# Hacked supermarket fridges hit 50°C in France > Plus Ahold Delhaize pulls systems offline, and Albert Heijn's app and deliveries go dark - Series: It's Probably Nothing - Publisher: Sierra Echo Charlie - Edition date (Pacific/Auckland): 2026-10-13 - Edition number: 1 - Status: Published edition - Language: en-NZ - [Canonical web edition](https://ipn.nz/editions/2026-10-13) - [Download PDF](https://ipn.nz/pdf/IPN-2026-10-13.pdf) - [MP3 audio](https://ipn.nz/audio/IPN-2026-10-13.mp3) (3:25, 3274336 bytes) - [Standalone transcript](https://ipn.nz/transcripts/2026-10-13.md) ## Opening Both of today's stories come from the grocery aisle. As far as anyone has said publicly, they aren't connected. One of them has attackers turning supermarket freezers into something closer to ovens, which wasn't on my bingo card for this week. ## 1. Attackers push French supermarket fridges into forced defrost, reportedly up to 50°C Overnight on 11–12 October, French time, someone got into the refrigeration controls at a lot of French supermarkets and triggered forced defrost cycles. Reporting that cites BFMTV says set-points went as high as 50 degrees Celsius, which is less a defrost and more a slow cook. Fresh and frozen stock had to be destroyed. This one is properly confirmed. Dominique Schelcher, chief executive of Coopérative U, said on X that a cyberattack had affected refrigeration production systems at several Coopérative U stores since the previous night. He added that an investigation would be needed to establish what happened. AFP reports that Intermarché and Coopérative U told it the attack made their fridges defrost. AFP also reports that Paris prosecutors confirmed the attack. The store count depends on who you read. BFMTV said about 150 Intermarché stores. AFP has 150–200 Intermarché stores and almost 100 Coopérative U outlets. The French trade outlet Points de Vente puts it at about 300 Intermarché stores and fewer than 100 Coopérative U stores, plus E.Leclerc stores. Citing another outlet, it says Monoprix and Carrefour Market stores were reportedly involved too. Points de Vente also reports that fires broke out at some sites. This is the rare OT incident with straightforward physical damage. Nobody can argue it was just IT spillover when the stock is in the skip. The Danfoss angle is where everyone will head next. Points de Vente reports that the attackers took control of a Danfoss refrigeration regulation system, which the chains use as a common supplier. Points de Vente also relays a Danfoss response through BFMTV reporter Raphaël Grably: the targeted models were obsolete or had not been updated. Nobody has publicly confirmed how the attackers got in, who they are or whether a known vulnerability was used, so it's too early to pin it on any particular Danfoss CVE. My own speculation: when competing chains are hit through the same supplier's kit on the same night, it smells more like a remote-management or vendor-access problem than a store-by-store compromise. That's a hunch, not a finding. ### Worth asking If you look after remotely managed refrigeration controllers in grocery, cold chain or anywhere else, this is a good week to work out exactly what can reach them and whether anyone would notice a set-point jumping to 50 degrees Celsius at 3am. ### Qualifications Store counts vary between outlets. The fires come from Points de Vente reporting. The intrusion route, the attacker and any specific vulnerability involved remain unconfirmed. ### Sources - [Cyberattack Manipulates Refrigeration at French Supermarkets, Destroying Fresh Stock (Mallory)]() — reporting/context - [Cyberattaque sur les systèmes frigorifiques de plusieurs enseignes – Points de Vente]() — reporting/context - [French supermarket chains say cyberattack forced refrigerator shutdown (AFP via malware.news)]() — reporting/context - [Attackers Reportedly Hack Supermarket Fridges and Raise Temperatures to 50°C]() — reporting/context ## 2. Ahold Delhaize takes systems offline; Albert Heijn's app, website and deliveries go down Separately, Ahold Delhaize put out a release on 12 October, tagged as a regulatory press release. It says the company is experiencing a security issue within its network and is taking some systems offline to protect them. Stores are open and serving customers. In the Netherlands, DutchNews reports that Albert Heijn's website, app and home delivery service became unavailable. Etos and Gall & Gall were affected as well, and customer service and logistics systems were offline. Tills kept working, but personal discounts and app-linked savings were paused. Electronic shelf labels might still be showing last week's offer prices. That small detail says a lot about how much of a modern supermarket lives in the back end. Across the Atlantic, Grocery Dive reports that the websites of all five of the company's US banners were down