

    «ungenügend geschützte Systeme opportunistisch zu identifizieren und anschliessend zu manipulieren»

    Open document: Halbjahresbericht 2026/I (Januar–Juni) (opens in a new window), retrieved 06.11.2026

  • First Swiss case (addendum 08.11.2026): at the butcher’s shop Lüthi's Fleischwaren in Köniz, attackers manipulated the control system of the refrigeration and freezer systems; according to the owner, the temperature rose to 50 to 70 degrees. The systems were disconnected from the network and the shop was closed. At Coop, attack attempts were unsuccessful, according to a spokeswoman.
    Where does it say so?

    Update: Angriffswelle auf Kühlanlagen erreicht die Schweiz, 05.11.2026

    «Erstmals ist ein erfolgreicher Angriff auf Kühlanlagen in der Schweiz öffentlich bekannt geworden.»

    Open document: Update: Angriffswelle auf Kühlanlagen erreicht die Schweiz (opens in a new window), retrieved 08.11.2026

  • Not checked (gap): original reports from Reuters, Euronews and NOS as well as the police reports from Bavaria, the reports from Danfoss and Claroty, the full-text PDF of the BSI and figures on openly accessible refrigeration control systems in Switzerland (Shodan). Reason: the session’s web search quota had been used up; the wave is documented via CERT-FR, BSI, heise and Handwerksblatt. A Swiss case may already have happened without having been published.

Real cases

3 more cases

What helps

  • Do not operate the refrigeration control system directly on the internet; remote maintenance only via VPN with two-factor login, change default passwords (ask the refrigeration technician).
  • Fit an independent temperature sensor with SMS alarm to every cold room; alarm also at night and at weekends.
  • Clarify with the adviser whether refrigerated goods are insured after a hacker attack (compare the property and cyber policies side by side); have any gap confirmed in writing.

Before you cut off remote maintenance

  1. CERT-FR advises checking the insurance conditions before disconnecting remote monitoring: some refrigerated goods covers require alarm transmission.

    Where does it say so?

    CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération, 12.10.2026, aktualisiert 13. und 16.10.2026, Recommandations

    «Le CERT-FR a connaissance de nombreuses compromissions des controleurs à distance»

    Open document: CERTFR-2026-ALE-012: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (opens in a new window), retrieved 06.11.2026

Industries affected

Three ways forward