--- title: "Ahold Delhaize Cyberattack, French Supermarkets Hacked, Spyware Through Ads | DMARC Report" description: "Explore key cybersecurity news from October 13–19, 2026, including major cyberattacks, zero-days, spyware, AI threats, and email security risks." image: "https://dmarcreport.com/og/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads.png" canonical: "https://dmarcreport.com/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads/" --- Quick Answer The October 13–19, 2026 cybersecurity roundup covers major cyberattacks, zero-day exploits, spyware campaigns, AI-driven threats, supply-chain risks, and North Korean IT schemes, highlighting the growing need for strong email and network security. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Ahold%20Delhaize%20Cyberattack%2C%20French%20Supermarkets%20Hacked%2C%20Spyware%20Through%20Ads&url=undefined%2Fblog%2Fahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads%2F&title=Ahold%20Delhaize%20Cyberattack%2C%20French%20Supermarkets%20Hacked%2C%20Spyware%20Through%20Ads "Share on Reddit") [ ](mailto:?subject=Ahold%20Delhaize%20Cyberattack%2C%20French%20Supermarkets%20Hacked%2C%20Spyware%20Through%20Ads&body=Check out this article: undefined%2Fblog%2Fahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads%2F "Share via Email") ![Cybersecurity Threats Weekly Roundup](https://media.mailhop.org/dmarcreport/dmarc-lookup-2281-1792584391252.jpg) Here’s a roundup of the week’s biggest **cybersecurity developments**, from a retail giant pulling its network offline to government spyware delivered through ordinary online ads. A zero-day in a popular VPN appliance, a record Patch Tuesday, and a major crackdown on North Korean IT workers also made headlines. _Most of these stories show how attackers keep exploiting trust, whether in ads, messages, or the software we already rely on_. ## Ahold Delhaize takes systems offline after a cyberattack! Dutch retail giant [Ahold Delhaize](https://www.theregister.com/security/2026/10/19/grocery-giant-ahold-delhaize-confirms-cyberattack-forced-us-and-european-systems-offline/5303970) confirmed on October 12 that it had detected a “security issue” and shut down parts of its network to contain it. _Stores stayed open, but customers couldn’t use websites or apps at several brands in the Netherlands and Belgium, and some Stop & Shop staff couldn’t reach schedules and pay stubs_. The company is also dealing with its second major incident in recent years. [BleepingComputer](https://www.bleepingcomputer.com/news/security/retail-giant-ahold-delhaize-takes-systems-offline-after-cyberattack/) ## Refrigerators at French supermarkets shut down by hackers! Attackers remotely switched off refrigeration units at several French supermarket chains over the weekend before the window, reportedly by targeting **Danfoss refrigeration controllers**. Researchers say the weaknesses in that equipment had been disclosed months earlier, which makes the story a warning about leaving known flaws unpatched. [BleepingComputer](https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/) [Cybersecurity Dive](https://www.cybersecuritydive.com/news/refrigeration-france-cyber/832858/) ## Government spyware delivered through online ads! ![Dmarc Report 8469](https://media.mailhop.org/dmarcreport/dmarc-report-8469-1792584415341.jpg)Citizen Lab reported that **Candiru spyware** infected at least [45 Al Jazeera devices](https://www.aljazeera.com/news/2026/10/15/israeli-ad-tech-firm-helped-spy-on-al-jazeera-devices) in 2024 and 2025 using malicious ads that needed no click at all. _The ads were sold through a company called Discover-Tech, which the researchers describe as a bridge between ad networks and mercenary spyware vendors_. It is the first public technical confirmation that this kind of spyware can reach real devices through advertising. [The Hacker News](https://thehackernews.com/2026/10/citizen-lab-traces-zero-click-candiru.html) ## Ivanti Connect Secure zero-day under active attack! [Ivanti disclosed CVE-2026-104935](https://www.darkreading.com/vulnerabilities-threats/ivanti-ics-zero-day-attacks-vendor-patching), an authentication bypass in its Connect Secure **VPN appliances** that lets unauthenticated attackers run commands. Volexity found a [threat actor](https://www.healthcareitnews.com/news/chinese-government-affiliated-cyber-threat-actors-target-edge-devices) chaining it with other flaws to reach root on fully patched devices. CISA added it to its exploited catalog and gave federal agencies until Friday to patch. [BleepingComputer](https://bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day) ## More edge devices added to CISA’s exploited list! On October 14, CISA added a [Palo Alto Networks PAN-OS](https://www.csoonline.com/article/4235787/attackers-exploit-palo-alto-pan-os-flaw-for-root-access-as-cisa-orders-three-day-fix.html) code injection flaw (CVE-2026-0322) and a [Cisco Secure Email Gateway](https://www.cisco.com/c/en/us/products/collateral/security/cloud-email-security/datasheet-c78-742868.html) path