Critical Infrastructure

Critical infrastructure is the set of systems that keep essential services running, from drinking water to the food supply, and its security extends to operational technology, the industrial controllers that run physical equipment. Attacks on those controllers reach past data into the physical world: in 2026 they spoiled food, led to reported fires at some stores and altered how water was pumped.

The 2026 incidents fell into two kinds. Intruders reached internet-exposed industrial controls at hundreds of French supermarkets, possibly by scanning for unsecured units rather than choosing a victim, and tampered with the industrial controls of two small Colorado water utilities. The second kind hit business systems such as servers, websites and apps. An incident at Ahold Delhaize disrupted its grocery brands in the US and Europe while stores stayed open. Separately, a ransomware operator broke into a water utility and a telecommunications provider through unpatched servers.

Colorado had named its attackers only as foreign actors as of September 2026. As of October 2026, the Paris prosecutor's office was investigating the refrigeration attack, Ahold Delhaize had named no attacker, and no link between the French and Ahold Delhaize incidents had been confirmed.

Attacks on industrial controls

Overnight on 11 to 12 October 2026, hackers remotely triggered the built-in defrost cycles of Danfoss refrigeration controllers at an estimated 250 to 350 French supermarkets, driving fridge and freezer temperatures to around 50°C. The heat spoiled fresh and frozen stock at major chains including Intermarché and Carrefour Market, and French media cited by BleepingComputer reported fires at some stores. Security researcher Baptiste Robert found 2,752 Danfoss refrigeration systems exposed to the internet worldwide, 1,590 of them in France, which suggested the attackers may simply have scanned for unsecured controllers rather than targeting any one retailer. The Paris prosecutor's office opened an investigation into what it called a large-scale cyberattack.

Colorado Governor Jared Polis's office confirmed in September 2026 that attackers had tampered with the industrial control systems of two small water utilities, each privately run and serving fewer than 200 people. The intruders changed equipment settings, disabled remote access and alarms, and altered pumping cycles, though the governor's office said the disruption was brief and did not affect water service or public safety. The state named the attackers only as foreign actors and had not confirmed a link to an Iran-linked effort, flagged by CISA, to access drinking water and wastewater systems nationally.

Disruption through IT systems

Incidents outside industrial controls also hit essential services. Ahold Delhaize took unspecified systems offline on 12 October 2026 after detecting a cybersecurity incident on its network. In the Netherlands, Albert Heijn's website, app, deliveries and customer service were disrupted and electronic shelf labels showed outdated prices, with disruption also at Delhaize in Belgium and at Food Lion and Stop & Shop in the US. Staff described it internally as an IT outage, and the company said stores stayed open.

The company began a controlled re-launch of affected systems on 13 October, said it had found no evidence that customer or associate data was taken, and named no attacker. The incident surfaced the same day as the French refrigeration attack, and no connection between the two had been confirmed.

The Warlock ransomware operator also broke into a water utility and a telecommunications provider. Symantec reported that the operator, tracked as Storm-2603, got in through unpatched Microsoft SharePoint servers, more than a year after the group first exploited the ToolShell zero-days.