Business Insurance

When the Freezer Gets Hacked: Insurance Gaps Florida Businesses Should Know

Posted on by webbuilder in Blog, Business Insurance |

From McGriff-Williams Insurance, an independent agency in Gainesville since 1983. Where confidence grows.

When most business owners picture a cyberattack, they think of locked computers, stolen customer data or a ransom note. In October 2026, an attack in France showed that a hack can reach something far more physical: the freezer case.

If you run restaurants or retail locations in Florida, own apartment or commercial buildings, store goods cold, or install and service building controls, this story is worth a few minutes. The bigger lesson isn’t about technology. It’s about which insurance policy, if any, pays when a hack ruins your inventory. We’ll walk through what happened, where the gaps can be, and the questions to bring to your next coverage review.

What Happened in France

On the night of Sunday, October 11, into Monday, October 12, 2026, attackers remotely accessed the refrigeration controls at hundreds of supermarkets across France. Reported counts vary, from at least 350 stores to roughly 700, according to news reports.

According to public reporting, the attackers reached controllers that were connected to the internet. They switched refrigerated and frozen cases into defrost mode, removed the limits that normally keep temperatures in check, and set some cases to around 122°F (50°C). Early findings suggested alarms were disabled or avoided. Cases ran hot for roughly four to six hours before morning staff discovered the problem. Food thawed and began to cook. A few stores reported small fires, which set off sprinklers and caused water damage.

Most stores stayed open. They threw out affected product, restocked, and recovered within hours to about a day. The losses still added up. One chain’s leadership estimated about €50,000 in losses for an average store. Another reported up to €200,000 for a single large hypermarket, and industry leaders said the total could reach tens of millions of euros.

Several things were still unknown as of mid-October 2026:

  • Who did it. No one had claimed responsibility, and investigators had not publicly named a suspect. Attribution remains unconfirmed.
  • Exactly how. Officials had not publicly confirmed the precise method used to get in.
  • Why. The motive is unknown. No ransom demand was reported.

The Paris prosecutor’s office opened a cybercrime investigation, and France’s national cybersecurity agency warned that attack campaigns were probably still underway. Equipment makers said many affected units were older models that no longer receive security updates. Security researchers also pointed to devices left exposed to the public internet and, in some cases, apparent default passwords. France’s economy minister called it “a wake-up call for everyone.”

Why It Matters Here in Florida

Grocery stores, restaurants, convenience stores and cold-storage facilities here can rely on connected refrigeration controls, and some are monitored remotely by a refrigeration contractor. That’s convenient, but it also creates a door into the system that needs to be locked.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published advisories describing security flaws in commercial refrigeration controllers, along with available fixes. Whether those particular flaws played a role in France has not been confirmed. Either way, the risk isn’t limited to Europe.

Here’s how the lesson can apply to the Florida businesses we work with:

  • Multi-unit restaurants and retail. If one remote connection reaches the coolers at several of your locations, one bad night could mean spoiled stock at all of them at once. That can change how your deductibles and waiting periods apply.
  • Real estate and apartments. If your buildings use connected HVAC, access or other building controls, ask who can reach those systems remotely, and whose policy would respond if a shared system were tampered with.
  • Wholesale and light manufacturing. If you hold product in coolers or freezers, the same question applies: what happens to the inventory if the temperature controls are changed remotely?
  • Contractors who install or service controls. If your team has remote access to customers’ refrigeration, HVAC or building systems, your customers may start asking how that access is secured and what insurance stands behind it.

The Surprise: Whose Policy Pays for the Spoiled Food?

French grocery leaders said publicly that their insurers had told them this kind of loss was not covered. Insurance brokers told Reuters that cyber policies typically exclude physical losses. Here’s why that gap can exist in the U.S. as well:

  • Many cyber policies exclude physical damage. Spoiled food is tangible property. A cyber policy may pay for investigating the hack but not for the inventory you had to throw away.
  • Many property policies now exclude cyber events. In recent years, insurers have added cyber exclusions to many commercial property forms.
  • Spoilage coverage often has narrow triggers. Spoilage coverage is commonly tied to a mechanical breakdown or a power outage. In France, the equipment did what it was told to do. Whether a remote change to temperature settings counts as a “breakdown” depends on your policy wording.

