Good morning!

French fridges defrost themselves overnight as Ahold Delhaize pulls some systems offline as a precaution. No link reported between them — just one lousy Monday for grocery IT.

Here are the 7 things you don't want to miss:

1. ❄️ French supermarket fridges defrost themselves overnight

Attackers triggered defrost cycles at major French supermarket chains overnight Sunday, sending refrigerator temperatures up and forcing stores to discard fresh and frozen stock. Intermarché, Coopérative U and Leclerc are among the chains affected; French outlets cited by BleepingComputer put the number of affected stores at 250 to 350. Paris prosecutors say they have opened an investigation; the controllers reportedly run on older Danfoss software. Food safety makes this the rare outage nobody shrugs off, in my view. (BleepingComputer)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. 🔐 Ledger pins its wallet thefts on a single distributor

All confirmed cases of Ledger's hardware-wallet thefts trace to a single distributor, the company said. CryptoBilis serves Indonesia, Malaysia and the Philippines. Ledger opened its investigation and paused sales Friday, confirming a malicious implant in at least one device Saturday. On-chain analysts estimate $86–93 million taken across 300-plus wallets — a figure Ledger has not confirmed — while Tether froze $10 million. Cold storage is only as warm as its supply chain. (CoinDesk)

4. 🛒 Ahold Delhaize's Monday starts with systems offline

Ahold Delhaize, one of the world's largest food retail groups, said Monday it took some systems offline as a precaution after detecting a "security issue within its network." Stores remain open and serving customers, the company said, and it is investigating the incident. The Dutch-listed grocer filed the alert as inside information under EU market-abuse rules. A precautionary outage beats a disclosed breach, until it doesn't. (Ahold Delhaize)

5. 🚔 An arrest at a cyber-insurance conference ends with sealed charges

The FBI arrested a 54-year-old man in Philadelphia on Thursday, where he had been attending a cyber-insurance conference; court records list him as Edward Dobrovsky. A complaint charges conspiracy to extort by threatening to expose confidential data, with the underlying document sealed and the FBI declining to name him. Reporting describes him as founder of a ransomware-negotiation firm; the firm disputes the label. (KrebsOnSecurity)

6. 🛡️ Exploit attempts reported against SonicWall's 10.0 SMA1000 flaw

Research firms Previdian and Defused reported Friday that attackers are attempting to exploit a CVSS 10.0, pre-authentication flaw in SonicWall's SMA1000 remote-access appliances — the 6210, 7210 and 8200v — CVE-2026-102255, tracked by SonicWall as SNWLID-2026-0017. Honeypots caught the attempts; no successful compromise has been established. Shadowserver counts more than 400 of the appliances still exposed online. Four hundred exposed boxes say more than the CVSS score. (BleepingComputer)

7. 🛰️ For Yandex, the cloud just acquired a front line

Yandex said Sunday that a drone attack fully shut its data center in the Vladimir region, its third facility hit in days. Its Kaluga site was partly disabled Friday and its Sasovo hub — home to two of the three supercomputers behind the company's AI model — went down Thursday. Reuters attributes the strikes to Ukraine; some Yandex services remain unavailable. Cloud regions have acquired a physical blast radius. (The Moscow Times)

Bonus. Threat Road Tip Of The Day

Third parties often hold the controls, not just the data. Spend twenty minutes listing every vendor whose software can change how your hardware behaves — thermostats, cameras, tills, firmware updaters — and note which of those products still receive security updates. That list is your next maintenance conversation.

Disclosure: Topic #2 in this newsletter is a promotion for Threat Road's Cyber Security Labs. Nothing else in this issue is sponsored.