on Monday morning. The disclosure doesn't name an attacker or an entry point, and it doesn't say whether ransomware or data theft is involved. Taking systems offline as a precaution across two continents at once usually isn't a minor thing, but that's me reading tea leaves. We'll know more when they say more. ### Qualifications The cause, the attacker and any data impact are all unconfirmed. The statement is dated but not timed. ### Sources - [Ahold Delhaize Takes Systems Offline After Cybersecurity Incident, Disrupting Digital Services (Mallory)]() — reporting/context - [Ahold Delhaize takes precautionary measures following cybersecurity incident]() — primary source - [Albert Heijn app and deliveries down after "IT incident"]() — reporting/context - [Ahold Delhaize experiencing cybersecurity issue]() — reporting/context - [Ahold Delhaize Takes Systems Offline Following Cybersecurity Incident]() — reporting/context ## Audio transcript Narrated using an AI voice. Hey, it's It's probably nothing. Both of today's stories come out of the grocery aisle, and as far as anyone's said publicly, they aren't connected. One has attackers turning supermarket freezers into something closer to ovens, which wasn't on my bingo card this week. So, France. Overnight on the eleventh into the twelfth, French time, someone got into the refrigeration controls at a lot of French supermarkets and triggered forced defrost cycles. Reporting citing BFMTV says set-points went as high as fifty degrees Celsius. Less a defrost, more a slow cook. Fresh and frozen stock had to be destroyed. This one's properly confirmed. Coopérative U's chief executive, Dominique Schelcher, said on X that a cyberattack had hit refrigeration systems at several of their stores since the previous night, and that an investigation would be needed to establish what happened. AFP says Intermarché and Coopérative U told it the attack made their fridges defrost, and that Paris prosecutors confirmed the attack. The store count depends on who you read. BFMTV said about a hundred and fifty Intermarché stores. AFP has a hundred and fifty to two hundred Intermarché, plus almost a hundred Coopérative U. The trade outlet Points de Vente goes higher, around three hundred Intermarché, plus E. Leclerc, and citing another outlet, says Monoprix and Carrefour Market stores were reportedly involved too. Points de Vente also reports fires broke out at some sites. It's the rare OT incident with straightforward physical damage. Nobody can call it IT spillover when the stock's in the skip. The Danfoss angle is where everyone's heading next. Points de Vente reports the attackers took control of a Danfoss refrigeration regulation system the chains use as a common supplier, and relays a Danfoss response, via BFMTV reporter Raphaël Grably, that the targeted models were obsolete or hadn't been updated. Nobody's publicly confirmed how they got in, who they are, or whether a known vulnerability was used, so it's too early to pin it on any particular bug. My own speculation: competing chains hit through the same supplier's kit on the same night smells more like a remote-management or vendor-access problem than store-by-store compromise. That's a hunch, not a finding. If you look after remotely managed refrigeration controllers, grocery, cold chain or anywhere else, it's a good week to work out exactly what can reach them, and whether anyone would notice a set-point jumping to fifty degrees Celsius at three in the morning. Separately, Ahold Delhaize put out a regulatory release on the twelfth saying it's experiencing a security issue within its network and taking some systems offline to protect them. Stores are open. DutchNews reports Albert Heijn's website, app and home delivery went down, Etos and Gall and Gall were hit too, and customer service and logistics systems were offline. Tills kept working, but personal discounts were paused, and electronic shelf labels might still be showing last week's offer prices. Which says a lot about how much of a modern supermarket lives in the back end. Grocery Dive reports the websites of all five US banners were down on Monday morning too. The disclosure doesn't name an attacker or entry point, or say whether ransomware or data theft is involved. Pulling systems offline across two continents at once usually isn't minor, but that's me reading tea leaves. We'll know more when they say more. That's your lot for today. Catch you next time. Don't forget, all our threat intelligence comes from Mallory dot A I. If you want intelligence your team can act on, reach out for a chat. ## Publisher Researched by our AI agents using [Mallory](https://mallory.ai) and original sources. Reviewed and published by [Sierra Echo Charlie](https://sierraechocharlie.com). Want intelligence your team can act on? [Reach out for a chat.](mailto:letsgo@sierraechocharlie.com)