From cold store to server room: why cybersecurity starts in the building

It was a weekend the supermarket sector will not soon forget. During the night of 11 to 12 October 2026, hackers in France remotely forced the refrigeration systems of hundreds of supermarkets into defrost mode. At Intermarché, Système U, E.Leclerc and Monoprix, fresh and frozen products had to be thrown away. At the same time, in the Netherlands, the websites, apps and deliveries of Albert Heijn, Etos and Gall & Gall came to a halt after a cybersecurity incident.

Two different incidents, with one shared lesson. Cybersecurity is no longer only about stolen data or a hacked laptop. It is about systems that control the physical world. And many of those systems are in the building.

What happened

France: refrigeration as the target

According to French media, the refrigeration systems of between some 300 and more than 400 stores were hit. The attackers used a flaw in the software of installations made by Danfoss. The manufacturer had already reported that flaw on 18 September. The hackers put the installations into defrost mode and, on some units, raised the set temperature considerably. According to a trade publication, one store lost around € 220,000 worth of products. Small fires were also reported. The Paris public prosecutor has opened an investigation.

What did not happen is striking. No data was stolen and no ransom was demanded for files. An ordinary installation in the building was used to cause real damage.

The Netherlands: the digital chain breaks

At Albert Heijn, Etos and Gall & Gall, the incident began on Sunday afternoon, 11 October. The company speaks of a cybersecurity incident and shut down systems as a precaution. Online ordering and delivery were unavailable, personal discounts did not work and work stopped at part of the distribution centres. Stores had less fresh produce. Albert Heijn gives few details about the cause, because the investigation is still ongoing. You can read what is now known in the update below.

It shows how dependent an organisation is on its digital systems. When the digital part fails, customers notice it right down to the shelf.

Update: what we know now

Since the weekend, more has become known about both attacks. This is the situation on 13 October 2026.

Albert Heijn: suspicious traffic and a controlled restart

According to sources of the Dutch public broadcaster NOS, Albert Heijn saw suspicious traffic from hackers on its systems. That traffic ran through servers in the United States, Poland, Moldova and Turkey. This says nothing about where the attackers themselves are: attackers often route their traffic through other countries. Albert Heijn confirms that there is a cybersecurity incident, but gives no technical details. The company does share information about the attack with other companies, so that they can protect themselves.

The incident was not limited to the Netherlands. Delhaize in Belgium also had IT problems, and the websites of the American supermarkets of parent company Ahold Delhaize, such as Stop & Shop and Food Lion, were unavailable for some time.

In the stores, it was easy to see how far a digital incident reaches. Several distribution centres came to a halt, so fresh products in particular were missing. The electronic price labels on the shelves still showed last week's offers, so the price at the checkout could differ. On 13 October the price labels had been restored and several distribution centres were running again.

According to Albert Heijn, the systems are now being switched back on step by step and in a controlled way. So far there are no signs that data of customers or employees has been stolen. The company does warn about fake messages that pretend to come from Albert Heijn. Parent company Ahold Delhaize sees no reason to assume a link with the attack in France.

France: old controllers without updates

The Paris public prosecutor's office has opened an investigation, and ANSSI, France's national cybersecurity agency, is also involved. Manufacturer Danfoss says that the problem lies mainly in two types of refrigeration controllers that have reached the end of their service life. They no longer receive updates, but were still installed in the stores and could be reached from the internet. In at least one store, equipment from another manufacturer, Dixell, was also hit.

The problem was not new. Danfoss already warned about these controllers in 2025. Researchers then found 2,765 of them that could be reached from the internet. Experts also point to a hidden maintenance entrance in the software, through which an engineer could get access. The damage runs into millions of euros. In some places, the temperature in the refrigeration units rose to 50 °C. The advice of ANSSI is clear: disconnect such controllers from the internet, or shield them very strictly.

What can building owners learn from this?

• What is connected to the network, you notice in the building. Price labels, refrigeration and logistics all run on the network. If it fails, the shelves are empty. In an office, the same applies to access, climate and lighting.
• Equipment lasts longer than its updates. A controller in an installation often stays in place for ten years or more. The manufacturer stops updates sooner. So know which devices in the building still receive updates, and which do not.
• A maintenance entrance is also an entrance. Installations that the engineer can reach remotely can sometimes also be reached by an attacker. Find out which remote access exists, and close what is not needed.
• Shutting down quickly is only possible if networks are separated. Albert Heijn could switch off systems to prevent worse. That only works if it is clear which system is connected to what, and if installations and office IT are separated from each other.

These are exactly the points an IT-Label inspection looks at: which equipment is connected to the network, whether the networks are separated and how the building is secured.

Buildings today are full of computers. They are just called refrigeration, climate, access and cameras.

Why cybersecurity is becoming ever more important

More and more devices in a building are connected to a network. Think of the refrigeration, the climate system, the access gates, the cameras, the smart meters and the sensors that track how busy a space is. An installer can often reach them remotely to fix faults. That is convenient, but every connection is also a possible way in for an attacker.

At the same time, organisations are increasingly dependent on those systems. Offices run on cloud applications, video calls and online collaboration. Shops and warehouses run on stock systems and logistics. When the network fails, work stops. You can read more about this development in our knowledge base article on cybersecurity in real estate.

