View Ridge Security
Back to Cyber Hose

Ahold Delhaize takes systems offline after cyberattack disrupts stores

Major retailer Ahold Delhaize took systems offline after a cyberattack, while AhsayCBS zero-days and French supermarket fridge hacks also made headlines.

🚨 ACTIVE EXPLOITATION

  • Attackers exploit AhsayCBS backup flaws (CVE-2026-105133/105134) to deploy webshells and XMRig miners
    Threat actors are exploiting two AhsayCBS backup server flaws, including the latest 10.3.4 version, to gain SYSTEM-level remote code execution and deploy webshells and XMRig cryptominers.
    • Affects AhsayCBS cloud backup management console, widely used by MSPs and system integrators; all versions up to 10.3.4 are vulnerable, making the flaws effectively zero-days despite NVD listing 10.3.4 as fixed
    • Chained flaws CVE-2026-105133 (authentication bypass in checkSysPwd, CVSS 5.5) and CVE-2026-105134 (command injection in the Replication Receiver endpoint /rps/api/json/UpdateReceivers.do, CVSS 9.3) yield unauthenticated RCE as NT AUTHORITY\SYSTEM
    • Huntress first observed exploitation October 7, 2026 at 23:20:15 UTC; five organizations were targeted as of October 8
    • Attackers configure a malicious replication receiver, drop JSP webshells into the application web directory, and download Taskgmr.ps1, edge.exe (XMRig), msedge.exe (modified NSSM), and config.json from an Alibaba Cloud Object Storage endpoint
    • Persistence is achieved via a fake MicrosoftEdgeUpdateSvc Windows service running the disguised NSSM binary; one incident used certutil.exe to fetch the vulnerable WinRing0x64.sys driver for kernel-level mining, and an AI-assisted PowerShell script kills Task Manager if left open
    Sources 📄 Source: huntress.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

💥 BREACHES & INCIDENTS

  • Ahold Delhaize takes systems offline after cyberattack disrupts stores in US and Europe
    Ahold Delhaize took systems offline after a cybersecurity incident disrupted its retail brands in the US and Europe.

    • Affects Ahold Delhaize brands: Albert Heijn, Etos, Gall & Gall, and Delhaize in Europe, and Food Lion, Stop & Shop, Giant Food, and Hannaford in the US
    • Websites, apps, and customer service platforms are down; Stop & Shop staff can't access schedules and pay stubs; Food Lion stores may be unable to shop, stage, or hand off orders
    • The company disclosed a 'security issue within its network' on October 12, 2026, taking some systems offline to protect them; stores remain open
    • Security researcher Kevin Beaumont reports the incident is ransomware, the second attack after a November 2024 INC Ransom breach that stole data on 2.2 million people
    Sources 📄 Source: newsroom.aholddelhaize.com · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer, @GossiTheDog@cyberplace.social (+4)

  • Cyberattack defrosts refrigerators at hundreds of French supermarkets via Danfoss controllers
    Hackers hijacked Danfoss refrigeration controllers at hundreds of French supermarkets, forcing defrost cycles that spoiled fresh food.

    • Affected chains include Intermarché, Coopérative U/Super U, Leclerc, Carrefour Market, and Monoprix, with roughly 250–350 stores hit overnight Sunday into Monday.
    • Attackers hijacked Danfoss refrigeration controllers running older control software and triggered the built-in automatic defrost system, raising fridge temperatures up to 50°C for about six hours.
    • The defrost function normally cycles about two hours daily; attackers overrode limits to run it indefinitely, forcing disposal of meat, frozen goods, and produce.
    • CISA warned in May 2025 of a high-severity authentication bypass (CVE-2025-41450) in Danfoss AK-SM 8xxA controllers, and Team82 disclosed a hidden authentication mechanism in August; no confirmed link to the attack yet.
    • Early losses approach €300,000 at some sites and could reach millions nationally; the Paris prosecutor's office has opened an investigation.
    Sources 📄 Source: bfmtv.com · 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

  • Cyberattack heats French supermarket fridges to 50°C, spoiling food at Intermarché and Super U
    A cyberattack on Danfoss refrigeration-control systems forced French supermarket fridges to heat to 50°C, spoiling food stocks.

    • French supermarket chains Intermarché, Super U (Coopérative U), E.Leclerc, and Metro stores were affected, with around 150 Intermarché stores reportedly hit; the attack began overnight October 11–12.
    • The attack targeted Danfoss refrigeration-control systems managing freezers, chilled displays, compressors, and temperature alerts.
    • Attackers reportedly abused the defrost feature in older control software, triggering continuous defrosting that made cooling units heat to 50°C for hours.
    • Confirmed losses at two Haguenau stores alone reached about €270,000, with total damage potentially reaching several million euros; the intrusion method and responsible group remain unconfirmed.
    Sources 📄 Source: bfmtv.com · 📎 Coverage: hackread.com · 👁 via Cyber Security News, cryptika.com (discovered)

  • Ahold Delhaize takes systems offline after cybersecurity incident disrupts retail services
    Ahold Delhaize has taken systems offline in response to a cybersecurity incident affecting its network.

