Staff Reports
Two separate cyber scares this week should make grocery chains and regulators uncomfortable. In France, hackers changed refrigeration controls at scores of stores and left workers hauling spoiled meat and frozen food to the trash. At the same time, Ahold Delhaize — the owner of Stop & Shop, Food Lion, and other chains — pulled parts of its network offline after a cybersecurity problem disrupted online ordering. This isn’t drama. It’s proof that lazy cyber hygiene has real, smelly consequences.
What happened: refrigeration attack and Ahold Delhaize outage
In France, attackers got into refrigeration controllers at hundreds of supermarkets. Staff found freezers and fridges turned up, food thawed and rotting, and shelves of inventory ruined. Chains from Carrefour to Monoprix reported losses as employees dumped boxes of spoiled products. Investigators say the affected controllers included older Danfoss, Copeland, and Dixell models running outdated firmware — gear that was past its support life.
Meanwhile, Ahold Delhaize took parts of its systems offline after detecting a cybersecurity problem. Stores stayed open, but online shoppers saw maintenance notices and some had orders delayed or refunded. The company said it’s doing a controlled relaunch of systems and, so far, hasn’t found signs of stolen customer data. Dutch authorities see no link between the two incidents, but the lesson is the same: when operational systems are vulnerable, lives and businesses suffer.
Why this matters: cyber hygiene is not optional
This is not an abstract IT headache. When industrial control systems and internet-connected devices are left unpatched, terrorists or pranksters can make people throw away food and cost small businesses serious money. Workers end up cleaning the mess. Consumers lose confidence. And, because there was no ransom demand or claim of responsibility in the French case, nobody is standing up to pay the bill.
Who’s really at fault: old tech, vendors, and weak oversight
Blaming “hackers” is easy. The harder truth is that manufacturers sold controls that stopped getting security updates. Supermarket owners kept using them past their end of life. Regulators and procurement teams failed to enforce security standards. That’s a recipe for disaster. If the equipment can be reached from the internet and the vendor isn’t patching it, it’s not a bug — it’s a business decision with real-world costs.
Fixes to demand: modernization, liability, and common-sense security
We need clear, enforceable rules for industrial and IoT security. Supermarkets and vendors should face liability when obsolete, unsupported gear causes physical harm or major loss. Regulators should require segmentation of operational networks, remove direct internet exposure for control systems, and push for mandatory patching or phased retirements of legacy equipment. Congress and state legislatures can incentivize upgrades and hold accountable those who put short-term savings above public safety.
Call it commonsense accountability. If your refrigerator can be warmed up by an anonymous stranger online, you don’t have an IT problem — you have a policy failure. It’s time for supermarket chains, vendors, and regulators to stop pretending cyber hygiene is optional and start treating it like the public-safety issue it is.
