As of October, Russia has up to 700 ballistic and several thousand cruise missiles in reserve, and its 2026 state order for Geran-type drones and decoys such as the Gerbera exceeded 100,000 units, Ukraine’s military intelligence (HUR) told NV in figures the outlet published on 20 October. The missile stocks are roughly the same as HUR reported to NV in July, the outlet found.
Ukraine enters the heating season facing what it says is a Russian plan to hit 60 infrastructure sites this winter. HUR’s figures suggest Russia has the weapons for it, even after its fall mass strikes. In June, HUR said Russia could fire up to 100 ballistic missiles a month while keeping its stocks steady. Its drone output, meanwhile, is shifting to jets that are harder to shoot down.
Russia produces 110 ballistic missiles a month
Russia can make more than 200 missiles a month, 110 of them ballistic, HUR said. About 115 of its ballistic missiles are Iskander-Ms, with production of up to 65 a month. A modernized Iskander with a projected range of 550 to 700 km is in development.
At the same time, Russia holds up to 400 S-300PM and S-400 air defense missiles adapted to strike ground targets, and makes about 40 a month. Meanwhile, Kinzhal production has been temporarily paused over poor accuracy, and the capacity has gone to conventional ballistic missiles.
Most new Kalibrs go into reserve
Russia plans to make more than 80 Kh-101 cruise missiles a month and is exceeding that, though defects in releasing them from aircraft have sent some batches back to the factories.
Russia has more than 450 Kalibrs and makes about 29 a month. Because Ukrainian air defense downs them effectively, Russia sends most new ones to its strategic reserve and to equip its fleets, HUR said. It also holds more than 600 Oniks anti-ship missiles, upgraded for ground strikes, and more than 120 Zircons.
Explore further
Ukraine recovers Russia’s undamaged Geran-3 jet kamikaze drone carrying camera and live-link equipment (VIDEO)
Russia now assembles 4,000 jet drones a month
Russia holds a reserve of about 6,200 Gerans and makes about 10,000 drones a month. Its main production hub is the Alabuga special economic zone in Tatarstan.
Since summer, Russia has shifted toward turbojet drones. “The reason is the saturation of Ukraine’s Air Force with mobile fire groups that shoot down low-speed targets en masse,” HUR said. Russia now assembles about 4,000 jet drones a month, mostly Geran-4s and Geran-5s, which fly at 400 to 500 km/h. It also makes about 2,000 cheaper propeller-driven Geran-2s, which HUR said are used to wear down air defense and locate air defense positions.
The Philippines is exploring deeper cooperation with Taiwan on protecting undersea cables and addressing "gray-zone" activity, despite Manila's one-China policy, which recognizes Beijing and not Taipei, a Philippine diplomat said on Wednesday.
Companies are announcing enormous new data centers to power the AI boom. Some promise facilities bigger than anything the industry has built before.
There's just one problem: Most of these projects may never happen.
Bernstein Research analyzed thousands of planned US data centers and concluded that only about 35% of the announced capacity is likely to get built. That's roughly 170 gigawatts of data center capacity out of a total of almost 500 gigawatts.
The rest? A significant chunk of it belongs to a category the industry has a wonderfully dismissive name for: "Bragawatts." These are ambitious announcements, often from newcomers with little experience building data centers, that have a slim chance of becoming reality.
"Press releases are cheap…concrete is not," Bernstein analysts wrote in a research note.
Bernstein began its analysis with more than 7,000 data center projects across North America, drawing on information from Aterio, a company that tracks construction through satellite imagery, permits, and other records. The analysts narrowed that to more than 5,000 projects (partly by excluding thosealready canceled).
Then they assessed the chances of these remaining projects being completed. The analysts considered factors such as whether construction had started, whether electricity was available, and whether the companies involved had successfully built data centers before.
The results revealed a striking divide.
The 'bragawatt brigade'
Kevin O'Leary.
Daniel Delgado Jr./Disney via Getty Images
Experienced operators including Amazon, Google, Microsoft, and Meta landed at the top. Bernstein gave these companies perfect scores of 5 out of 5 for their development credentials. Other data center specialists, such as Digital Realty, Equinix, and CoreSite, got top marks, too.
