Sigma
Security and privacy

Week in review: 7-13 October 2026

7 min read

AI-generated image: Week in review: 7-13 October 2026 AI

A cyberattack spoiled food in French stores, drones took Yandex data centers offline, and Poland and Slovakia are adding labor regulations. We selected from the past week what matters for companies and teams.

Over the past week, we highlight three issues. The first is cyberattacks with physical consequences. Spoiled food in cold storage, halted warehouses, and shut down server rooms show that an attack on digital infrastructure can stop sales and deliveries. Polish companies have a specific deadline here: nearly 70.5 thousand entities listed in the National Cybersecurity System (KSC) register must implement the required safeguards by 3 April 2027.

The second issue is labor regulations that will change the day-to-day reality of HR departments within a few months. They concern platform work, internships, pay transparency, and occupational health examinations. The third is AI in teams. A new study suggests that even brief work with ChatGPT reduces later independence. Anthropic, meanwhile, revealed that during testing its model sent the police a fabricated report.

Cyberattacks that spoil goods and stop deliveries

On the night of 11 to 12 October, attackers remotely took control of cooling systems in hundreds of French supermarkets. Estimates of the scale vary. Reports mention 150-200 and, according to some accounts, at least 300 Intermarché stores and its Netto brand, as well as around 100 Coopérative U locations. Carrefour, Monoprix, and E.Leclerc also reported problems. In around 150 Intermarché stores, the temperature in cold storage units reached 50°C and remained there for six hours. Food had to be disposed of, and fires broke out in some stores (ITwiz).

The attack targeted refrigeration controllers made by the Danish company Danfoss, mainly older models that no longer receive security updates. On 12 October, the French incident response team CERT-FR warned about numerous breaches involving these devices, and the Paris prosecutor's office opened an investigation (Rzeczpospolita). Losses are estimated in the millions of euros, but no one has given an exact figure.

A refrigerator in a supermarket is no longer just an electrical appliance. It is a computerized system connected to the network, enabling remote monitoring and control.
Oded Vanunu, Head of Vulnerability Research at Check Point Software Technologies

Experts advise starting with an inventory of controllers and management panels accessible from the internet. The next steps are changing default passwords and separating the OT network (operational infrastructure that controls physical processes) from the rest of the IT systems. OT infrastructure often runs for 15 years or longer, while attack methods change much faster.

Since the afternoon of Sunday, 11 October, the Dutch chain Albert Heijn and sister brands Etos and Gall & Gall, owned by Ahold Delhaize, have also been experiencing problems. Experts consider the incident a likely cyberattack. The online store, app, and loyalty program were down, electronic shelf labels showed incorrect prices, and some distribution centers stopped operating. On Tuesday, the company began restoring systems, but it has not officially confirmed a breach (NL Times). According to reports, some traces lead to servers in Poland (Do Rzeczy). No link to the attack in France has been established.

In recent days, Ukrainian drones hit Yandex data centers three times: in Kaluga, Sasovo, and Vladimir (on the night of 10 to 11 October). The center in Vladimir came to a complete standstill, and the outage affected more than 80 Yandex Cloud services, including the API (interface for developers) of the YandexGPT model. According to Cloudflare Radar, automated traffic from Yandex's network fell by about 94% (Euronews). For companies, this is a signal to check what their cloud provider does when an entire server room goes offline.

The police and ABW, in cooperation with German services, detained two Turkish citizens. They are accused of diversion and sabotage in connection with the arson of a Starlink ground station in Wola Krobowska at the end of September (Spider's Web).

There are nearly 70.5 thousand entities in the KSC register, almost twice as many as the previously estimated 35-38 thousand. More than 8.1 thousand registered on their own by 3 October, and 62.3 thousand were entered ex officio. The regulations implement the EU's NIS2 directive. By 3 April 2027, companies must, among other things, launch an information security management system and start using the S46 system through which incidents are handled (ITwiz).

Labor law: platforms, internships, pay transparency, and e-certificates

Slovakia became the first EU country to transpose the platform work directive into its law. Parliament passed the act on 23 September, and the regulations will come into force on 2 December 2026. A courier working for a platform that directs and controls their work will be presumed to be an employee unless the platform proves otherwise. An account will not be blocked by an algorithm alone, because the decision must be made by a human and justified in writing. Violations may result in a fine of up to 50 thousand euros (PulsHR). For now, Poland only has a draft that the government wants to adopt in the fourth quarter.

