What: At least fifteen significant cyber incidents and critical vulnerabilities occurred in under four weeks of October 2026, including attacks on refrigeration controls in French supermarkets and a US grocery group's systems.

Why it is important: Attacks cost about USD 50 per successful intrusion in one reported campaign and initial network access prices fell 69%, while exploitation now follows disclosure within days, making patch speed across e-commerce, store and supplier systems the binding constraint.

On 11 and 12 October, attackers remotely took control of refrigeration controls in more than 500 French shops, according to Al Jazeera's tally, including E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U, pushing fridge and freezer temperatures up to 50°C. Ahold Delhaize took systems offline as a precaution from 12 October; stores stayed open, but the websites and apps of its US banners were down for at least eight days.

Attacks are also getting cheaper. NorForge researchers observed one operator using the open-source Cairn AI agent framework against more than 1,200 websites, breaching over 100 companies at an estimated USD 50 per intrusion, a figure the researcher treats as approximate. Flashpoint reports verified ransomware victims up 45% year on year in the first half of 2026, while the average price of initial network access fell 69%, from USD 1,427 to USD 439.

Exploitation is accelerating too. Two critical PHP flaws, identified with AI assistance, had details spread before the planned release, forcing emergency patches. Plex attacks began the day after technical details appeared.

The note asks how quickly critical patches reach e-commerce, store and supplier systems.

IADS Notes: Attacks on store equipment now cause physical disruption: strikes on obsolete Danfoss refrigeration controllers spoiled stock across about 400 French supermarkets, and Asos, TFG London and Ahold Delhaize reported separate incidents within days (The Robin Report, October 2026). Continuity then depends on a fallback that has been tested in practice: Magasin du Nord kept all its stores and its webshop open by trading partly by hand after unauthorised activity on 18 October, in a market where only 5% of surveyed companies say they could largely run core activities without central IT (Magasin du Nord, October 2026). The expectation gap remains wide: 81% of surveyed executives expect critical systems to be restored within 10 days, against a real-world average of three to six months, while attacker breakout time fell from 62 minutes in 2023 to 29 (Harvard Business Review, October 2026). AI is lowering the barrier to sophisticated attacks further, from models breaching outside organisations during testing to attackers directing models to carry out intrusions (Bloomberg, August 2026). Exposure also runs beyond the first tier of suppliers: a cyberattack on a global logistics provider disrupted warehouse operations across Europe, while most vendor risk programmes stop at direct suppliers (RH-ISAC, August 2026).

IADS note: the accelerating pace of cyber risk