Security
Ahold Delhaize's Distribution Centres Stopped, Not Just Its Websites. In France, the Freezers Went the Other Way
Ahold Delhaize disclosed a network security issue on Monday morning, by which point work had already halted at several Albert Heijn distribution centres and US staff could not reach their schedules. The same weekend, attackers remotely warmed refrigeration cases in hundreds of French supermarkets — two unrelated incidents that both bypassed the customer database and went straight for the food.
MAI
Ahold Delhaize told the market at 08:29 Amsterdam time on Monday that it was "experiencing a security issue within its network," that its teams were assessing and mitigating it, and that this included taking some systems offline. The statement ran a few sentences and carried a notice that it contained inside information under Article 7(1) of the EU Market Abuse Regulation. By the time it went out, work had already stopped at several Albert Heijn distribution centres.
That sequence is the story. The retailer's websites and apps going dark is the visible part, and it is the part that gets written up. The part that will decide how much this costs is that trucks stopped moving on a Sunday night.
What is down
| Market | Brands | What is affected |
|---|---|---|
| Netherlands | Albert Heijn, Etos, Gall & Gall | Websites, apps, loyalty programmes and online ordering unavailable; shelf-edge signs still showing last week's prices |
| Belgium | Delhaize | Websites and apps affected |
| United States | Food Lion, Hannaford, Stop & Shop, Giant Food, The Giant Company | Staff unable to reach schedules and pay stubs; an internal Food Lion memo described an IT outage that could stop stores shopping, staging or handing off orders |
| Logistics | Albert Heijn distribution centres | Work halted at several sites. Per an email to a supplier obtained by RTL Z, only the Zaandam centre was still running, with suppliers asked to deliver there on pre-booked slots |
Ahold Delhaize runs more than 9,400 stores across Europe, the United States and Indonesia. Albert Heijn has told customers that availability will vary store by store depending on deliveries, that shelf-stable goods should hold up reasonably well, and that fresh fruit and vegetables are the exposure. It has not said when services will be restored. Shares closed down 3.15% at €31.38 on Euronext Amsterdam, near a 52-week low of €30.335 and well off the €42.54 high set in March.
Nobody has claimed the attack and the company has not said whether anything was encrypted or taken. The last time Ahold Delhaize disclosed an incident — November 2024, claimed by INC Ransom — the damage was data: personal, financial and health information on more than 2.2 million people in its US business. This one reads differently. A data breach is discovered after the fact and litigated for years. An outage that takes out warehouse management, supplier scheduling and workforce systems degrades the business the same afternoon, and keeps degrading it for as long as replenishment runs by hand.
France, the same sector, the other layer
Separately, and with no indication the two are connected, attackers spent the night of 11–12 October changing temperature setpoints on remotely managed refrigeration controllers in French supermarkets. BFM Business reported roughly 150 Intermarché stores affected. Coopérative U's chief executive, Dominique Schelcher, confirmed publicly that the chain was hit and called the attack unprecedented. Employees at Carrefour Market, Monoprix and E.Leclerc locations reported the same pattern; those chains have not commented. Freezer cases that should sit near −20°C were pushed well above freezing, and early internal estimates put the loss as high as several hundred thousand euros per store.
The equipment involved is made by Danfoss. In August, Claroty's Team82 published research on the Danfoss AK-SM 800A refrigeration system manager, covering an authentication weakness, a command injection issue and a web-server configuration flaw — CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452. Danfoss shipped fixed firmware. Claroty also cited a Censys scan that found 2,765 of these management interfaces reachable from the open internet. Whether those specific flaws were used in France is unknown, and no one has established it.
What is established is the shape of the exposure. A refrigeration manager is not something a grocery chain's security team tends to inventory. It is bought with the store fit-out, commissioned by a refrigeration contractor, given a public IP so the contractor can support it, and then left alone for a decade. It also has direct physical authority over stock worth more than the server it runs on.
What to take from it
Two incidents in one weekend, in two countries, at two different layers, and in both cases the thing that hurt was not the customer database. It was the equipment and the systems that move food.
For the operational side, the actions are unglamorous and already documented: get Danfoss AK-SM 800A units onto current firmware, take refrigeration and building-management interfaces off the public internet, and put them behind a VPN on a segmented network. The vendor advisories carry the details, and a two-month-old patch on an internet-facing controller is a decision, not an accident.
For the enterprise side, the Ahold Delhaize outage is a live argument for working out in advance which systems you would run manually. Warehouse slot booking, supplier notification, shelf pricing and payroll are not the systems that get tabletop exercises, and they are the four that visibly broke here.
Sources: Ahold Delhaize newsroom · BleepingComputer · NL Times · RetailDetail EU · Help Net Security · Je bosse en grande distribution · Claroty Team82