The result is that the largest dollar loss, the spoiled stock, can fall between policies. French insurance commentators noted that lost profit on unsold goods might be recoverable in some cases, while the cost of the discarded stock itself might not be.

Fire can be different. Some property policies cover a fire that results from a cyber incident, and others don’t.

What a Cyber Policy May Help With

Depending on its terms, a cyber policy may still help pay for:

  • Forensic investigation to find out how the attackers got in
  • Restoring and reconfiguring affected systems
  • Some lost income while systems are down, usually after a waiting period
  • Legal and public relations help
  • Extortion costs, if a ransom is demanded

A lot depends on how your policy defines your “computer system.” Some definitions include equipment like refrigeration and building controls. Others may not, especially if a vendor owns or operates the device.

Questions to Ask About Your Coverage

Bring these questions to your next insurance review:

  1. Does my cyber policy treat connected equipment, like refrigeration, HVAC or building controls, as part of my computer system?
  2. Does it include any coverage for physical damage or spoiled inventory caused by a hack?
  3. Does my property or spoilage coverage exclude cyber events? If so, is any coverage given back?
  4. What triggers my spoilage coverage? Is it only mechanical breakdown or power outage?
  5. If 20 of my locations are hit in the same night, how do my deductibles and waiting periods apply?
  6. Does my policy have a war or state-sponsored attack exclusion, and how would it apply if a government blamed another country?

Don’t Forget Your Vendors

In France, discussion quickly turned to who was responsible for securing the equipment. Ask yourself:

  • Who has remote access to your refrigeration and building systems?
  • Does your service contract say who is responsible for security, updates and passwords?
  • Does your vendor carry insurance that could respond if its access is used in an attack?

France’s government cybersecurity alert also offered a useful reminder: check your insurance contract conditions before cutting off your refrigeration contractor’s remote monitoring connection. Some policies or service agreements may require that monitoring, so check with your agent and your contractor first.

We can help with the paperwork side of this, too. For property owners, we can review the insurance requirements in your leases. That review looks only at insurance terms. It isn’t legal advice, so have your attorney review the lease itself.

Practical Steps to Consider This Month

Talk with your refrigeration contractor and IT provider about these steps, drawn largely from French and U.S. government cybersecurity guidance:

  1. Make a list of every connected refrigeration and building controller you have, with make, model and software version.
  2. Get them off the open internet. Remote access should run only through a secured connection.
  3. Update or replace outdated units. Equipment that no longer gets security updates is hard to protect.
  4. Change default passwords and remove accounts nobody uses.
  5. Check defrost schedules and temperature limits, especially after any suspicious activity.
  6. Add an independent temperature alarm that doesn’t rely on the controller itself.
  7. Set an overnight plan so someone gets the alert and knows what to do.

If you’d like a starting point, ask us about our cyber risk assessment. It’s a review of your cyber exposures and how your insurance lines up with them, not a technical security audit or certification, so keep working with your IT provider and refrigeration contractor on the steps above.

If It Happens to You

Work with your refrigeration contractor and IT provider to cut off outside access to the affected systems, keeping your policy and contract conditions on remote monitoring in mind. Document everything: photos of cases, temperature readings, and a log of every item you discard with its cost. Notify your insurance agent and insurance companies promptly under every policy that might apply, including cyber, property and any spoilage or equipment breakdown coverage. Report the incident to law enforcement (for U.S. businesses, the FBI’s Internet Crime Complaint Center at ic3.gov).

Frequently Asked Questions

Does cyber insurance pay for food that spoils after a hack?
Often not. Many cyber policies exclude physical damage, and spoiled food is tangible property. A cyber policy may still help with investigation, system restoration and some lost income. It depends on your policy wording.