O'Leary Digital, associated with celebrity investor Kevin O'Leary, ended up at the bottom,with a credibility score of 0.35 out of 5, according to Bernstein. His company has announced 15 gigawatts of data center projects, and Bernstein estimates that only 489 megawatts, or about 3%, will actually materialize.
Although the term "bragawatts" has been doing the rounds in the data center industry lately, it's unclear who coined it, Bernstein analyst Madison Rezaei told me.
"I wish I could take credit for that," she said. "I believe I originally heard it from an Equinix executive, but I don't think he owned it either."
She said that whilesome ambitious newcomers could succeed, they haven't yet demonstrated they can deliver.
"It's not that all of these guys are sort of terrible and not going to deliver, but we just have lower confidence because we don't know them," Rezaei said.
O'Leary Digital responds
O'Leary Digital disputed Bernstein's assessment, saying the research doesn't account for substantial work that occurs before construction begins.
While acknowledging that O'Leary Digital is a young company, CEO Paul Palandjian said the team has decades of experience building major infrastructure projects and that its proposed 15 gigawatts of capacity would be built in stages over several years.
The company said it has secured binding agreements covering about 11,000 acres in Utah and 13,000 acres in Alberta, obtained a 30-year development agreement in Utah, and made progress on planning, engineering, and permits at both sites. It also said the projects would generate their own electricity.
The company said its early development work is funded, additional capital is committed to reaching key milestones, and experienced engineering and construction partners are involved.
"We would rather be judged on milestones than on a model," Palandjian said.
'An announcement in search of a project'
Opponents of the proposed La Osa data center attend a Pinal County Board of Supervisors meeting in Florence, Arizona, on August 26.
USA TODAY Network via Reuters Connect
Other low scorers in the "bragawatt" brigade included Vermaland and Joule Capital Partners, according to Bernstein analysis based on Aterio data.
Joule has announced 50 data center projects with a combined capacity of 11.7 gigawatts. Bernstein estimates that only about 11% of that capacity will actually get built. Almost all of Joule's planned capacity remains at the announcement stage, with little evidence of construction progress or of major customers committing to use the facilities, Bernstein wrote in a July note to investors.
The analysts gave Joule a credibility score of 2.05 out of 5, placing it among the lowest-ranked developers in its database.
"An announcement in search of a project," the analysts wrote.
Vermaland has announced plans for a massive data center project in Arizona. Bernstein estimates that only 4% of its proposed 2.2 gigawatts of capacity will get built. The company is primarily a landowner, not a data center developer. Its proposed $33 billion La Osa project near Eloy had already been sharply scaled back amid local opposition and without construction approval. In late August, regulators formally rejectedthe project. Even before that, the analysts gave Vermaland a credibility score of 0.75 out of 5.
Joule and Vermaland didn't respond to emails seeking comment this week.
A yawning gap for data centers
Sergio Toro, CEO of Aterio, sees similar patterns in his firm's voluminous, detailed data.
Aterio's tracking shows that roughly 30 to 40 gigawatts of new data center capacity get announced each month. Yet only about 7 gigawatts begin construction each month, while 2 to 3 gigawatts actually start operating.
This leaves a yawning gap.
Many announced projects get withdrawn before construction begins — and before real money has been spent.
"They just make the announcement, but they didn't get their approvals. Or they make multiple filings in multiple locations to see which one gets selected," Toro told me. "That's why we track with satellite if there's real movement on the ground or not."
Indeed, Bernstein analysts wrote recently that the amount of "stranded" data center capacity has surged. These are projects that are either canceled, delayed, or not approved.
The AI boom's three tiers
Toro sees three broad groups competing to build AI infrastructure.
At the top are the established technology giants, including Amazon, Microsoft, and Google. They've built data centers for decades and generally deliver on their commitments. Most of their projects will get done, he said.
In the middle are "neoclouds," newer companies such as CoreWeave that rent out computing power specifically for AI. Although they're more vulnerable to financing problems and delays, many are making solid progress, especially because some of these players already have access to electricity.
"We see them advancing quite well," Toro said. "Sometimes we see some delays, but it's not something significant or any kind of big capacity that is at risk."
Then come the newcomers making extraordinary promises. That's where most delays and cancellations happen, Toro said.
Even Amazon needs a backup plan
A technician works at an Amazon Web Services AI data center in New Carlisle, Indiana.
