Cyber insurance: the events of the week from 31 October to 7 November 2026

Five cyber events from the week of 31 October to 7 November 2026, from the new wave of attacks on European supermarket refrigeration systems to Crédit Mutuel Arkéa, Chainalysis, DigiCert and Queens Public Library, linked by exposed systems and suppliers used as the way in. With the insurance impact and the questions to bring to renewals.

Week of 31 October to 7 November 2026

The week of 31 October to 7 November 2026 has a common thread: systems left exposed, sometimes for years, that become the way in. In Europe a second wave of attacks hits supermarket refrigeration systems running outdated software and default passwords, as far as Sicily. In France a cooperative bank loses around 100 million euros through a supplier's platform. A certificate authority finds that an internal system stayed reachable from the internet for more than 16 months, and a blockchain analytics company admits that the late-October attack also exposed customer passwords. For underwriters of cyber risk, the question is not only whether the insured has fixed known vulnerabilities, but whether it knows which systems it actually has exposed.

In brief

Refrigeration systems in Europe: overnight from 1 to 2 November a new wave hits supermarkets in Belgium, Sweden, Ireland, the Netherlands, Portugal, Estonia, Finland and Italy; on 4 November ENISA, the European Commission, Europol and the CSIRTs Network publish a joint statement.
Crédit Mutuel Arkéa: on 4 November the bank confirms an attack that enabled fraudulent transactions; the loss is in the order of 100 million euros, converted into cryptocurrencies.
Chainalysis: on 4 November the company confirms that the late-October attack also exposed a subset of customer passwords; several products remain offline.
DigiCert: an internal system stayed exposed to the internet for more than 16 months; between 27 June and 2 July an unauthorised account viewed archived customer data, possibly including identity documents.
Queens Public Library: from 4 November ransomware takes down the website, app, self-service checkout, computers and Wi-Fi across the 66 branches of the New York library system.

The attacks of the week

1. Refrigeration systems: the second wave in Europe

Overnight from Sunday 1 to Monday 2 November 2026 cyberattacks hit supermarket refrigeration systems in several European countries. In Belgium units were switched to defrost mode, heating instead of cooling: several dozen Delhaize stores, 15 Carrefour stores, between 10 and 15 Intermarché stores and 5 Spar stores were affected. In Sweden, at an ICA store, temperatures were set to 50 °C and the goods were thrown away. In Ireland Musgrave pulled chilled and frozen products from 13 SuperValu stores as a precaution. Cases were also reported in the Netherlands, Portugal, Estonia, Finland and Italy, where at least four Coop supermarkets of the Radenza group in Sicily were hit (The Hacker News).

The method recalls the 11 October attacks on hundreds of French supermarkets, which exploited Danfoss AK-SM 800 and AK-SC 355 controllers no longer updated by the manufacturer. The CERT-FR alert also covers Copeland and Dixell xweb devices. Danfoss said the systems hit in the Netherlands were not on a secure network and still used default passwords. No one has claimed the attacks; the Belgian cybersecurity centre said the culprit may never be identified, and the Belgian federal prosecutor has opened an investigation (same source).

On 4 November ENISA, the European Commission, Europol's cybercrime centre, the EU CSIRTs Network and EU-CyCLONe published a joint statement on incidents in commercial refrigeration systems in several Member States, calling for exposure to be reduced immediately. The statement does not attribute the attacks (ENISA).

2. Crédit Mutuel Arkéa: around 100 million out of the bank's own account

On 4 November 2026 Crédit Mutuel Arkéa, a cooperative banking group that includes Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and Fortuneo, confirmed a cyberattack that enabled «la réalisation d'opérations frauduleuses», describing the incident as under control. Some transactions were suspended as a precaution, delaying transfers. According to Le Télégramme about 118 million euros were taken; the bank has not confirmed the figure. The funds were reportedly moved to other accounts and exchange platforms and converted into cryptocurrencies; Kraken and Crypto.com reportedly blocked accounts linked to the movements. The bank says the incident will have no financial consequences for customers (Le Monde Informatique).

The bank then explained that the attackers went through the platform of one of its suppliers, not named, and used the bank's own account to send transfers to other banks, without touching customer accounts. It described a sophisticated external attack, ruling out internal human error, and confirmed only the order of magnitude of the loss, which could exceed 100 million euros. No one has claimed the attack (DH).

An expert quoted by the same source raises the question that matters for the market: if the supplier also serves other banks, the risk does not concern a single institution.

3. Chainalysis: from emails to passwords

On 30 October 2026 Chainalysis, a blockchain analytics company, had reported an attack, stating that it was unrelated to the Binance theft. The first analysis indicated that only user IDs, names, emails and roles were exposed, with no access to credentials or session tokens. On 4 November the company confirmed that an «on-path» attack had also exposed a subset of customer passwords, and that the vector had been contained. Reactor, Data Solutions and Chain (Beta) were shut down as a precaution; KYT, the other address screening products and the login page were taken down because of abnormal activity, and at the time of the article were partly restored. Chainalysis required all users to reset their passwords and asked customers to rotate API keys. No group has claimed the attack (TechRadar).