Would my spoilage coverage pay instead?
Maybe. Spoilage coverage is commonly tied to a mechanical breakdown or a power outage. Whether a remote change to temperature settings counts as a breakdown depends on the wording, and some property policies exclude cyber events altogether.

Was the French attack ransomware?
There’s no sign it was. No ransom demand was reported, no one had claimed responsibility, and attribution was unconfirmed as of mid-October 2026.

What should I do first?
Make a list of your connected refrigeration and building controls, ask who can reach them remotely, and review your cyber, property and spoilage coverage together, not one at a time.

Let’s Look at the Whole Picture

The lesson from France is that cyber, property and spoilage coverage can’t be reviewed in isolation. They need to work together. McGriff-Williams Insurance is an independent insurance agency serving Florida businesses from Gainesville. We can review your cyber, property and spoilage coverage side by side, help you spot possible gaps, and talk through your options in plain English. There’s no obligation.

Call (352) 371-7977 or request a quote.

McGriff-Williams Insurance
3501 W University Ave, Gainesville, FL 32607
(352) 371-7977 · Monday–Friday, 9 AM–5 PM
mcgriffwilliams.com

This article is for general educational purposes only and is not legal advice. Insurance coverage depends on the actual terms, conditions, limits and exclusions of each policy. Nothing here changes any policy or promises that any loss is or will be covered. Details of the French incident are based on public reports as of mid-October 2026 and may change as investigations continue.

Sources

Is Your Business Covered for AI Liability? Most Aren’t — and That’s a Problem.

Posted on by McGriff Williams in Business Insurance, Insurance |

By now, artificial intelligence has worked its way into nearly every corner of the business world. Companies are using AI tools to create content, generate proposals, automate customer service, analyze data, and streamline workflows. The efficiency gains are real — but so are the risks. And most businesses haven’t stopped to ask a critical question: What happens when AI gets it wrong?

The Risks Are Already Here

AI tools like ChatGPT and similar platforms are powerful, but they are not infallible — and the mistakes they make can carry real consequences. Consider a few scenarios that are not so much hypothetical:

  • Copyright and Trademark Infringement. AI-generated content can inadvertently reproduce protected material. If your business publishes that content — in an ad, a proposal, or on your website — you could be on the hook for infringement claims, even if you had no idea that the info was pulled from a protected source.
  • AI tools can generate false information that reads as fact. If that content damages the reputation of an individual or another business, you could face a defamation lawsuit.
  • Financial Harm. AI-generated analysis, recommendations, or reports that a client relies on — and that turn out to be incorrect — can create significant liability exposure for your business.
  • Unauthorized Data Disclosure. AI systems that process customer or employee information can inadvertently expose sensitive or confidential data, triggering privacy-related claims.
  • Bodily Injury or Property Damage. In industries where AI information can influence physical decisions — construction, healthcare, engineering, logistics — acting on flawed AI recommendations could have real-world consequences that go far beyond a financial dispute.

Who’s at Risk?

Here’s the important distinction if you’re thinking this doesn’t apply to you: this isn’t just a technology company problem.

AI liability risk touches businesses across virtually every industry. If you use AI tools in your operations — even off-the-shelf software like automated chatbots, content generators, or workflow platforms — your business may have an exposure that your current insurance program doesn’t address.

Most general liability policies were not written with AI-generated content or AI-assisted decision-making in mind. Professional liability and E&O policies may cover some scenarios, but they often have gaps when it comes to the specific ways AI can create harm. The result is that many businesses are operating with a meaningful coverage gap they don’t know exists.

What’s the Solution?

The insurance market has responded to this emerging risk with a product specifically designed for it: Generative AI Liability Coverage.

This coverage is built for companies using AI in their day-to-day operations — not just for the tech firms building the AI tools themselves. It’s designed to address the unique exposures that come with integrating generative AI into business processes, including many of the scenarios described above.

