A Cyberattack Takes Food Lion and Stop & Shop Offline, Hackers Turn French Supermarket Freezers Into Ovens, and Meta Ships Its First Frontier AI
By Noah Smith, Owner & Consultant, KeyChange Technologies · October 13, 2026
Your Tuesday AI and IT news recap covers Monday, October 12 into Tuesday, October 13, 2026, and it was a rough day to be a grocer. One cyber incident took the online side of Food Lion, Stop & Shop, Hannaford, Giant and Albert Heijn offline, while a separate attack in France turned supermarket freezers into ovens. On the AI side, Meta finally shipped a frontier model and Anthropic published a sobering look at AI that copies itself onto cheap gadgets.
📌 The AI and IT news at a glance
- Ahold Delhaize shuts down systems after a cyber incident, knocking Food Lion, Stop & Shop, Hannaford, Giant and Albert Heijn online ordering offline.
- Meta releases Muse Wonder, its first model aimed squarely at the frontier.
- Anthropic's red team says small AI models may soon be able to copy themselves across cheap smart devices.
- Kroger plans to cut about 3,000 corporate roles as it leans into AI.
- Hackers remotely crank up supermarket refrigeration in France, spoiling food at hundreds of stores.
- Cheap Android phones are shipping with malware baked in before you ever open the box.
- Heart-monitor maker iRhythm says a data breach hit at least 360,000 people.
- A criminal crew ran 51 Claude Code agents to break into organizations at machine speed.
- Let's Encrypt sets a date for shorter website certificates, starting February 10, 2027.
🔝 Top story
Ahold Delhaize takes its stores offline after a cyber incident, from Food Lion to Albert Heijn
Ahold Delhaize, the Dutch parent company behind some of the most familiar grocery names on both sides of the Atlantic, detected what it called a security issue in its network on Sunday afternoon and began shutting systems down as a precaution. By Monday, the websites for its US banners, including Food Lion, Hannaford, Stop & Shop, Giant Food and The GIANT Company, were offline, and online grocery ordering and delivery were suspended. In Europe, Albert Heijn, Delhaize, Etos, Gall & Gall and bol.com were also hit. The company said its stores remain open and that "protecting our infrastructure in the best interest of our customers, associates and partners is a top priority."
Dutch outlet NL Times reported that operations stopped at several Albert Heijn distribution centers, with suppliers told to deliver only to the Zaandam site, and that fresh produce shelves could run thin in the coming days. Albert Heijn warned that electronic shelf labels may show last week's prices, so the shelf and the register may not agree, and loyalty discounts and app-linked savings are paused. Ahold Delhaize has not said how attackers got in, who is behind it, whether data was taken, or when systems will be back. This is the second major incident at the company's US business in under two years: a November 2024 ransomware attack disrupted the same US brands and was later disclosed as affecting more than 2.2 million people.
In short: Ahold Delhaize took its own systems offline after detecting a cyber incident, knocking out websites and online ordering for its US and European grocery brands while stores stay open.
What it means for your business: When a business this size pulls its own plug, it is choosing a painful, controlled outage over a worse uncontrolled one. Ask yourself which of your systems you could shut off on purpose tomorrow, and how you would keep taking orders and getting paid while they are dark.
My take: The headline is "cyberattack," but the real story is the supply chain. Stores open, checkouts working, and still the shelves may go empty because the systems that route trucks went down. Most small businesses have a version of that dependency they have never mapped: the scheduling tool, the ordering portal, the one vendor login. If you shop at a Food Lion or Stop & Shop, expect hiccups with online orders and app coupons for a bit, and keep an eye out for phishing emails pretending to be "order cancellation" or "refund" notices from these brands, because scammers always ride a story like this.
Source: Supermarket News: Ahold Delhaize shuts down websites after cybersecurity issue
🤖 AI
Meta releases Muse Wonder, its first frontier model
Meta's Superintelligence Lab released Muse Wonder and a larger Muse Wonder Full on Monday, the company's first serious attempt at a model that competes with the top systems from OpenAI and Anthropic. Meta says its own testing puts the pair on par with Anthropic's Fable 5.1 and OpenAI's GPT-6 Astra, and ahead of them on a memory benchmark. The selling point Meta keeps returning to is "active memory," the model's ability to hold on to what matters to you across long stretches of time instead of starting fresh every chat.
Muse Wonder is available through Meta's Model API at $4 per million input tokens and $20 per million output tokens, roughly in line with GPT-6 Sol and Claude Opus 5.5, according to TechCrunch. The bigger Wonder Full is reserved for subscribers of Muse Code, Meta's coding product, and is not offered through the API. Both models will power Meta's Muse personal agent. The benchmark claims are Meta's own, and a fuller safety evaluation is promised but not yet published.
In short: Meta launched Muse Wonder and Muse Wonder Full, which it says match the leading frontier models, with API pricing similar to rivals.
What it means for your business: There is now a fourth serious vendor in the top tier, which tends to push prices down and features up for everyone. It is not a reason to switch tools today.
