TL;DR for CISOs: Ahold Delhaize took systems offline after a cybersecurity incident that reportedly reaches U.S. and European banners, attackers reportedly overheated refrigeration controllers across French supermarkets, GitLab shipped a fix for a CVSS 10.0 code execution flaw, and Ledger confirmed a hardware implant in devices sold through one reseller.
- Decide in advance how much to switch off during an unexplained incident, and test whether the business can run in that reduced state.
- Operational controllers and building systems belong in your asset inventory. Several competing retailers appear to have shared one device family and, reportedly, one service provider.
- Developer platforms and purchased hardware are both supply chain. Patch the pipeline server this week and restrict where security hardware is bought.
Lead story: Ahold Delhaize takes systems offline after cybersecurity incident
CRITICAL · RETAIL / OPERATIONSCompany: Ahold Delhaize, which operates more than 9,400 stores across Europe, the U.S. and Indonesia and serves around 60 million customers weekly, per BleepingComputer
What the company said: It is experiencing a security issue within its network and took some systems offline to protect them. All stores are open
U.S. impact reported: Grocery Dive says the websites of all five U.S. banners (Hannaford, Stop & Shop, Giant Food, Food Lion and The Giant Company) were down Monday morning. BleepingComputer reports Stop & Shop employees could not reach schedules and pay stubs, and a Food Lion memo described an IT outage
Europe impact reported: NL Times reports online ordering unavailable for Albert Heijn, Gall & Gall and Etos, loyalty programs offline, and work paused at several Albert Heijn distribution centers, per an RTL Z report of a supplier email. Albert Heijn says product availability will vary by store
Not confirmed: Attacker identity, root cause, whether any data was accessed, whether systems were encrypted, which systems are offline, and the restoration timeline. NL Times says RTL reports signs point to cybercriminals, which is not confirmed
Context: The company disclosed a separate incident in late 2024, which BleepingComputer links to the INC Ransom group and more than 2.2 million people. No link between the two events has been established, per Grocery Dive
What happened
Ahold Delhaize confirmed on October 12 that it had taken some systems offline after a cybersecurity incident. The company has not named a cause. Network problems began Sunday afternoon in the Netherlands, according to NL Times.
The reported effects reach well beyond websites: online grocery orders, loyalty programs, store labeling, supplier deliveries and employee self-service tools. That spread matters more than the headline, because it shows how many routine workflows depend on the same shared systems.
Evidence
Verified against independently fetched sources:
1. BleepingComputer, Ahold Delhaize takes systems offline after cyberattack
2. Grocery Dive, Ahold Delhaize experiencing cybersecurity issue
3. NL Times, Empty shelves likely at Albert Heijn as cyber incident extends to parent's U.S. business
What this means for your team
When the cause is still unknown, the decision that costs the most is how much to shut off. Ahold Delhaize chose containment over availability, and the public record shows stores stayed open while supplier and online channels did not. Whether your own plan lets the business run in that degraded state is worth testing before you need it.
A statement that stores are open can sit alongside a memo telling a store it may be unable to stage or hand off orders. Your frontline and your public message need the same facts, and the gap is where trust is lost.
Action checklist
- Ask your business continuity owners which store, warehouse or branch processes still work when central identity, scheduling or ordering systems are offline, and write the answer down.
- Confirm you can disconnect a business unit or region from shared infrastructure on your own authority, and who decides.
- Check what your supplier and logistics partners are told when you are offline. Albert Heijn's suppliers were reportedly given instructions by email, which is a channel you may also lose.
- Align the internal memo, the customer message and the regulator notice on one set of confirmed facts before the first statement goes out.
Refrigeration controllers hacked across French supermarkets
HIGH · OPERATIONAL TECHNOLOGYWhat was reported: Attackers raised defrost and temperature settings on refrigeration controllers overnight on Sunday, spoiling food. SecurityWeek, citing Reuters, names Auchan, Carrefour, E.Leclerc, Intermarche and Monoprix, and says Cooperative U confirmed several affected stores
Scale reported: BleepingComputer cites French outlets for 250 to 350 stores. SecurityWeek cites BFM TV for more than 300 locations in France and reports Belgium, Germany, the Netherlands, Poland, Portugal and Spain were also affected. These counts are not independently verified
Equipment: Danfoss refrigeration controllers. Security Boulevard, citing AFP, reports Danfoss said most affected equipment was legacy and no longer receives software or security updates. Danfoss itself had not responded to BleepingComputer at publication
Official response: The Paris prosecutor's office opened an investigation, per BleepingComputer. The EU agriculture and food commissioner condemned the attack
Related research: In August, Claroty Team82 published flaws in Danfoss AK-SM 800A controllers, including an authentication bypass (CVE-2025-41450) and post-authentication command injection (CVE-2025-41451), fixed in firmware R4.3.1 per Claroty. No source confirms these were used in this attack
Not confirmed: Attack vector, attacker identity and motive, the full list of victims, total damage, and any link to the Ahold Delhaize incident. BleepingComputer states there is no evidence of a link
What happened
Overnight, refrigeration controllers at supermarkets were reportedly set to heat instead of cool. SecurityWeek, citing a researcher's post, describes target temperatures of 50 degrees Celsius, and says in some equipment temperatures rose for about six hours before staff noticed.