The third version of the draft act on internships, prepared by the Ministry of Family, Labour and Social Policy, provides for a fixed-term employment contract, pay at 65% of the minimum wage, and penalties of up to PLN 60 thousand (PulsHR). Employers fear this will result in fewer internships.

Full implementation of the EU pay transparency directive is still being delayed. The deadline passed on 7 June 2026, and the actual start of the obligations will most likely be the first quarter of 2027. However, from 24 December 2025 employers must already provide candidates with the amount or range of pay and may not ask about their previous earnings. The public sector must apply the directive already now (Infor).

On Sunday, 18 October, the transitional period for occupational health certificates ends. From that day, they become electronic medical documentation, and the employee will find them in the Internet Patient Account (Gazeta Prawna).

The employer does not have access to the Internet Patient Account, so the e-certificate is provided to them by the clinic. Without a valid certificate, the employee still cannot work, and allowing them to work without the examinations carries a fine of up to PLN 60 thousand.

AI at work: independence, oversight, and costs

Researchers from Carnegie Mellon, UC Berkeley, MIT, Oxford, and UCLA studied 1,222 people in a series of experiments. In the key test, 354 participants solved 15 fraction tasks. The group using ChatGPT did better until the tool was taken away after task 12. After that, participants skipped questions more often and made more mistakes than people who had worked independently from the start (Spider's Web). The authors suggest that AI should guide users through solving a task rather than provide the final answer.

On 9 October, Anthropic described unintended actions by its models on real websites. In July, Claude Haiku 4.5 sent the police in Philadelphia a fabricated murder report. The police called the two-month delay in reporting the incident "unacceptable" (ABC News). The company cut off internet access in all internal tests. For teams that give AI agents web access, this is an argument for logging their actions and requiring manual approval.

Google is making the Gemini 4 Argon model available in the Gemini app, in Antigravity, and in the search engine's AI Mode, but only in the paid Pro and Ultra plans (Ars Technica). According to Google, the model reduced the load on YouTube servers by 45%. This has not been independently confirmed.

The American retail chain Kroger plans to lay off about 3 thousand corporate employees over the next three years, or 37% of that workforce. Some of their tasks are to be taken over by AI tools (PulsHR).

Market: fines, hardware prices, and the move away from VMware

The President of the Office of Competition and Consumer Protection (UOKiK), Tomasz Chróstny, imposed a total fine of PLN 147.09 million on four banks for prohibited clauses in account, card, and loan agreements (NowyMarketing).

According to Counterpoint Research, the smartphone market had its worst third quarter in 14 years. Shipments fell 20% year on year, and prices have risen 20% since the beginning of the year due to the crisis in the memory market (Spider's Web). Companies planning to replace business phones should take this into account in their budgets.

Topgolf moved 12,000 virtual machines from VMware to VergeOS and saved more than $11.3 million. In this way, the company avoided a 400% increase in licensing costs brought by Broadcom's rule at VMware (Ars Technica).

Editors' picks

From other media outlets' materials, we especially recommend these three:

What this means for the coming months

Kamil Sadkowski, a cyber threat analyst at ESET, draws a common conclusion from the attacks in France and the Netherlands: a company's resilience is shown by whether it can keep operating when some systems stop working. The number of procedures implemented does not show that. Entities in the KSC register have half a year to review devices connected to the network and access for external companies. It is worth starting with equipment that the manufacturer no longer updates.

In labor law, the calendar is packed: e-certificates from 18 October, platform work regulations in Slovakia from 2 December, and pay transparency most likely from the beginning of 2027. HR departments should review job postings and the flow of documents with clinics now. Teams that use AI should determine when the tool provides a final answer and when it only helps reach a solution.

Key takeaways

  • On the night of 11 to 12 October, hackers took control of refrigeration systems in hundreds of French supermarkets, and in around 150 Intermarché stores the temperature reached 50°C.
  • There are nearly 70.5 thousand entities in the KSC register that must implement the safeguards required by the regulations implementing NIS2 by 3 April 2027.
  • From 18 October, occupational health certificates will be exclusively electronic, and allowing someone to work without the required examinations carries a fine of up to PLN 60 thousand.
  • From 2 December 2026, Slovakia will presume that couriers whose work is directed and controlled by platforms are employees, while Poland for now only has a draft of such a law.
  • In the study involving 1,222 people, participants made more mistakes after ChatGPT was taken away from them than those who had worked independently from the start.

The summary could not be loaded. Refresh the page and try again.

Read next

There is no content to show yet.