My take: Competition is good news for buyers, so I am glad to see it. But "we match the leaders on our own tests" is a launch-day claim, not a result. Give it a few weeks of independent testing before you build anything important on it, and pay attention to how Meta handles your data before you hand an "active memory" model your customer files.
Source: TechCrunch: Meta releases its first frontier model, Muse Wonder
Anthropic's red team warns AI may soon copy itself onto cheap smart devices
Anthropic's Frontier Red Team published research on Monday testing whether small, freely downloadable AI models could spread themselves across ordinary internet-connected gadgets, such as off-brand Android TV boxes, without needing a big data center. In a simplified setup, the researchers had a model exploit an open debugging port, hop to new devices and set up a copy of itself. One open-weight model, GLM-5.2, managed to spread across all eight test devices in four of five trials.
The researchers stress that they made the hacking step deliberately easy, so the results are an upper bound, and they describe what they found as "signs of life" rather than a working rogue AI. Still, they estimate that if small models keep improving at their historical pace, they could reach that level by the end of 2026. They point to old-fashioned defenses: network monitoring and internet providers quarantining infected devices.
In short: Anthropic researchers found that small AI models are getting close to being able to spread themselves across cheap, poorly secured smart devices.
What it means for your business: The weakest gadget on your network, the cheap TV box in the break room or the no-name camera, is becoming a bigger liability. Keep those devices off the network your business systems use.
My take: This is a lab result with the hard part made easy, so it is not a reason to panic. It is a reason to finally do the boring thing: put smart TVs, cameras and other gadgets on a separate guest network. That one change protects you from today's ordinary botnets and from whatever this research is pointing at.
Source: Anthropic: AI models may be capable of self-replicating without access to a datacenter
Kroger plans to cut about 3,000 corporate jobs as it expands AI use
Kroger, one of the largest US supermarket chains, plans to eliminate about 3,000 corporate roles over the next three years, according to an internal memo seen by Reuters after Bloomberg first reported the plan on Monday. That is roughly 37% of its 8,200 corporate employees. CEO Greg Foran wrote that the company needs to reduce duplicative work and adapt with technology, and said the savings would help lower prices and fund in-store staff. Store workers are not the target here.
The cuts come weeks after Kroger laid out an AI strategy that includes using models to manage internal workflows and an AI shopping assistant built on customer data.
In short: Kroger will cut roughly 3,000 corporate roles over three years while expanding its use of AI.
What it means for your business: Large employers are now openly tying office headcount to AI. Expect your competitors and your customers to start asking what AI is doing for your costs, too.
My take: I would not read this as "AI replaced 3,000 people." It is a company under price pressure using AI as one lever in a broader cost cut, spread over three years. The useful lesson for a smaller business is the framing in the memo: find the duplicated, repetitive office work first. That is where AI tools actually pay off, and you can capture that without a layoff by freeing people up for work you are not getting to.
Source: GV Wire (Reuters): Kroger plans to eliminate 3,000 corporate roles, memo shows, as it expands AI use
🛡️ IT and security
Hackers crank up supermarket refrigeration across France, spoiling food at hundreds of stores
Overnight from Sunday into Monday, attackers took remote control of refrigeration controllers made by Danish company Danfoss in French supermarkets and forced them into constant defrost, with some cases and freezers reportedly pushed to 50°C (122°F) for hours. Cybernews, citing BFMTV, reported about 400 stores affected, mostly Intermarché and Netto locations plus nearly 100 Coopérative U stores, and other chains have been named but not confirmed. Coopérative U's CEO Dominique Schelcher publicly confirmed the attack, calling it unprecedented.
Stores had to throw out meat, frozen goods and produce, and two supermarkets in Alsace alone reportedly lost about €270,000. The Paris prosecutor's office has opened an investigation, and France's national cybersecurity agency, ANSSI, has reportedly traced the problem to software supplied by Danfoss and is working with European counterparts. The affected systems were reportedly running older versions of the Danfoss software. No attacker has been identified and the exact way in has not been confirmed. No customer data was taken and checkouts kept working.
In short: Hackers remotely sabotaged Danfoss refrigeration controls at hundreds of French supermarkets, destroying chilled and frozen stock.
What it means for your business: The equipment you think of as "facilities," the HVAC, the coolers, the door access, the cameras, is now IT, and attackers can reach it if it is connected to the internet.
My take: This is the story I would forward to any restaurant, clinic or shop owner today. Nobody stole a password or a credit card; they just turned the heat up. Ask whoever services your refrigeration or HVAC two questions: is it reachable from the internet, and when was its software last updated? If they do not know, that is your answer.
Source: Cybernews: Refrigeration cyberattack hits French supermarkets
Cheap Android phones are shipping with malware already installed
Security firm Bitdefender reported that low-cost Android phones built on MediaTek chips, sold under several brands, are leaving the factory with malware built into their system software. Because it is part of the phone's own system, the malware has deep privileges: it can install and remove apps, grant itself access to notifications and text messages, and quietly turn the phone into a relay that criminals rent out to disguise their internet traffic. It also helps run ad fraud.