Intermarche said the incident reportedly involved a service provider that manages refrigeration in its stores. If that holds, the common point across several competing chains is a shared third party and a shared device family, not the retailers' own networks.
Evidence
Verified against independently fetched sources:
1. BleepingComputer, Cyberattack shuts down refrigerators at French supermarkets
2. SecurityWeek, Refrigeration controller hack spoils food across European supermarkets
3. Security Boulevard, Supermarket chains in Europe feel the heat of cyberattacks
What this means for your team
Most security inventories stop at servers, laptops and cloud accounts. A refrigeration controller that can be reached from a management portal is a business-critical asset with a physical failure mode, and it is often owned by facilities or a contractor.
The unusual detail is the monitoring gap. If hot air in a freezer was how staff noticed, the alerting design assumed attackers would not touch setpoints. For any sector that holds perishable, regulated or temperature-sensitive stock, such as food, pharma and healthcare, that assumption needs a second look.
Action checklist
- List every internet-reachable building, refrigeration and facilities controller, including those managed by vendors, and name an owner for each.
- Identify equipment that no longer receives security updates and set a replacement or isolation date.
- Move management interfaces behind a VPN or allow-list, and ask each managed-service provider how remote access to your sites is authenticated.
- Add independent temperature alarms that do not rely on the controller's own settings, and test them.
GitLab fixes a CVSS 10.0 code execution flaw in its CI/CD regex compiler
CRITICAL · DEVELOPER PLATFORMFlaw: CVE-2026-97229, an integer overflow in the CI/CD regular expression compiler, rated CVSS 10.0 in GitLab's release notes. A crafted regular expression in a CI/CD configuration could let an unauthenticated user execute code on the server, per BleepingComputer
Affected: GitLab CE and EE self-managed instances on 19.2 before 19.2.8, 19.3 before 19.3.5 and 19.4 before 19.4.2, per GitLab. BleepingComputer lists 19.3.4 as the fixed 19.3 build. GitLab's notes say 19.3.4 had a merge request page bug fixed in 19.3.5, so use 19.3.5
Not affected: GitLab.com is already patched. GitLab Dedicated customers need no action
Release: Patch release on October 12 covering 24 CVEs: 1 critical, 5 high, 15 medium and 3 low
Exploitation: Neither source reports exploitation of this flaw. BleepingComputer notes CISA added a different GitLab flaw (CVE-2026-85706) to its exploited catalog one day after that disclosure
Credit: Reported by researcher joaxcar through GitLab's HackerOne program
What happened
GitLab released versions 19.4.2, 19.3.5 and 19.2.8 on October 12 and urged all self-managed customers to upgrade immediately. The critical issue sits in how the platform validates regular expressions inside pipeline configuration.
A prior GitLab maximum-severity flaw was added to the CISA exploited list within a day of disclosure, according to BleepingComputer, so the usual comfort period between patch and attack should not be assumed here.
Evidence
Verified against independently fetched sources:
1. BleepingComputer, GitLab warns of max-severity RCE flaw in regex compiler engine
2. GitLab, Critical patch release 19.4.2, 19.3.5, 19.2.8
What this means for your team
A source code platform holds repository secrets, deployment credentials and the pipeline that ships production changes. Code execution on that server is a route to all three, which is why this class of flaw deserves emergency handling even before exploitation is reported.
The two sources disagree on one fixed version number, a small example of why upgrade tickets should cite the vendor advisory and not a news summary.
Action checklist
- Identify every self-managed GitLab instance, including test and acquired-company instances, and record its version.
- Upgrade to 19.2.8, 19.3.5 or 19.4.2 or later. Plan downtime for single-node systems, since migrations must finish before startup.
- Where patching has to wait, restrict who can reach the instance and who can edit CI/CD configuration.
- After patching, review audit logs and runner activity for unexpected pipeline edits and rotate secrets stored in the instance if you see any.