This is a new product in a fast-moving space, and coverage terms, availability, and eligibility vary. But the window to get ahead of this risk — before a claim makes it urgent — is NOW.

Don’t Wait for a Claim to Start the Conversation

The liability landscape around AI is evolving quickly. Courts are still working through many of the legal questions, regulators are paying close attention, and plaintiffs’ attorneys are already identifying AI-related claims as a growing area of opportunity.

The businesses that will fare best are the ones that take a proactive look at how they’re using AI today and make sure their insurance program keeps pace with those activities.

If your company uses AI tools in any capacity, we encourage you to reach out and have a conversation about what your current coverage does — and doesn’t — include. We’re here to help you understand your exposure and make sure you’re protected.

Small Business Insurance New Year, New Risks – Why Your Policy Needs a January Review

Posted on by McGriff Williams in Business Insurance, Tips |

Why Small Business Owners Should Review Their Commercial Insurance Coverage

The start of a new calendar year is more than just a fresh page—it’s a critical moment for small business owners to assess and adjust their operations. Your small business insurance policy should be at the top of this review list. As your business evolves, so do the liabilities you face, and inadequate commercial insurance coverage can leave your company exposed to financial loss.

January: The Best Time for a Business Insurance Audit

Why kick off the year with an insurance review? Your business operations in the previous year often involve changes that directly impact your risk profile:

  • Growth and Expansion: Did you hire new employees, increase inventory, or lease a larger office space?
  • New Equipment/Assets: Purchasing new machinery, technology, or vehicles changes the value of your assets that need protection.
  • Updated Services or Products: Launching a new offering may introduce professional or general liability risks not covered by your current policy.
  • Changing Regulations: New state or industry-specific compliance requirements might necessitate different forms of business liability insurance.

Key Areas to Update in Your Small Business Insurance Policy

A thorough January review helps identify gaps in your protection. Focus on these critical types of small business insurance:

1. General Liability Insurance (GLI)

Did your client interactions or on-site foot traffic increase last year? General liability insurance protects against claims of bodily injury or property damage for which your business could be held responsible. Verify that your current liability limits align with your updated exposure, especially if you moved to a new location or handle more high-value projects.

2. Commercial Property Insurance

This coverage protects the physical assets of your company—buildings, equipment, inventory, and supplies. Review the following:

  • Inventory Value: If sales surged, your current coverage limits might undervalue your stock, leaving you under-indemnified after a loss event.
  • New Asset Valuation: Have you purchased new computers, manufacturing equipment, or furniture? Update your asset schedule to reflect the current replacement cost.
  • Business Interruption Coverage: Has your revenue increased? This vital component, often bundled with property insurance, must reflect your current profitability to adequately cover lost income following a covered peril.
3. Workers’ Compensation Insurance

If your employee count changed, or if roles shifted to include higher-risk duties, your Workers’ Comp insurance classifications and premium will need an adjustment. Failing to accurately report payroll and job functions can lead to penalties or claims issues down the line.

4. Professional Liability (E&O) and Cyber Insurance

For service-based businesses (consultants, IT, marketing agencies), Professional Liability Insurance (Errors & Omissions) is crucial. If you begin offering new, higher-risk services (e.g., handling client data, providing complex advice), re-evaluate your limits.

Furthermore, with cyber threats rising, all small business owners should review their Cyber Liability Insurance to confirm it covers data breaches, regulatory fines, and business interruption from a cyber-attack.

Your Action Plan for a January Insurance Review

Don’t wait until a claim occurs to discover a coverage shortfall. Follow these steps to optimize your commercial insurance in the new year:

  • Document All Changes: Create a detailed list of new hires, large asset purchases, revenue changes, and any new services/products from the past 12 months.
  • Contact Your Broker: Schedule a dedicated review with your small business insurance agent or broker to discuss the documented changes.
  • Compare Quotes: The market is always changing. Use the new year as a trigger to quickly compare business insurance quotes to confirm you are getting competitive rates for the required coverage.
  • Confirm Deductibles: Verify that your current deductibles are financially manageable for your business.