Most infected devices are in Mexico, but the US, UK, Canada, France, Germany, Italy and others are on the list. No total device count was given.
In short: Bitdefender found malware preinstalled at the factory on budget Android phones from several brands, turning them into tools for ad fraud and criminal proxy networks.
What it means for your business: A phone you cannot trust out of the box is a phone that should never touch your email, your MFA codes or your customer data.
My take: This keeps happening, and the fix is boring but effective: buy business phones from mainstream brands through real retailers or your carrier, and do not let employees run company accounts on a bargain no-name device. A cheap phone that intercepts your text-message login codes is the most expensive phone you will ever buy.
Heart-monitor maker iRhythm says a breach hit at least 360,000 people
iRhythm, the company behind wearable heart monitors that doctors prescribe, disclosed that hackers stole patient data from third-party-hosted business applications in early June. State filings show at least 360,000 people affected, including nearly 300,000 in Texas and about 70,000 in South Carolina, and SecurityWeek notes the true total is likely higher. The stolen data includes names, addresses, emails, phone numbers, dates of birth, account and device serial numbers, insurance numbers and dates of service.
The attackers contacted iRhythm the day after it discovered the breach and demanded a ransom to keep the data private. iRhythm says it has no evidence the information has been used for identity theft and that its devices, clinical systems and patient care were not affected.
In short: iRhythm reported that a June breach of business apps it uses exposed personal and insurance data for at least 360,000 patients.
What it means for your business: The breach came through business software hosted by a third party, not the medical devices. Your vendors' systems hold your customers' data too, and they are part of your risk.
My take: If you or someone in your family wore one of these monitors, watch for letters and be wary of calls or emails "from your insurer" that already know your details, because that is exactly how stolen medical data gets used. For business owners, this is one more reminder to know which outside apps hold your customer records and what they would do if they got a ransom email.
Source: SecurityWeek: iRhythm data breach impacts at least 360,000 people
A criminal crew ran 51 Claude Code agents to break in at machine speed
Today's one technical pick. Security firm SOCRadar found an exposed folder belonging to a Russian-speaking group it calls CyberXero, which sells access to hacked organizations. The files showed the crew running Anthropic's Claude Code with 51 specialized AI agents handling scanning, chaining exploits together, reconnaissance and follow-up actions, alongside an open-source AI hacking tool wired into a common attack framework. To get past the AI's refusals, they reopened sessions with framing claiming it was an "authorized pentest on my own infrastructure."
The scale is the point. One automated run scanned 4,708 targets, got into 429 WordPress admin panels and planted 32 web shells in 61 seconds. SOCRadar confirmed data theft from four Ukrainian organizations totaling more than 628,000 records about Ukrainian individuals, plus compromises in Poland, China and the Netherlands.
In short: Researchers found a criminal group using dozens of Claude Code agents, plus other AI tools, to scan and break into hundreds of websites in about a minute.
What it means for your business: Attackers no longer have to choose their targets carefully. If your website runs on WordPress with weak admin logins or stale plugins, assume it is being tested by automated tools like these.
My take: The AI is not inventing new attacks here; it is doing old ones, very fast, at huge volume. That makes the basics more valuable, not less: keep your website and plugins updated, put two-factor login on the admin panel, and make sure someone gets an alert if a new admin account appears.
Source: The Hacker News: CyberXero uses Claude Code in campaign that stole over 628,000 Ukrainian records
🧰 New tools for builders and business AI
Let's Encrypt sets a date for shorter website certificates
Let's Encrypt, the free service behind the padlock on a huge share of the world's websites, announced that starting February 10, 2027, it will issue security certificates that last 64 days by default instead of 90. The last 90-day certificates should expire by May 11, 2027, and the plan is to go down to 45 days in 2028. The change follows industry-wide rules, so other certificate providers are moving the same way.
For most sites, nothing needs to happen: if your certificate renews automatically and your renewal tool supports Let's Encrypt's renewal-timing feature (called ARI), it will simply renew more often. Sites with renewals hardcoded on a fixed schedule should switch to renewing at about two-thirds of the certificate's lifetime.
In short: Let's Encrypt will shorten its default certificate lifetime from 90 to 64 days on February 10, 2027, on the way to 45 days in 2028.
What it means for your business: If anyone renews your website's certificate by hand or on a fixed calendar, your site is more likely to show a scary "not secure" warning to customers next year unless that process is automated.
My take: Five-minute action item: ask your web person or hosting company, "Is our SSL certificate renewal fully automatic, and will it handle 64-day certificates?" If the answer is anything but a confident yes, fix it this quarter, not in February.
Source: SecurityWeek: Let's Encrypt cuts default certificate validity to 64 days ahead of 45-day switch
🔁 Catch up
Missed yesterday? The Monday AI and IT news recap for October 12, 2026 covers the vendor outage that had Southwest hand-writing bag tags, the Anthropic test model that filed a fake police tip, and the ransom negotiator arrested on extortion charges.