When Cyberattacks Hit the Real World: Supermarkets, Banks and Burger Joints in October 2026

Not every Black October story involves a CVE. Some of the most visible incidents were about what happens to ordinary people and businesses when systems fail or data leaks.

On 12-13 October, attackers reportedly manipulated refrigeration systems across French supermarkets, forcing defrosting. The agriculture minister said about 700 of 10,000 supermarkets were affected, and Intermarché stores were reportedly heated to 50°C for six hours, with food discarded. The attacker is unknown. It is a reminder that operational technology in retail has real physical consequences.

• Ahold Delhaize (reported 12 October): websites and apps went offline in Europe and the US, while physical stores stayed open. Malicious activity was confirmed.
• Burger King Japan (15-16 October): about 11.18 million app user records, including names, birth dates, gender, emails, phone numbers and order history. Card numbers were not stored in that system.
• Nikkei: unauthorised access on 7 October via stolen credentials to a cloud development service; about 1.83 million records, around 150,000 with personal information.
• Mr. Max Holdings (Japan): up to 1.7 million customers potentially affected.