traversal flaw (CVE-2026-76519) to its Known Exploited Vulnerabilities catalog. _The pattern is familiar: internet-facing network gear remains a favourite entry point, and patching it quickly matters more than almost anything else_. [Sherlock Forensics](https://sherlockforensics.com/blog/2026-10-14-weekly-security-roundup.html) ## BeyondTrust Remote Support flaw linked to China-based hackers! [BeyondTrust patched CVE-2026-102764](https://tech-insider.org/beyondtrust-remote-support-zero-day-armory-castle-2026/) in its Remote Support product on October 16\. The flaw was reportedly exploited by a China-linked group since late August. **Remote support tools** are a high-value target because they hold privileged access to many organisations at once. [Sherlock Forensics](https://sherlockforensics.com/blog/2026-10-14-weekly-security-roundup.html) ![Dmarc Check 5647](https://media.mailhop.org/dmarcreport/dmarc-check-5647-1792584634152.jpg) ## Microsoft’s October Patch Tuesday breaks records! [Microsoft’s October Patch Tuesday fixed](https://www.malwarebytes.com/blog/bugs/2026/10/update-windows-record-patch-tuesday-fixes-flaw-already-under-attack) more than 1,400 vulnerabilities, a record for the company. One of them, **CVE-2026-96951**, is a Windows Shell flaw that is already being exploited and lets attackers bypass the Mark of the Web protection on downloaded files. Administrators should prioritise it. [The Record](https://therecord.media/new-ivanti-microsoft-bugs-exploitation) ## FBI disrupts North Korean “laptop farms” in Texas! _The Justice Department charged 14 people and arrested two in Operation Lonestar Roundup._ FBI agents searched more than 40 suspected laptop farms in Texas and seized about 187 devices. [North Korean IT workers used stolen](https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.html) or fake identities to win remote jobs at roughly 70 US companies, and the scheme is estimated to have raised around **$3 million**. [BleepingComputer](https://bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested) ## AI helps build a full Chrome exploit in six days! ![Dmarc Record 8170](https://media.mailhop.org/dmarcreport/dmarc-record-8170-1792584672704.jpg)Security firm XBOW used AI agents powered by OpenAI’s public GPT-5.6 Sol model to chain three previously unknown [Google Chrome bugs into a full-chain exploit](https://gbhackers.com/google-pays-250000-for-ai-assisted-chrome-exploit/). The work took six days and is reported to be worth around **$250,000** in bug bounty terms. It shows how quickly AI tools are shrinking the time between a vulnerability and a working attack. [Cyber Recaps](https://cyberrecaps.com/news/cybersecurity-news-october-14-2026) ## Spy chips found in hardware crypto wallets! **Researchers reported** spy implants inside hardware [crypto wallets](https://gizmodo.com/ledger-announces-new-phone-like-crypto-wallet-at-the-worst-possible-time-2000826405), and the wallet maker Ledger confirmed that a chip implant was behind some wallet thefts. The story is a reminder that [supply chain attacks](https://news.risky.biz/risky-bulletin-extremely-targeted-supply-chain-attack-hits-daemon-tools/) can target hardware as well as software, and that buyers should check where their devices come from. [This Week in Security](https://this.weekinsecurity.com/this-week-in-security-october-18-2026-edition/) ## Small AI models could form self-spreading botnets, Anthropic warns! [Anthropic warned that small AI models](https://www.wthr.com/article/news/nation-world/anthropic-small-ai-self-replicating-warning-smart-home-devices/507-1245e4fd-23b9-4f27-91e4-3202b8c5aa89) could soon be used to build self-propagating botnets across internet-connected devices. _The warning reflects a broader concern that cheaper, lighter models will make automated attacks easier to run at scale_. [Hacklido](https://hacklido.substack.com/p/hacklido-weekly-cybersecurity-roundup) ## OpenAI employee arrested for planting a hidden recorder! An [OpenAI employee](https://www.cnbc.com/2026/10/13/openai-employee-arrested-recording-device.html) was arrested over an alleged hidden recording device placed in an executive conference room. The case is an insider threat story, showing that **physical and internal security** matter as much as network defences at AI companies. [Hacklido](https://hacklido.substack.com/p/hacklido-weekly-cybersecurity-roundup) ![Dmarc Generator 9731](https://media.mailhop.org/dmarcreport/dmarc-generator-9731-1792584708047.jpg) ## ConnectWise suspends cloud backup after Microsoft 365 tenant compromises! ConnectWise suspended its **cloud backup** service after attackers [compromised Microsoft 365 tenants](https://www.cybersecuritydive.com/news/connecwise-suspends-cloud-backup-hacker-microsoft-365/833345/). _Customers who relied on that backup were left without a safety net, which is why backups should be stored separately from the systems they protect_. [Hacklido](https://hacklido.substack.com/p/hacklido-weekly-cybersecurity-roundup) ## Critical GitLab flaw with a CVSS score of 10.0! [GitLab