The damage does not stay with Chainalysis: customers use KYT and the other products to screen transactions and addresses, and an outage of those services means suspended or manual checks on their side.

4. DigiCert: 16 months of unnoticed exposure

On 6 November 2026 it emerged that DigiCert, a certificate authority, suffered access to archived customer data. In February 2025 an internal business system was moved from a VPN-protected network to another zone, becoming reachable from the internet; it stayed that way for more than 16 months. The system had a self-registration feature that let anyone create an account without multi-factor authentication, and a permissions flaw let those accounts browse archived data. DigiCert found the unauthorised accounts on 18 June 2026 but considered them harmless; on 2 July it closed the registration; on 19 October it confirmed that an account had viewed a subset of records between 27 June and 2 July (The Register).

Names, business emails, phone numbers and addresses are involved; some records may contain passports, driving licences or utility bills supplied for identity verification. DigiCert has not stated how many customers are affected and says that its certificate authority operations, CertCentral and DigiCert ONE were not touched, with no evidence of certificates issued, revoked or validated by the unauthorised account (same source).

5. Queens Public Library: 66 branches without systems

On 4 November 2026 the Queens Public Library in New York reported a system-wide network outage, later attributed to ransomware. The following day the website and app, the checkout and return machines, renewals, branch computers and free Wi-Fi were down; the 66 branches stayed open. The library is working with the New York Police Department, federal partners and outside experts; the police are working with the FBI. Neither the group responsible nor whether data was stolen has been disclosed, and there is no date for restoration (NY1).

Other events worth noting

Binance (cryptocurrencies): on 31 October the FBI attributes the 6.3 billion dollar theft to the North Korean group TraderTraitor; on 1 November the exchange reopens withdrawals in phases and within hours records a net outflow of 3.6 billion, 2.1% of assets.
Amadeus (air transport): the airlines involved in the access to the reservation system rise to at least 15; on 3 November Singapore Airlines reports about 46,000 records, Condor confirms international flight data and Qantas is checking its own exposure.
Synology (technology): the C3RB3R group encrypts NAS devices running outdated DSM versions, exploiting flaws fixed between late 2024 and September 2026.
QNAP and Plex (technology): QNAP reports NAS devices compromised through the four Plex2Shell flaws in Plex Media Server and warns that updating does not remove programs already installed by the attackers.

Insurance impact

The common picture is unmanaged exposure: devices and systems reachable from the internet that the insured does not control or does not know it has. For each event, the possible impact on policies can be read as follows.

Refrigeration systems. Coverages potentially triggered: damage to third-party property and spoiled goods, business interruption, incident response. Accumulation potential: very high, because the same controllers are installed in thousands of stores in several countries. Contractual issue: physical damage from a cyber event, which can fall between the cyber policy and the property policy, and any exclusions for unsupported systems.
Crédit Mutuel Arkéa. Coverages potentially triggered: computer fraud and fraudulent funds transfer, incident response. Accumulation potential: medium to high if the supplier serves other banks. Contractual issue: the boundary between crime and cyber policies for the direct loss of funds, and the supplier's role in the chain of liability.
Chainalysis. Coverages potentially triggered: business interruption, liability towards customers, notification. Accumulation potential: medium, for customers that depend on transaction screening services. Contractual issue: dependent business interruption at customers and the length of the product outage.
DigiCert. Coverages potentially triggered: notification, privacy liability, incident response. Accumulation potential: low for the data, but worth watching given the issuer's central position. Contractual issue: an exposure that began in 2025 and was discovered in 2026, against the retroactive date and the date of discovery.
Queens Public Library. Coverages potentially triggered: restoration, service interruption, extortion, notification. Accumulation potential: low. Contractual issue: the extra costs of keeping public services open while systems are down.

Cyber damage becomes physical. Attacks on refrigeration systems destroy goods and can damage equipment. It is a scenario that tests the definitions of physical damage and the exclusions in cyber and property policies.

The supplier is the way in. Crédit Mutuel Arkéa points to a supplier's platform, and Chainalysis is itself a supplier to many operators. The risk moves from the insured to its dependencies.

Exposure lasts longer than the attack. DigiCert left a system reachable for 16 months and the supermarket controllers have been out of support for years. The inventory of exposed systems and the dates of discovery matter more than the single attack.

What to bring to renewals

Does the insured have an inventory of control devices (refrigeration, air conditioning, building systems) reachable from the internet, and who manages them?
Are devices no longer supported by the manufacturer isolated from the public network, and have default passwords been changed?
Does the policy cover damage to property and goods caused by a cyberattack, or does it defer to the property policy?
How are direct losses of funds from fraudulent transfers treated, and which policy responds between crime and cyber?
Which suppliers have access to the insured's payment systems or accounts, and with what controls?
How does the insured check that a network or configuration change does not expose internal systems to the internet?
Which external services are essential to the insured's legal obligations, such as transaction screening, and what happens if they stop?

On the portfolio side, it is worth mapping insureds in large-scale retail and cold-chain logistics that use exposed controllers, and treating suppliers of banking platforms and transaction screening services as shared accumulation points.