When a supermarket experiences a cyber attack, the obvious concerns might be compromised systems or stolen data. But what if the attackers also gain control of its connected freezers, change their temperatures and spoil stock worth thousands?
While it sounds unusual, cyber risk is increasingly heading in this direction. Cybercriminals are designing attacks to overstep the cyber reality and deal real-world, physical damage – and it’s easy to see why.
Across industries, physical equipment is being connected to digital systems. Modern manufacturing has robotic arms on the factory floor linked to centralized software. Healthcare involves medical equipment that transmits telemetry to hospitals in real time. And in retail, fridges and freezers can keep produce fresh and safe to eat – until an attacker turns them into ovens.
As cyber attacks move into the physical world, the potential consequences are changing too. So what do brokers – and businesses – need to know about the changing face of cyber threats, and how can cyber insurance respond when attacks cause physical damage?
An unpredictable threat landscape
The motive behind most cyber attacks becomes clear sooner or later, whether that’s stealing data, extorting a ransom or making money through fraud. The recent spate of fridge and freezer attacks is different. They’ve involved no ransomware demand or obvious financial payout for the attacker, making the goal harder to understand – and the wider cyber threat landscape harder to predict.
For businesses, the unforeseen twists and turns of cyber threats mean having the right protection in place is more important than ever. And that’s where the fridge and freezer attacks raise another key question: if a cyber event causes physical loss or damage, will their cyber insurance respond? It's an exposure that may require businesses to look beyond standard cyber cover, and consider protection built around their specific risks.
Testing boundary lines of cover
Insurance has traditionally drawn clear distinctions between different types of risk. Cyber insurance is built around cyber events, while physical damage has typically sat elsewhere. But attackers don’t operate within those boundaries. A cyber event can begin with compromised technology and end with spoiled stock, damaged equipment or an unusable premises, putting pressure on insurance programs designed when those risks were easier to separate.
Deciding whether a loss is “cyber” or “property” is a reactive, temporary fix. Instead, it pays to get on the front foot. By looking at where technology controls or connects to physical assets, brokers and businesses can begin testing how their policies would respond before the technology is actually compromised. This way, they can begin to build cover around their complete exposure.
Building cover around the risk
Cyber insurance is well placed to fill the gap. Good cyber cover already looks beyond the immediate digital impact of an attack, providing support for legal fees, business interruptions costs and more. Businesses with specialist, unique risks can go one step further, designing cover to fit their exact needs.
At CFC, businesses can access specialist options for physical losses following a cyber event. The property damage extension can cover the cost of repairing or rebuilding premises and replacing damaged contents or stock, while the stock spoilage endorsement can reimburse the reasonable cost of replacing perishable goods spoiled as a result of an attack. They won’t be relevant to every business, but they can be particularly valuable for sectors such as retail, hospitality, manufacturing and food and beverage, where connected technology controls physical assets, equipment or perishable stock.
So how well do your clients understand their exposure? Helping them identify where a cyber attack could have physical consequences is a key first step, building a clear picture of the risks to put protection in place that matches their exposure.
Get in touch with any questions on CFC’s cyber insurance and our property damage extension or stock spoilage endorsement.
