TL;DR
On the same Sunday, hackers cooked the freezers at roughly 700 French supermarkets, and Ahold Delhaize pulled its US grocery sites offline. The freezers ran on controllers nobody had patched. Ahold’s loyalty program couldn't work once the app went down. If you run a grocery chain, label every connected box in your stores before somebody’s phone rings at 4 AM. My to-do list is below.
Cyril Scheubel manages a large Intermarché outside Dijon, and around 4 a.m. Monday, a surveillance company called to tell him his freezers and cold rooms were warming up. He drove straight in. When he opened the freezers, he found hot air coming out where the cold should have been.1
France’s finance minister later told Parliament that roughly 700 of the country’s 10,000 supermarkets got hit the same way. Hackers raised refrigerator temperatures to about 50°C (122°F) for about six hours, and stores dumped the food in dumpster loads.2
That same Sunday, Ahold Delhaize spotted a cybersecurity incident of its own and pulled the Food Lion, Hannaford, Stop & Shop, and Giant Food websites and apps the next morning. Ahold says it sees no reason to connect its problem to the French attack, and I’m taking them at their word.3
The two failures still share something. A freezer controller and a loyalty app both broke, and in each case nobody had decided ahead of time what the store should do next.
Who patches a freezer?
Danfoss supplied the refrigeration software, and it said most affected systems were older products that no longer received security updates.4 ANSSI, France’s cybersecurity agency, reported numerous compromised control modules from Danfoss and from US-based Copeland. Claroty had flagged flaws in the Danfoss AK-SM 800A and Copeland XWeb Pro platforms before the attack, and both vendors had already shipped fixes.5
So the patches existed. I’d love to know whose job it was to install them, because a rack controller sits in an awkward spot on the org chart. The vendor sold it, a refrigeration contractor services it, facilities pays the bill, and IT may not even know it is on the network.
I’ve argued here before that the back room is where grocery tech pays off, with predictive maintenance and shrink prevention beating another shopper-facing chatbot every time. That payoff depends on wiring up equipment that used to sit alone on a concrete floor, and wired equipment needs somebody’s name on it.
The same symptoms showed up on US bases
In late August, at least six US military commissaries confirmed refrigeration outages within days of each other, including Fort Huachuca in Arizona. They threw out thousands of dollars’ worth of meat, dairy, produce, and frozen food. The commissary agency’s refrigeration contract specifically required equipment that could be monitored and controlled remotely.6
Army CID’s Cyber Field Office and the Air Force Office of Special Investigations both confirmed they’re investigating. The Pentagon has acknowledged a “possible refrigeration disruption” and nothing more. Nobody has named a cause or tied it to France.
Ahold’s loyalty program went dark with the app
Ahold kept its stores, pharmacies, and gas stations open and promised refunds for digital orders that never processed. Then the Stop & Shop outage page apologized and pointed shoppers to DoorDash, Instacart, and Uber Eats.7
Ahold’s own website handed its fastest-growing channel to the platforms that keep the customer data when the order is done.
Ahold Delhaize’s US digital sales rose more than 14% last quarter while comparable-store sales grew less than 1%.8 Over in the Netherlands, competitors reported a bump in delivery orders while Ahold’s sites were down.9
Shoppers also can’t access their loyalty accounts on the websites or apps, so they can’t redeem the rewards that justify choosing Giant or Hannaford over the store down the road. Can a Giant shopper give a phone number at the register this week and still redeem points? None of the coverage I’ve read answers that, or whether anyone designed a fallback.
Most households already spread their grocery run across a few stores. A week without points just sends them to another store more often.
This is also Ahold's second major cyberattack in two years. The November 2024 incident affected more than 2 million US customers and disrupted deliveries, payments, pharmacies, and the banners’ online portals.
Somebody has to write the 5 AM plan
Cyril Scheubel learned from a surveillance company’s 4 AM. phone call, and by then the food was already lost. A store needs a plan before that call comes. If I ran a grocery chain, I’d finish this list before the holidays:
Count the boxes. List every network-connected device in your stores, from refrigeration controllers and HVAC to electronic shelf labels and scales, and put one person’s name next to each.
Get the refrigeration and any other critical controllers off the open internet. Danfoss itself tells customers to run these systems behind a firewall. Ask facilities which controller models you run, check them against the vendor advisories, and budget to replace anything the vendor no longer patches.
Put patching in the service contract. Your refrigeration contractor already walks every store, so firmware updates and a quarterly report should be part of the job.
Unplug one controller on purpose. Pick a store, pull the network cable, and watch whether the local alarms still fire and whether the night crew knows the manual override.
Give loyalty an offline mode. A cashier should be able to find a member by phone number and apply rewards at the register when the app is down, and shoppers should hear about it on day one of an outage.
Settle the aggregator question now. If your outage page will send shoppers to Instacart or DoorDash, negotiate today for the order data to come back to you.
Run the drill. Put a store manager, your CISO, and your head of facilities in one room and walk through the first two hours of an operations attack. You’ll find out fast which questions nobody can answer.
Most of this costs a few meetings and some contract language. The hard part is getting facilities and IT to agree on who picks up the phone at 4 AM.
The Paris prosecutor’s cybercrime unit is still adding up the spoiled food and the fires. On Friday morning, Ahold’s US banner sites were still down, and they were still giving customers to the marketplaces.
“France investigates cyberattack that hacked retailers’ refrigeration systems.” NPR News: https://www.npr.org/2026/10/15/nx-s1-6001732/france-investigates-cyberattack-that-hacked-retailers-refrigeration-systems
“Ahold Delhaize’s web shutdown enters fifth day.” Supermarket News: https://www.supermarketnews.com/grocery-technology/ahold-delhaize-s-web-shutdown-enters-fifth-day
“Cyberattack hits French store fridges, sparks fires.” The Canberra Times: https://www.canberratimes.com.au/story/9367218/cyberattack-hits-french-store-fridges-sparks-fires
“Cyberattack targeting refrigeration systems hits 700 supermarkets.” ABC News: https://abcnews.com/Business/wireStory/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-137230099
“Cyberattacks hit European supermarket chains and disrupt refrigeration systems.” News 4 JAX: https://www.news4jax.com/business/2026/10/13/cyberattack-targeting-refrigeration-systems-hits-700-supermarkets-french-government-says
“Commissaries across the US affected by refrigeration outages.” Stars & Stripes: https://www.stripes.com/theaters/us/2026-08-28/refrigeration-outages-multiple-us-commissaries-22684428.html
“Ahold Delhaize’s web shutdown enters fifth day.” Supermarket News: https://www.supermarketnews.com/grocery-technology/ahold-delhaize-s-web-shutdown-enters-fifth-day
“The Friday Checkout: Ahold Delhaize’s digital disaster is a customer retention nightmare.” Grocery Dive: https://www.grocerydive.com/news/the-friday-checkout-ahold-delhaizes-digital-disaster-is-a-customer-retent/833220
“Cyberattack hits French store fridges, sparks fires.” The Canberra Times: https://www.canberratimes.com.au/story/9367218/cyberattack-hits-french-store-fridges-sparks-fires