Protecting your assets with the right coverage is a foundational element of a strong business plan. Start the year right by securing comprehensive small business protection.

ADA Website Compliance: What Florida Business Owners Need to Know

Posted on by McGriff Williams in Business Insurance, Human Resources, Insurance |

As insurance advisors, we want to make you aware of an emerging legal trend that’s affecting businesses across the state of Florida: lawsuits alleging that business websites fail to comply with the Americans with Disabilities Act (ADA).

Over the past year, Florida businesses—particularly in North Florida—have been hit with a wave of federal lawsuits claiming their websites aren’t accessible to individuals with visual impairments. These lawsuits often cite technical issues like:

  • Images lacking proper descriptive text for screen readers
  • Improper tab navigation order
  • Phone numbers listed as plain text rather than clickable links
  • Links that open new tabs without announcing the transition
  • Missing descriptive labels on form elements

What’s particularly concerning is that businesses are being sued without warning or the opportunity to fix their website. Many business owners discover they have a problem only once they’re served with a lawsuit.

Most business owners assume their General Liability or Business Owner’s Policy will cover these lawsuits. Unfortunately, standard commercial insurance policies do NOT typically provide coverage for ADA website compliance claims.

Some EPLI policies provide coverage for “Third Party” discrimination claims, which can include disability discrimination under the ADA. However, there are important limitations:

What EPLI May Cover:

  • Legal defense costs (often the most significant expense)
  • Settlement amounts or judgments for monetary damages

What EPLI Typically Does NOT Cover:

  • Costs to actually fix your website accommodations and make it ADA compliant
  • Injunctive relief expenses
  • Punitive damages (which are generally uninsurable under Florida law)

Important Considerations:

  • EPLI policies often have higher deductibles/retentions (commonly $15,000-$25,000)
  • Defense costs may erode your policy limits rather than being provided in addition to limits
  • Coverage is subject to policy terms, conditions, and exclusions
  • Some claims may be settled for less than your deductible, meaning you’d pay out of pocket anyway

So what now? Some practical steps to protect your business are:

1. Make Your Website ADA Compliant NOW

2. Review Your Insurance Coverage

3. Document Your Compliance Efforts

4. Don’t Ignore the Issue

Not always will a plugin fix ADA compliance issues. There’s a chance your site will need to be rebuilt if ADA requirements weren’t considered from the start. One tool you can try is this scan: https://adascan.dev to get a better idea of where your site is currently.

If you have questions about your coverage or want to discuss your specific situation, please don’t hesitate to reach out. We’re committed to helping you protect your business and navigate these complex insurance issues.

Is Insurance Enough? continued… The value of HR Support

Posted on by McGriff Williams in Business Insurance, McGriff-Williams News |

Recently, we introduced the idea that a good insurance policy may not be fully sufficient if youre striving for true, overall risk management of your business. If you missed that message, you can catch up here.

There are lots of approaches you can take, in a non-insurance way, to gain confidence in your companys long-term stability. The first one well dig into is HR Support.

HR Support can be defined as any of the following:

  • Onboarding and Termination
  • Job Description Builder/Postings
  • Employee Retention
  • Benefits Management
  • Employee Leave and Time Off
  • Compensation and Bonus Structures
  • Employee Handbooks
  • State and Federal Regulations
  • Safety and Health in the Workplace
  • Tax Filing, Credits, Compliance, etc
  • Retirement Planning and Exit Strategies

There are resources, such as the program we use for our partners and clients, called Mineral (formerly Think HR) that provide countless tools for topics such as these. If you aren’t currently putting effort into these assessments… That have nothing to do with your insurance coverage You may be at a higher risk than you realize. And keeping a good team smoothly operating is too valuable to chance that.

Were happy to help guide you through some of these things when you’re ready. And don’t miss our next deep dive in the Is Insurance Enough? A Riveting Series: Part 3 where well talk about ERISA Compliance.