Two announcements, one company, one week
On November 2, Ahold Delhaize USA told Supermarket News it had chosen NCR Voyix's Voyix Commerce Platform to unify point of sale, self-checkout, pharmacy, and fuel operations across its local grocery brands, with new registers already live in 100 stores. Chief Information Officer Ann Dozier framed it as a push toward a consistent technology foundation that still lets each banner serve its own customers. It is the kind of modernization story retail technology teams like to tell: cleaner architecture, fewer point solutions, faster rollout cycles.
The same day, Supermarket News reported a second wave of cyberattacks had hit refrigeration systems at roughly 40 Delhaize-owned stores in Belgium and Luxembourg, part of a broader sweep that also touched ICA in Sweden, Colruyt's SPAR stores in Belgium, Musgrave's Supervalu stores in Ireland, and Coop locations in Sweden. One company, one week, two completely different stories about where its technology investment has actually gone, and the contrast is instructive for any CTO weighing a modernization roadmap against a security backlog that has quietly accumulated for years.
What happened to the freezers
According to reporting cited by Supermarket News, attackers remotely switched refrigeration evaporators into defrost mode at dozens of stores across Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland. Musgrave confirmed 13 Supervalu stores in Ireland were affected, Coop confirmed six locations in Sweden, and Ahold Delhaize confirmed the incident at its Delhaize stores directly: a spokesperson said the company was aware of an IT incident that affected the refrigeration systems in a number of Delhaize stores.
This is not an isolated event. An earlier attack pushed freezer temperatures at hundreds of French supermarkets to roughly 120 degrees Fahrenheit, spoiling millions of dollars of inventory, and separately the Pentagon is investigating freezer malfunctions at US military bases over the summer closely enough that it has contacted French authorities about a possible connection. Belgium's Centre for Cybersecurity logged 588 incident reports through late September, already ahead of all of last year's total of 556.
Sabotage, not extortion
No group has claimed credit for the refrigeration attacks and no ransom demand has surfaced, which security reporting has pointed to as the detail that sets this campaign apart from typical retail ransomware. The attackers appear to want spoiled food and disrupted stores, not a payout, which changes the incentive structure defenders have to plan for. A financially motivated actor usually stops once you refuse to pay. An actor optimizing for disruption does not.
Patrick Lamplmair, chief technology officer and co-founder of the Austrian industrial security firm Tributech, put the fix in operational terms rather than policy terms: every command sent to equipment like a refrigeration controller should prove where it came from and that it was not altered in transit, and every setpoint should be checked against physical limits before it executes. He also urged operators to ask their equipment suppliers directly how commands are verified, a question most retail IT teams have never had to put to a refrigeration vendor.
The budget mismatch this exposes
Ahold Delhaize USA's NCR Voyix rollout is a sensible, well-telegraphed modernization: consolidate point of sale, self-checkout, pharmacy, and fuel onto one commerce platform, cut vendor sprawl, and give every local banner the same underlying rails. It is also, notably, a customer-facing and revenue-facing system, the kind of project that competes well for budget because its return on investment is easy to model for a finance committee that wants to see faster checkout lines and fewer support tickets translate directly into comparable-store sales.
Refrigeration controllers, HVAC systems, and the other operational technology scattered through a supermarket's back of house rarely get that same budget attention, even though a defrosted freezer destroys inventory just as surely as a ransomware-encrypted point of sale terminal stops a sale. A separate incident last month that knocked Ahold Delhaize's websites offline across the US and Europe for several days shows the company has plenty of digital attack surface to defend on both the customer-facing and operational side, and that attack surface is only growing as more of the back office gets networked.
Why this keeps happening to grocery specifically
Grocery retailers run an unusually large fleet of networked industrial controllers: refrigeration units, HVAC systems, in-store kiosks, and increasingly robotics, often supplied by multiple vendors with their own remote management tools and update cadences. That sprawl is exactly what makes attribution and defense hard. A retailer like Ahold Delhaize is really securing a federation of legacy equipment and modern software bolted together over years of acquisitions and store remodels, each with a different vendor, update cycle, and authentication model to track, audit, and patch on its own schedule.
The Belgian cybersecurity centre's near-doubling of incident reports year over year suggests this is a trend line rather than a one-off wave, and European grocers have now absorbed two distinct refrigeration sabotage campaigns within months of each other, first in France and now across seven countries at once. That is enough repetition to stop treating each incident as a freak occurrence and start budgeting for refrigeration and other store operational technology as a recurring security line item, reviewed on the same cadence as point of sale and ecommerce modernization rather than only after the next freezer fails.
What this means for the roadmap
If you run technology for a multi-banner retailer, this week's split headline is a useful audit prompt. Pull up your capital plan and check how much is flowing to customer-facing modernization like unified point of sale versus how much is flowing to authenticating and segmenting the operational technology that keeps the lights, the HVAC, and the freezers running. A lopsided answer, as Ahold Delhaize's own week just illustrated, points to a governance gap rather than just a security gap.
Closing that gap does not require ripping out refrigeration vendors. It requires the same discipline CTOs already apply to application security: verify the origin of every command sent to physical equipment, enforce setpoint limits in hardware where possible so a spoofed command cannot physically damage inventory, and ask every OT vendor the question Lamplmair raised before the next incident forces the question on you. Modernization budgets will keep favoring the systems that generate revenue, so make the case now for the systems that protect inventory before they are left to compete for what is left over.