Noah Berger/Getty Images via Amazon Web Services
Not every project that disappears was a fantasy, though. Even a top player like Amazon struggles sometimes to secure electricity and other supplies on time for these huge projects.
The biggest, most experienced tech companies deliberately pursue more potential data center capacity than they need because they know some developments will fail or get delayed.
Major AI companies were committing to three or four times the space and electricity they needed over the following two years, Jeffrey Moerdler, a data center lawyer, estimated during an interview with Bernstein analysts.
His reasoning: Of data center projects that haven't started construction, roughly a third will arrive on schedule, another third will be delayed, and the remainder won't happen.
Rezaei and Toro estimate that the top players don't over-commit that much — more like double the capacity they need at most.
The strategy provides a "Plan B," as Toro put it, in case of delays involving electricity, equipment, permits, local opposition, or other factors.
Texas has a ghost problem
The Decker Creek Power Station in Austin.
Brandon Bell/Getty Images
This helps explain another extraordinary number.
Data center companies have requested connections for roughly 450 gigawatts of electricity demand on Texas' main power grid, more than five times the grid's roughly 85 gigawatts of existing capacity, according to Toro and others.
Many of those requests are placeholders rather than firm construction plans. Toro calls them "ghost projects."
These speculative projects clog the waiting lists for electricity connections, making the electricity shortage look a lot worse than it actually is.
"Developers routinely spam projects across several sites, and many are speculative builds with no customer yet," Ryan McEntush, a partner at venture capital firm Andreessen Horowitz, wrote in a recent blog. "Often these new developers have never even plugged in a GPU, let alone a power plant."
Texas has paused applications to review and weed out projects that aren't serious. Toro, from Aterio, expects this to favor the established players at the expense of the bragawatts.
The real AI boom
None of this means the AI infrastructure boom is imaginary.
Aterio tracks thousands of buildings, including major projects already under construction. Bernstein estimates that nearly 80% of the capacity the largest technology companies are directly developing is credible.
And when speculative projects disappear, Rezaei doesn't expect a wave of unpaid debt. Many will fail before building begins, the stage when developers borrow serious money through project financing.
Some of those missing data centers were never really coming in the first place.
The company announced a new category of non-voting Class C stock in its third-quarter earnings report. It listed several reasons for creating the new class — one of which is to keep the CEO in control.
A Special Committee established by Meta's board determined that Zuckerberg was the best fit to lead the company into its future, and highlighted the CEO's creative vision and management abilities.
"The creation of the Class C common stock will continue the founder-led model that has driven the company's success since its inception," Meta said.
The stock class will also provide Meta the ability to finance its growth, the earnings report said. Meta is spending big on AI and the data centers needed to power it. The company reported $34.91 billion in third-quarter capital expenditures.
Meta's press release said the distribution would effectively amount to a two-for-one stock split for existing shareholders. Susan Li, Meta's chief financial officer, said that the stock will be distributed to existing shareholders.
Other tech companies have issued stock to access new capital without diluting their CEO's voting power. Google performed a stock split in 2012 for a similar reason. Semafor was first to report the new stock class.
Zuckerberg has long been the face of Meta. He's strengthened his leadership through the AI boom, going "startup mode" and getting hands-on with the tech. The company's AI team set up their desks around where Zuckerberg sits.
The success of Muse, Meta's AI agent, has raised the profile of another Meta executive: Alexandr Wang. The chief AI officer has joined Zuckerberg for podcasts and spoken onstage at keynotes.
A Financial Times profile last week touted Wang as a "potential successor to Zuckerberg." It's clear the board wants Zuckerberg there for the long haul.
France, Germany, Austria and Poland are expanding or reviewing the authority of critical infrastructure operators to defend facilities against drones, raising legal and operational questions over the growing role of civilian companies in national security.
European governments are reconsidering who should be authorised to intercept hostile drones as energy companies and critical infrastructure operators confront an increasingly serious threat to electricity networks, transport systems and other essential facilities.
France has already introduced legislation permitting approved operators to deploy counter-drone systems, while Germany is reviewing similar arrangements and Austria has announced plans to extend certain protective powers to infrastructure companies.
Poland has moved further by authorising designated security units to disable or destroy drones entering restricted areas around important energy installations.