patched a flaw rated CVSS 10.0](https://hacklido.com/news/gitlab-patches-cvss-10-0-flaw-that-could-let-unauthenticated-users-run-server-code) that could let unauthenticated users run code on the server. **Administrators** running self-managed GitLab instances should update immediately, since a bug at this severity is typically found and exploited quickly. [Hacklido](https://hacklido.substack.com/p/hacklido-weekly-cybersecurity-roundup) ## Technical University of Denmark reports identity system breach! The [Technical University of Denmark](https://cphpost.dk/2026-10-09/news/round-up/hacker-retained-access-to-danish-cpr-register-for-nearly-22-days-before-breach-was-discovered/) found unauthorised access to its identity and access **management systems**, with a large amount of data taken out. Identity systems are especially sensitive because compromising them can open the door to everything else. [Sharkstriker](https://sharkstriker.com/blog/october-2026-data-breaches/) These [cybersecurity](https://dmarcreport.com/blog/what-is-dumpster-diving-cyber-security-why-it-matters/)incidents also highlight the importance of [email security](https://dmarcreport.com/blog/why-email-security-matters-and-how-to-get-it-right/). Implementing [DMARC](https://dmarcreport.com/), SPF, and [DKIM](https://dmarcreport.com/what-is-dkim/) helps organizations protect their email domains against spoofing and reduce the risk of domain impersonation and phishing attacks. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Take control of your DMARC reports Turn raw XML into actionable dashboards. Start free - no credit card required. [Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) AutoSPF Automatic SPF Flattening Streamline your SPF record management, enable DMARC compliance, and improve your email deliverability by fixing the SPF 10-lookup limitation. [ Fix My SPF Record! → ](https://autospf.com/pricing/?utm%5Fsource=dmarcreport&utm%5Fmedium=blog-sidebar&utm%5Fcampaign=autospf-cross-promo&utm%5Fcontent=fix-my-spf) [ See How It Works ](https://autospf.com/how-it-works/?utm%5Fsource=dmarcreport&utm%5Fmedium=blog-sidebar&utm%5Fcampaign=autospf-cross-promo&utm%5Fcontent=how-it-works) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads%2F) [ ](https://twitter.com/intent/tweet?text=Ahold%20Delhaize%20Cyberattack%2C%20French%20Supermarkets%20Hacked%2C%20Spyware%20Through%20Ads&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads%2F) Copy Related Articles - [ ![10 Reasons Why DKIM Fails](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 10 Reasons Why DKIM Fails Intermediate ](/blog/10-reasons-why-dkim-fails/) - [ ![cybersecurity news](https://media.mailhop.org/dmarcreport/dmarc-check-9711-1784029121308.jpg) Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Intermediate ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/) - [ ![AppRiver SPF Record](https://media.mailhop.org/dmarcreport/dmarc-check-7224-1785846270575.jpg) AppRiver SPF Record: How To Set It Up (Owned By Zix) Intermediate ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/) - [ ![Cybersecurity ransomware news](https://media.mailhop.org/dmarcreport/dmarc-report-3120-1788259786008.jpg) Berlin Ransomware Extortion, McKesson Data Breach, Boston Scientific Disrupted Intermediate ](/blog/berlin-ransomware-extortion-mckesson-data-breach-boston-scientific-disrupted/) ## Related Articles [ Intermediate 4m 10 Reasons Why DKIM Fails Apr 19, 2022 ](/blog/10-reasons-why-dkim-fails/)[ Intermediate Accenture Sourcecode Breached, JADEPUFFER AI Ransomware, GodDamn Disables Windows Jul 14, 2026 ](/blog/accenture-sourcecode-breached-jadepuffer-ai-ransomware-goddamn-disables-windows/)[ Intermediate AppRiver SPF Record: How To Set It Up (Owned By Zix) Aug 4, 2026 ](/blog/appriver-spf-record-setup-guide-for-zix-email-security-platform/)[ Intermediate Berlin Ransomware Extortion, McKesson Data Breach, Boston Scientific Disrupted Sep 1, 2026 ](/blog/berlin-ransomware-extortion-mckesson-data-breach-boston-scientific-disrupted/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"473","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"Ahold Delhaize Cyberattack, French Supermarkets Hacked, Spyware Through Ads","description":"Explore key cybersecurity news from October 13–19, 2026, including major cyberattacks, zero-days, spyware, AI threats, and email security risks.","url":"https://dmarcreport.com/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads/","datePublished":"2026-10-21T00:00:00.000Z","dateModified":"2026-10-21T00:00:00.000Z","dateCreated":"2026-10-21T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 5,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"473","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-lookup-2281-1792584391252.jpg","caption":"Cybersecurity Threats Weekly Roundup"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"Ahold Delhaize Cyberattack, French Supermarkets Hacked, Spyware Through Ads","item":"https://dmarcreport.com/blog/ahold-delhaize-cyberattack-french-supermarkets-hacked-spyware-through-ads/"}]} ```