Cybersecurity starts with hardware and infrastructure

When people think of cybersecurity, many think of antivirus software, passwords and firewalls. Those matter. But they help little if the basics are not right. A firewall offers no protection if anyone can walk into the server room. These are the points where things often go wrong in a building:

• The server room and technical room. Is the room locked? Who has a key or badge? Is the network equipment perhaps standing in an open cabinet in the corridor?
• Physical access to the network. Can a visitor plug a cable into a free network socket and get onto the network that way? Is there electronic access control and are there cameras?
• Open wifi. A wifi network without a password, or a guest network that is not separated from the office network, is an open door.
• Installations on the same network. Are the refrigeration, climate system or cameras on the same network as the office computers? Then an attacker can move from one system to the other.
• Remote access. Which suppliers can log in from outside, and how is that secured? Are default passwords in use?
• Outdated equipment. Equipment and software that no longer receive updates remain vulnerable. In installations in particular, equipment often stays in place for ten years or more.

We wrote earlier about the physical side in the articles who can physically reach your network? and cybersecurity starts at the foundation of the building.

What the law now requires

Lawmakers have raised the bar considerably in recent times. Three laws are relevant here.

The Dutch Cybersecurity Act

Since 15 August 2026, the Cyberbeveiligingswet (Cybersecurity Act) has applied in the Netherlands. It is the Dutch implementation of the European NIS2 Directive. More than 8,000 organisations fall under it, in sectors such as energy, healthcare, transport, digital services, manufacturing and food.

• Duty of care. Organisations must take appropriate measures to secure their networks and systems. The European directive explicitly states that the physical environment of those systems must also be protected. That includes the server room, the technical room and who can get in.
• Reporting obligation. A serious incident must be reported within 24 hours, with a full notification within 72 hours.
• The supply chain. Organisations are also responsible for the risks at their suppliers. Think of the installer who logs in remotely to the refrigeration or climate system.
• The board. Directors are personally responsible for compliance. Cybersecurity is therefore not a matter for the IT department alone.

We explored what this law means for the building in the Cybersecurity Act and the digital building layer.

The Cyber Resilience Act

The Cyber Resilience Act is a European law for products with a network connection. That includes the controllers of refrigeration, climate and access systems in a building. Since 11 September 2026, manufacturers must report an actively exploited flaw within 24 hours. From December 2027, new products must meet security requirements. The attack in France ran through exactly such a flaw in a manufacturer's software. Read more in what the CRA means for real estate.

The GDPR

Could personal data have been viewed or stolen in an attack? Then an organisation must report this to the data protection authority within 72 hours. Even if the attack started at an installation in the building.

All three laws place the responsibility on the organisation or the manufacturer. Yet a large part of the risk sits in the building: in the server room, the network and the installations. A tenant can only meet the duty of care if it is clear how the building is put together.

What this means for tenant and landlord

In many buildings it is unclear who is responsible for what. The landlord thinks in terms of installations, the tenant in terms of its own IT. The building network that the refrigeration, climate system and access control run on often falls in between.

For the tenant, this means: ask before signing how the building is secured. Who can reach the server room, which networks are there and who manages them? For the landlord, this means: a building whose basics are demonstrably in order is more attractive to tenants that fall under the Cybersecurity Act. Agree together who manages what, so that nothing falls through the cracks during an incident.

What an IT-Label inspection looks at

The IT-Label assesses the digital infrastructure of a building. Security is part of that. During the inspection, a Certified Partner looks at, among other things:

• whether the server room and technical rooms can be locked;
• whether there is electronic access control and camera surveillance;
• whether there is visible network security, such as a firewall and secured equipment;
• which IoT equipment and sensors are connected;
• how the wifi network is set up;
• whether the networks are separated.

The outcome is reflected in the delivery level from PREMIUM to SHELL. This way tenant and landlord know where the building stands, and what still needs to be done.

We are honest about what the label is not. It is not a penetration test and not proof that an organisation complies with the Cybersecurity Act. The IT-Label assesses the building, not the tenant's own IT environment. But it does provide the foundation on which an organisation can build its security.

Want to know quickly where a building stands? The IT-Label pre-inspection gives an indication of the digital delivery level within a few days, from € 750 excl. VAT per location.

Six questions to ask now

• Who can reach the server room? Is it locked, and is it recorded who goes in?
• Is there open wifi? And is the guest network separated from the office network?
• Which installations are connected to the network? Refrigeration, climate, access, cameras: are they separate from the office IT?
• Who can log in from outside? Which suppliers have remote access, and how is it secured?
• Which equipment no longer receives updates? Are there controllers or other devices for which the manufacturer has stopped, and can they be reached from the internet?
• Who is responsible? Is it recorded what the landlord manages and what the tenant manages?

This weekend's incidents show that an attack does not always come in through the computer on the desk. Sometimes it comes through the cold store, the climate system or an open cabinet in the corridor. If you know the digital foundation of the building, you can close those doors in time.

Sources: RTS, Journal du Geek, Je bosse en grande distribution, Albert Heijn (media statement), NOS, ICT Magazine, NL Times, DutchNews, franceinfo, L'Usine Digitale, L'Avenir, Cyberattaque.org, NJB (Staatsblad 2026, 187), NCSC, ICTRecht, Stibbe, Jones Day, Digital Trust Center. This article was updated on 13 October 2026. The investigations at Albert Heijn and in France are still ongoing.