Published October 18, 2026

6 min read

Michael GreenFounder & Lead Technologist · York Tech Services

GIANT Cyberattack Update: Ahold Delhaize Faces Major Costs as European Refrigeration Hacks Spread

UPDATED NOVEMBER 10, 2026

GIANT's website and mobile app returned on October 20 following a cyber incident at parent company Ahold Delhaize. Since then, the company has disclosed a substantial expected financial impact. Meanwhile, another wave of cyberattacks has disrupted supermarket refrigeration systems across Europe, including stores operated by Delhaize, another Ahold Delhaize brand.

There is no publicly established link between the October Ahold Delhaize corporate network incident and either wave of refrigeration attacks.

The food supply is now a target through the systems that preserve and move it. Across Europe, attackers have manipulated supermarket refrigeration controls, spoiling food and forcing stores to discard inventory. This is a more direct threat than a website outage: when attackers reach connected equipment that controls temperature, a cyberattack can put the food itself at risk.

GIANT's October outage was a separate corporate network incident that disrupted online services and parts of Ahold Delhaize's operations. No public evidence links it to the European refrigeration attacks. Together, the incidents expose two distinct points of vulnerability in a modern food retailer: the digital systems used to sell and distribute food, and the physical systems required to keep it safe.

GIANT's Website and App Are Back, but the Financial Impact Is Significant

On October 12, 2026, Ahold Delhaize confirmed a cybersecurity issue and took parts of its network offline as a protective measure. The resulting outages affected websites, mobile apps and online services across a number of its U.S. and European grocery brands. Physical stores remained open.

GIANT's website and app resumed service at approximately 9 a.m. on October 20, according to WGAL's reporting. GIANT stores, pharmacies and fuel stations continued operating during the outage. The company's broader recovery was not instantaneous, however.

On November 4, Ahold Delhaize provided the most concrete assessment yet of the October incident's business consequences. It forecast a €200 million to €250 million reduction in fourth-quarter net sales and a €75 million to €100 million reduction in underlying and IFRS operating income. These are company estimates of expected impact, not final audited losses, and they relate to the October corporate cyber incident, not the later refrigeration attacks.

The company said most operational disruption was contained within two weeks, but that work to fully restore normal operations was continuing. In its October 19 update, Ahold Delhaize said investigators had confirmed malicious activity and that it had no evidence at that point that sensitive customer, associate or partner information had been taken. No public attribution of the October 2026 Ahold Delhaize network intrusion has been established.

For a business of this size, even a limited period of interrupted digital ordering and distribution can translate into significant lost sales and operational expense.

A Second Wave of Refrigeration Hacks Hits Europe

While Ahold Delhaize was responding to its network incident, an unusual form of cyberattack was already unfolding in France.

Overnight on October 11–12, attackers interfered with remotely managed refrigeration controllers at approximately 700 French supermarkets, according to French authorities and cybersecurity researchers. Some systems were forced into defrost cycles or had temperature settings manipulated. Stores reported spoiled inventory and major financial losses.

Then, on November 2, similar incidents emerged across Europe. Supermarkets and other food businesses in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands and additional countries reported refrigeration malfunctions. Reporting and security research put the second wave at more than 100 affected retail locations across multiple countries, although counts varied as incidents were investigated.

Among the affected retailers were Carrefour, ICA, Coop and Delhaize. That last name is important: Delhaize belongs to the same Ahold Delhaize group that owns GIANT. Reuters reported that refrigeration incidents affected dozens of Delhaize stores in Belgium and Luxembourg, with operations subsequently returning to normal.

In some stores, refrigeration controls were reportedly pushed toward 50°C (122°F), far beyond safe food-storage conditions. Temperatures and damage varied by location, but affected stores had to remove or destroy perishable inventory.

The attacks also reached beyond grocery aisles. Researchers reported affected refrigeration systems at French medical facilities, with no evidence that blood products were spoiled. Three British meat suppliers were also affected, but their trade association reported no loss of meat.

Important distinction: On November 9, France attributed the October 11–12 attacks in France to Iran's Islamic Revolutionary Guard Corps (IRGC). That attribution concerns the French wave; responsibility for the separate November 2 wave has not been publicly established. Neither wave has been publicly linked to Ahold Delhaize's October 12 corporate network incident. The timing and the fact that Delhaize stores were affected by the later wave do not establish a connection.

How Could Hackers Control a Supermarket Freezer?

