Grocery Giant Hit by Cyberattack, Stores Disrupted

Ahold Delhaize — the Dutch retail group behind Food Lion, Stop & Shop, Albert Heijn, and others — confirmed this week that a cyberattack forced it to take systems offline across its U.S. and European brands, according to The Record.

The company detected suspicious activity in its IT systems last week and filed a police report in the Netherlands on Monday. Physical stores stayed open throughout, but online shopping services took the hit. U.S. brands including Food Lion and Stop & Shop are still down at time of writing. Dutch brands Albert Heijn, Etos, and Gall & Gall restored their websites and apps, though home deliveries from Albert Heijn are not expected to resume until Friday. Services in Belgium and Central and Southeastern Europe are back online.

Ahold Delhaize says it has no evidence that customer, employee, or partner data was stolen — but the investigation is ongoing, and that picture could change. The company declined to say whether ransomware was involved or whether a ransom demand was made.

This is not the company's first incident. A 2024 attack on Ahold Delhaize resulted in the theft of information belonging to more than 2.2 million people.

What you should do: If you shop with any of these brands, keep an eye on your payment card statements over the coming weeks. No confirmed data theft yet, but the investigation is live. If you used a stored card with Stop & Shop or Food Lion, consider setting up transaction alerts with your bank now rather than waiting for a confirmation that may or may not come.

Copyright takedown requests filed on behalf of OnlyFans and other adult content creators are quietly revealing something far more interesting: which university and government websites have been compromised.

Researchers at UpGuard found that attackers are breaking into legitimate, high-trust websites — think .edu and .gov domains — and stuffing them with hidden content designed to manipulate search engine results, a technique known as SEO spam (manipulating what search engines show in order to drive traffic to attacker-controlled pages). When adult content creators file copyright notices against that pirated material, those filings become a searchable record of exactly which sites were hit.

The takeaways for security teams are concrete: copyright takedown databases are a usable source of historical compromise data, and high-authority domains are being actively targeted precisely because search engines trust them.

According to Dark Reading, this technique exposes organisations to reputational damage well beyond the initial intrusion.

What you can do: If your organisation runs a public-facing website, check Google Search Console for unexpected indexed pages. Attackers planting hidden content often leave traces there before anyone notices.

What Plex Media Server is: A self-hosted media application that lets you organise and stream your personal collection of films, TV shows, and music from your own hardware to any device.

What it is: CVE-2026-96655 is one component of a four-vulnerability chain called Plex2Shell, according to Security Week. When the four flaws are combined, an attacker can run arbitrary code (any commands they choose) on an exposed Plex server without needing a valid login. The code runs with the same privileges as the Plex service itself.

Who's at risk: Anyone running a Plex Media Server that is accessible from the internet and has not yet applied the September 2026 patch. Exploitation began within 24 hours of a public proof-of-concept being released.

CVSS: Not yet individually scored — treat as Critical until confirmed.

Root cause: The vulnerability chain exploits insufficient input validation across multiple components of the Plex server. Each flaw alone is limited; chained together, they allow an unauthenticated attacker to escalate from a simple request to full code execution. Think of it like a series of unlocked doors: no single one gets you into the vault, but walking through all four does.

Attack vector: An attacker sends crafted requests to an internet-exposed Plex server, working through the four-flaw chain without supplying credentials. Observed attacks have deployed a cryptocurrency miner (XMRig) and proxy software that routes attacker traffic through the victim's residential IP address — useful for bypassing corporate VPN and email security controls.

Detection strategies:

• Check running processes for XMRig or any process named myawesomeproxy
• Review outbound network connections for unexpected high-bandwidth traffic, particularly to mining pools
• Check Plex server logs for unauthenticated requests that result in unusual process spawning

Recommended actions:

1. Update Plex Media Server to the latest release immediately — Plex shipped fixes in September 2026
2. If you cannot patch right now, remove public internet access to your Plex instance until you can
3. Audit running processes and outbound connections on any machine hosting Plex

MITRE — a nonprofit research organisation that maintains one of the most widely used frameworks for understanding how attackers behave — released version 20 of its ATT&CK framework last week, according to Security Week.

The update is worth knowing about even if you are not a security professional. It now formally tracks how attackers abuse AI tools, steal application-specific passwords to bypass MFA (multi-factor authentication, the extra verification step beyond your password), and manipulate AI-assisted search results.

What this means for you: ATT&CK v20 adds entries for a specific type of password theft that lets attackers log in to services without triggering an MFA prompt. If any of your accounts offer "app passwords" for older integrations — common in email clients — review and revoke any you no longer use. That removes one avenue the new entries describe.

The free framework is available at attack.mitre.org.

The European Commission published its first harmonised standard supporting the AI Act this week — EN 18286:2026, covering quality management systems for high-risk AI, according to the European Commission.

Organisations that implement EN 18286 gain a presumption of legal conformity with Article 17 of the AI Act, which covers quality management requirements. The standard is designed to layer on top of existing frameworks like ISO 9001 rather than replace them. If your organisation develops or deploys high-risk AI in the EU, this is the first concrete compliance pathway available.