    • Ahold Delhaize, one of the world's largest food retailers with over 9,400 stores in Europe, the US, and Indonesia, disclosed a security issue in its network on October 12, 2026.
    • The company took some systems offline as a protective measure; stores remain open and checkout systems continue working.
    • Disruptions hit Albert Heijn, Etos, Gall & Gall, and Delhaize websites, apps, home delivery, loyalty programs, and customer service, plus US chains Food Lion, Stop & Shop, Giant Food, Hannaford, and The Giant Co.
    • Stop & Shop employees reported trouble accessing schedules and pay stubs; Food Lion's internal memo warned stores may be unable to shop, stage, or hand off orders.
    • The company has not identified an attacker, entry point, or confirmed ransomware; this follows a November 2024 INC Ransom attack that stole data on over 2.2 million individuals.
    Sources 📄 Source: newsroom.aholddelhaize.com · 📎 Coverage: bleepingcomputer.com · 👁 via cryptika.com (discovered)

  • Ledger confirms unauthorized hardware implant in CryptoBilis-sold wallets amid ~$90M fund drains
    Ledger confirmed an unauthorized hardware implant in at least one device sold by reseller CryptoBilis, tied to estimated losses of $86–93 million.

    • Affects buyers of Ledger devices purchased from Southeast Asian reseller CryptoBilis (Indonesia, Malaysia, Philippines) within the last three months; Ledger's own systems and direct sales channels were not compromised.
    • At least one device contained a physical hardware implant that exposed users' recovery phrases, enabling seed-phrase theft and wallet draining.
    • On-chain researchers estimate $72M–$93.2M stolen from roughly 311–315 wallets across Bitcoin, Ethereum, Tron (~$70M in USDT), BNB Chain, Polygon, and Solana; Tether froze ~$10M.
    • CryptoBilis has suspended all hardware wallet sales pending the investigation; company records show the reseller changed ownership in 2026 to an individual with a registered address in China's Heilongjiang province.
    • Ledger is contacting affected users, cooperating with authorities, and reviewing reseller controls and anti-tamper processes; CZ alleged attackers bought the reseller, unverified.
    Sources 📄 Source: x.com · 📎 Coverage: coindesk.com · 👁 via The Hacker News

  • Ledger confirms unauthorized hardware implant in wallet sold by reseller CryptoBilis
    Ledger confirmed an unauthorized hardware implant in a customer's wallet amid ~$93M in thefts tied to reseller CryptoBilis.

    • Affects buyers of Ledger wallets purchased through CryptoBilis, an official reseller serving Indonesia, Malaysia, and the Philippines; Ledger's own store and systems are unaffected.
    • At least one device contained a hidden circuit board behind the Ledger Nano X display with a microcontroller, LTE chip, and eSIM, per Mark Karpelès and Tibane Labs analysis.
    • The implant reads the recovery phrase shown on screen during setup and transmits it over a cellular network, leaving the secure chip and firmware untouched so genuine checks pass.
    • Bitquery estimates $92.9M stolen from 311 wallets: ~$70.5M in USDT on Tron, ~$16.8M in Bitcoin, plus Ether and BNB Chain/Polygon assets; some Ether was routed through Tornado Cash.
    • All confirmed cases tie to the October 9 draining incident; CryptoBilis has halted all hardware wallet sales and Ledger is contacting affected customers with authorities involved.
    Sources 📄 Source: x.com · 📎 Coverage: trendingtopics.eu · 👁 via Cyber Security News, cryptika.com (discovered)

  • Canonical websites hit by second DDoS attack this year
    Canonical's main websites were disrupted by a sustained DDoS attack in October 2026, the second such attack this year.

    • Affected Canonical's primary web properties: ubuntu.com, canonical.com, the Ubuntu blog, developer portal, and Ubuntu security advisory pages and API
    • Developer-facing services including Launchpad, Snap Store, PPAs, and Ubuntu SSO were not impacted
    • Attack confirmed October 8, 2026 on Ubuntu Discourse; total downtime was roughly four hours before services were restored
    • No details on attack size or origin disclosed and no group has claimed responsibility; a larger April attack was claimed by hacktivist group The Islamic Cyber Resistance in Iraq – 313 Team
      📄 <https://discourse.ubuntu.com/t/ddos-on-canonical-and-ubuntu-websites/89064|Source

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check