Ledger confirms a hardware implant in devices sold through one reseller
NOTABLE · SUPPLY CHAIN / CRYPTOWhat Ledger confirmed: One impacted user's device contained an unauthorized hardware implant, and all user reports of unexpected fund drains were linked to devices sold through reseller CryptoBilis, per BleepingComputer. Ledger described the affected volume as limited
Losses: Protos reports that analysts Specter and Tanuki42 estimated losses between $72 million and more than $86 million. These are analyst estimates. Ledger has not published a total, and BleepingComputer gives no dollar figure
Implant description: Researchers cited by BleepingComputer describe a component placed behind the screen or under the battery that captured the display and button presses and sent the seed phrase over an LTE connection. This comes from Mark Karpeles and Tibane Labs, not from Ledger
Ledger guidance: Buyers from this reseller who have not set up the device should not do so. Those who have should move assets to a new signer with a new seed. Ledger says its Genuine Check cannot detect an added implant if the original secure element is intact
Not confirmed: How and when devices were tampered with, who is responsible, the number of users affected, and whether other resellers are involved. BleepingComputer says there is no indication of other resellers so far
What happened
Ledger first said it was investigating on October 9 and confirmed hardware tampering on October 10, according to BleepingComputer. It told CryptoBilis to pause sales and shipments, per Protos.
Security researcher Taylor Monahan, quoted by Protos, warned that phishing, fake ads and fraudulent apps are targeting users trying to migrate funds, so the clean-up has its own risk.
Evidence
Verified against independently fetched sources:
1. BleepingComputer, Ledger confirms hardware wallet spy implant behind crypto thefts
2. Protos, Ledger says Southeast Asia reseller linked to $86M draining
What this means for your team
This is a physical supply chain compromise, and the vendor's own authenticity check reportedly cannot catch it. Any organization that buys security hardware, hardware wallets, tokens or network gear through secondary channels carries the same blind spot.
For companies holding digital assets or running treasury operations, the lesson is procurement discipline: the discount that makes a reseller attractive can be the signal.
Action checklist
- Confirm that security tokens, hardware wallets and network devices are bought only from the manufacturer or named authorized distributors, and record the approved list.
- If your organization or its executives hold Ledger devices, check the purchase channel and follow Ledger's guidance on devices bought through CryptoBilis.
- Inspect packaging and tamper evidence on receipt for high-value hardware, and keep a record of serial numbers.
- Warn staff who migrate funds that scammers are using the news to push fake apps and ads.
Also notable
- iRhythm: at least 360,000 people notified of a June breach of third-party-hosted business applications. Exposed data includes names, addresses, dates of birth and phone numbers. The company says it has no evidence of identity theft use. Source: SecurityWeek (single source reviewed).
- Bricksforge WordPress plugin: CVE-2026-85097 (CVSS 9.8) is being exploited, with attempts first seen by Patchstack on October 7. Versions up to 3.1.8.9 are affected, and 3.1.8.10 fixes it. Patchstack estimates about 6,000 sites use the plugin. Source: SecurityWeek (single source reviewed).
- Nippon Columbia: a malware infection at the contractor exposed customer and employee records tied to Daiichi Kosho. Reporting cites roughly 8.6 to 8.7 million records, and the figure is not yet settled. Source: BleepingComputer homepage listing (single source reviewed).
- Anthropic says it took risky AI cybersecurity evaluations offline after models used in tests reached U.S. government websites. Source: BleepingComputer (single source reviewed).
Frequently asked questions
What happened at Ahold Delhaize?
The company confirmed on October 12 that it took some systems offline after a cybersecurity incident. Stores remained open, but U.S. banner websites, Dutch online ordering and loyalty programs were reported down. Cause, attacker and data impact have not been confirmed.
Which brands are affected by the Ahold Delhaize incident?
Reporting names Albert Heijn, Etos and Gall & Gall in the Netherlands, Delhaize in Belgium, and Hannaford, Stop & Shop, Giant Food, Food Lion and The Giant Company in the U.S. The extent of disruption varies by brand.
How were French supermarket refrigerators attacked?
Reports say attackers changed defrost and temperature settings on Danfoss refrigeration controllers overnight. The entry method has not been confirmed, and Danfoss said most affected equipment was legacy hardware that no longer receives updates.
Which GitLab versions fix CVE-2026-97229?
GitLab 19.2.8, 19.3.5 and 19.4.2 or later. GitLab.com is already patched and Dedicated customers need no action. Neither source reports exploitation of this flaw.
What should a CISO do first this week?
Confirm GitLab versions and upgrade, inventory internet-reachable operational controllers, test whether the business can run with central systems offline, and verify the purchase channel for security hardware.
Curated by Pritha Aash, Community Head, CISO Platform
Subscribe to the weekly newsletter
More from the Breach Intelligence hub, including our look at the SonicWall SMA1000 flaw under attack, plus vulnerability management and third-party risk coverage on CISO Platform.
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments