Hackers hijack refrigeration systems at 350 French supermarkets

French investigators are probing a cyberattack that compromised refrigeration systems at at least 350 supermarkets, forcing staff to discard spoiled meat and frozen food.

Stores belonging to Carrefour, Monoprix, Intermarché and Coopérative U were affected after attackers manually overrode fridge temperatures. No group has claimed responsibility or demanded a ransom.

France’s cybersecurity agency said affected systems included Danfoss, Copeland and Dixell equipment. Danfoss said many compromised units were running outdated firmware or had reached end of life, leaving them without security updates.

Reuters identified at least 4,500 Danfoss interfaces exposed online, highlighting the scale of potentially accessible refrigeration infrastructure.

Separately, Dutch supermarket owner Ahold Delhaize began restarting systems following a cybersecurity incident affecting Albert Heijn. The Dutch NCSC said it had found no link between the incidents.

The disruption highlights how exposed operational technology and ageing equipment can turn a cyberattack into physical losses, food waste and disruption to essential services.

AI used in attacks against 84% of ransomware victims says new report

Cybercriminals used AI in attacks experienced by 84% of surveyed ransomware victims, according to Semperis’s 2026 Ransomware Risk Report. Meanwhile, 44% said attackers exploited their organisation’s own AI agents or systems.

The research surveyed 1,200 IT and security professionals across nine countries and eight industry sectors, highlighting how attackers are adopting AI alongside established intrusion and extortion techniques.

Identity infrastructure was a major target, with 87% reporting attacks against systems controlling network access. Repeat compromises were also common: 69% experienced multiple successful attacks during the previous year, while 59% of respondents paid a ransom at least once.

The findings also reveal ransomware’s human impact. More than a third of surveyed victims faced psychological or physical threats against employees. Some 14% of surveyed organisations reported employees or relatives changing jobs, workplaces or homes following sustained threats.

The report highlights the importance of securing identities, controlling AI permissions and preparing for sustained extortion.

Retailers in cybercriminals’ crosshairs as Hobbs, Whistles and Phase Eight hit by attacks

TFG London, owner of Hobbs, Whistles and Phase Eight, is investigating a cybersecurity incident affecting some IT systems across the three fashion brands.

The group identified the incident on Sunday and brought in external cybersecurity specialists. Stores remain open as normal, although some website functions may be unavailable.

In an email to customers, TFG said it did not believe payment information had been affected. Investigators are still determining whether sensitive customer information was exposed, and anyone affected will be contacted directly.

Separately, H&M is investigating claims of an attack by hacking group ShinyHunters. The retailer said it had found no indications that its data environment had been compromised.

The developments follow the recent ASOS breach, in which attackers used unauthorised app notifications to publicise their claims.

The incidents highlight continuing cybersecurity pressures on retailers and the importance of rapid investigation, clear customer communications and vigilance against potential follow-up phishing or fraud.

Microsoft patches record 1,413 vulnerabilities including actively exploited Windows flaw

Microsoft has released security updates addressing a record 1,413 vulnerabilities, including more than 70 rated Critical and one already being exploited by attackers.

The actively exploited flaw, CVE-2026-96951, affects Windows Shell and allows attackers to bypass Mark of the Web protections. By persuading users to open specially crafted files, attackers could evade security warnings designed to help prevent malicious content from running.

CISA has added the vulnerability to its Known Exploited Vulnerabilities catalogue.

Other significant fixes include a publicly disclosed .NET Framework vulnerability that can bypass Windows Defender Application Control, potentially allowing attackers with existing access to execute unauthorised code.

A Critical Raw Image Extension flaw could also enable code execution when Windows generates thumbnails for malicious image files, without users opening them.

The release covers Windows, Office, SharePoint, SQL Server and developer tools. Organisations should prioritise actively exploited vulnerabilities and assess exposure across critical systems, internet-facing infrastructure and privileged workstations.

Global operation disrupts Cybercrime network behind one billion malicious messages

Microsoft, law enforcement agencies and industry partners have disrupted a cybercriminal ecosystem linked to more than one billion malicious messages targeting over 75,000 organisations across 150 countries.

An investigation with Japan’s National Police Agency traced activity to YAM Store, a Chinese-language marketplace selling compromised or fraudulently obtained cloud accounts, licences and infrastructure.

The marketplace supported phishing platforms including CoGUI and Iron Man, which impersonated banks, retailers, delivery companies and government agencies. Criminals also used AI to create convincing fake organisations to obtain cloud accounts.

More than 750 million malicious messages targeted Microsoft customers this year, with some campaigns using device-code phishing to steal authentication tokens.

Under a US court order, Microsoft and Health-ISAC seized and redirected supporting domains. Microsoft also deactivated over 20,000 accounts and blocked 100,000 domains associated with impersonation and fraud.

Partners continue removing infrastructure, highlighting the scale of services enabling criminals to launch phishing campaigns against organisations worldwide.

If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively Get in touch to find out how you can protect your organisation. 

The Threat Intel Roundup was prepared by Integrity360 summarising threat news as we observe it, current at the date of publishing. It should not be considered to be legal, consulting or any other professional advice. Any recommendations should be considered in the context of your own organisation. Integrity360 does not take any political stance in the information that we share. Moreover, the opinions expressed may not necessarily be the views of Integrity360.