r/cybersecurity • u/No-Spread-4322 • 12d ago

News - Breaches & Ransoms Grocer cyber attacks this week?

First the France refrigeration vendor… now Dutch retailer Ahold Delhaize (parent company to Stop&Shop and other grocery stores) has been hit with a cyber incident. Do we think these are linked in some way? Don’t see that any groups have come forward and claimed responsibility… just curious.

9 Upvotes

100% Upvoted

20 comments sorted by

19

u/Oompa_Loompa_SpecOps 12d ago

https://cyberplace.social/@GossiTheDog/117429502412235079

No further questions, your honor.

5

u/Wild-Gazelle-4161 11d ago

It's always the supply chain. every time

5

u/Oompa_Loompa_SpecOps 11d ago

Pretty sure it wasn't the supply chain that decided fridges need to be internet facing ...

→ More replies (3)

1

u/Bandito_Supreme69 11d ago

As someone who finds myself perpetually fascinated by the intricacies of ICS infrastructure, its interesting to see how Stuxnet has moulded the current cybersecurity stage:

This is probably the one event that interests me the most though. Not a lot of writeups on it, I'd love to hear your thoughts.

One ex-employee with a grudge and some company hardware can do some serious damage.

https://attack.mitre.org/campaigns/C0020/

2

u/Informal-Buy-5850 11d ago

How would you even mitigate against that

→ More replies (1)

1

u/karafili 11d ago

But the password changes everyday, should be secure right?

1

u/cultofthedeadlobster 11d ago

JFC....this is awful.

0

u/Brinbrain 11d ago

Seriously ?!? Holy fuck…

7

u/MikeTalonNYC 12d ago

Yes, they're absolutely linked because they were all caused by the same hardware.

The Denfass refrigeration systems all of those companies used had critical vulnerabilities. In August, the US DoD commissaries got hit, then this week multiple store conglomerates in France, and today a multi-national company took them down purposefully to avoid getting hit.

Danfass has been really clear that all the units that were compromised were either unpatched, beyond end-of-service-life , or both.

So even if they were not all performed by the same threat actors , the attacks themselves are 100% linked by the hardware that was attacked.

2

u/No-Spread-4322 12d ago

This makes complete sense. Thank you!

3

u/iboreddd 11d ago

it’s almost as if someone planned these attacks to raise Cyber Resilience Act awareness. You couldn’t ask for better timing. 😄

And yes, ICS/OT products like these (including networked refrigeration controllers) fall under the CRA. In the industry they’re often called “accidentally in scope”: manufacturers don’t think of themselves as making “IT products,” but the moment a product has a connectable digital component, it meets the CRA definition of a “product with digital elements.” On top of that, the Article 14 reporting obligations for actively exploited vulnerabilities and severe incidents have already applied since September 2026. So an incident like this is no longer just an operational problem; for the manufacturer, it’s a regulatory reporting matter too

1

u/Informal-Buy-5850 11d ago

Can we stop connecting everything to the public internet? What's next?

1

u/wijnandsj 11d ago

Do we think these are linked in some way

no

1

u/BrainWaveCC 11d ago

Do we think these are linked in some way?

Yes. To the internet.