Commercial refrigeration is increasingly managed by network-connected control equipment. These systems help stores monitor temperatures, detect failures, reduce energy costs and allow specialist contractors to adjust equipment without traveling to every location.

That convenience can become a risk when a management interface is reachable directly from the public internet.

France's national cyber incident response team, CERT-FR, warned in October of compromises involving Danfoss AK-SM and AK-SC refrigeration controllers and Copeland/Dixell XWEB systems. Its guidance urged operators to remove management interfaces from public internet exposure, review configurations, apply vendor security recommendations and restore remote connectivity only through protected access methods such as a secured VPN.

Some affected product families have known security vulnerabilities, and older equipment may no longer receive updates. Security researchers have also warned about weak or default passwords and improperly configured remote access. The precise entry method used in each attack has not been publicly confirmed, so it would be inaccurate to say a specific vulnerability caused every incident.

Once an attacker has control of a refrigeration management interface, even ordinary functions can be misused. Turning on a defrost cycle, changing a temperature setting or disabling an alarm can damage inventory without the attacker needing to deploy ransomware on a store's computers.

Thousands of Controllers Were Still Exposed Online

The scale of the problem is not limited to the stores that have already reported damage.

In measurements through November 5, cybersecurity firm Censys reported that the number of publicly reachable hosts associated with two refrigeration-controller product families had fallen from 6,695 on October 9 to 3,124 on November 5, a 53% decline. The decrease followed the attacks and warnings, but Censys cautioned that its measurements cannot establish exactly why the systems disappeared from public view.

Separately, Palo Alto Networks' Unit 42 identified more than 5,000 internet-exposed devices from manufacturers named in the French advisory during November 5–6. Its measurements included devices in the United States. These findings use different collection methods and should not be combined into one total.

Just as importantly, an internet-exposed controller is not automatically a compromised controller. The exposure figures describe reachable equipment, not a count of successful attacks.

Still, they demonstrate why the issue extends beyond Europe. Businesses everywhere depend on remote access to physical equipment, often with responsibility split among a store, its IT team, equipment manufacturers and third-party service providers.

What This Means for Food Supply Security

Ahold Delhaize's October incident and the refrigeration attacks highlight two different ways technology failures can disrupt the food business.

One affected online services and parts of a major retailer's distribution operations. The other demonstrated that attackers can interfere directly with the physical conditions needed to preserve food. Neither establishes that GIANT's refrigeration equipment was hacked, and there is no verified report of that happening in Pennsylvania as part of these incidents.

The same risk extends to any industry that uses connected systems to monitor or control physical operations. Hospitals, utilities, water and wastewater operators, manufacturers, transportation networks, warehouses and commercial buildings all depend on digital systems that can affect services, equipment or safety. The consequences vary by system, and an internet-connected device is not automatically critical or compromised. But poorly secured access to operational technology can allow an intrusion to disrupt services, interrupt production or alter physical processes.

Organizations should maintain an inventory of operational technology, assign clear responsibility for securing it, and limit connections between control systems and business networks to what operations require. Remote access should use named accounts, multifactor authentication where supported, and access rules appropriate to the task and provider. Operators should keep supported equipment updated, plan for unsupported systems, and test incident-response and manual fallback procedures without compromising safe operation. In grocery and cold-storage environments, that also means independent temperature monitoring and procedures to protect or safely dispose of food if refrigeration fails.

Backups can restore software and data. They cannot reverse a lost cold chain or bring spoiled food back into inventory.

For businesses in York County and elsewhere, the question is no longer simply whether customer records are protected. It is also which connected systems can affect daily operations, who can access them, and what happens if that access is abused.

A Reminder of Ahold Delhaize's Earlier Breach

The October 2026 incident also follows a separate Ahold Delhaize cyberattack in November 2024, involving its U.S. operations. In 2025, the company disclosed that personal information relating to approximately 2.24 million individuals had been affected. INC Ransom claimed responsibility for the earlier intrusion; that claim should not be treated as verified attribution for either of the 2026 events.

The 2024 data breach, the October 2026 corporate incident and the European refrigeration attacks have different known facts and should not be presented as one continuous campaign. Taken together, however, they demonstrate how cyber risk can move from personal information to day-to-day operations and even the physical storage of essential goods.

York Tech Services | York County, Pennsylvania

Cybersecurity, Technology & Emerging Threats

Sources

Explore More News