The changes reflect concerns that national police and armed forces cannot provide permanent protection for every substation, power station, railway facility or pipeline against relatively inexpensive unmanned aircraft.
France establishes a new approach
In August 2026, the French parliament approved legislation allowing authorised operators of critical infrastructure and their contractors to detect, jam and intercept drones near designated facilities.
The legislation followed a series of reported drone incursions over sensitive locations, including military installations.
Under the French approach, operators of strategically important infrastructure may eventually use approved counter-drone systems without relying exclusively on the immediate intervention of military personnel.
Potential beneficiaries include electricity operators and organisations responsible for transport infrastructure.
French authorities are testing detection equipment, electronic countermeasures and interceptor drones at Brétigny-sur-Orge, south of Paris.
The programme examines systems capable of identifying approaching aircraft, determining whether they present a threat and initiating an appropriate response.
France intends to expand the protection of sites classified as strategically important, with further deployment planned during 2027.
The initiative would introduce responsibilities traditionally associated with military or police operations into the management of civilian infrastructure.
Germany and Austria reconsider existing restrictions
Germany is examining the legal conditions under which private companies and infrastructure operators could participate in active counter-drone operations.
At present, responsibility for neutralising threatening aircraft remains primarily with the competent public authorities.
The debate has intensified following security incidents involving unmanned aircraft, including the discovery of an explosives-laden drone near a Ukrainian cargo aircraft at Leipzig/Halle airport in August.
German authorities attributed the incident to Russia, an allegation Moscow denied.
The German government’s review concerns not only the equipment that companies may possess but also whether trained security personnel should be permitted to deploy countermeasures without waiting for a separate police authorisation.
Austria announced plans in September to extend comparable powers to selected critical infrastructure operators, including major energy companies.
The government has acknowledged the practical limitations of protecting a large number of widely dispersed installations using state security personnel alone.
Poland has already established restricted drone zones around sensitive energy facilities, with designated security units authorised to intercept aircraft entering those areas under applicable national rules.
Electricity networks face particular risks
Electricity infrastructure presents a difficult security problem because essential installations are distributed across extensive geographical areas.
Transmission operators manage thousands of kilometres of high-voltage lines, while substations, transformers and switching stations connect generation facilities to consumers.
A successful attack against critical equipment can produce consequences extending well beyond the immediate site.
Large power transformers are particularly difficult to replace. Manufacturing, transporting and installing specialised equipment can require lengthy preparation, making rapid recovery uncertain after serious damage.
European utilities have traditionally concentrated on physical security, maintenance and restoring services after technical failures or accidents.
The spread of drones creates additional demands for surveillance, early warning and the ability to respond before an attack reaches its target.
Russia’s repeated strikes against Ukraine’s electricity infrastructure have demonstrated the extensive disruption that attacks on power systems can cause.
European governments are now evaluating how comparable vulnerabilities could be exploited against their own networks.
Electronic jamming can interfere with communications and navigation systems beyond the targeted aircraft. A drone brought down over an industrial or residential area could injure members of the public or damage surrounding property.
Security personnel must also determine whether an unidentified drone is hostile, operating unlawfully or simply present because of an error by its operator.
A mistaken interception could expose infrastructure companies to compensation claims and other legal consequences.
European governments must therefore establish who can authorise an intervention, which countermeasures are permitted and how responsibility is allocated when damage occurs.
There is no uniform European approach.
Some operators support expanding their protective powers, while others argue that the use of force should remain the responsibility of the state.
Finland’s national electricity transmission operator, Fingrid, has expressed reservations about transferring such authority to energy companies.
The position reflects a wider concern that infrastructure operators should concentrate on maintaining essential services rather than assuming responsibilities for armed or coercive security operations.
A growing European security market
The regulatory debate is developing alongside a rapidly expanding market for counter-drone technology.
Manufacturers are offering equipment that integrates radar, optical sensors, electronic detection and software capable of classifying possible threats.
Interceptor drones and electronic countermeasures are increasingly being designed for use around civilian infrastructure rather than exclusively on military installations.
German defence company Rheinmetall has reported growing interest from private infrastructure operators in counter-drone protection.
However, the technology is advancing faster than the legal frameworks governing its use.
The immediate challenge for European governments is to establish protective arrangements that allow rapid intervention while preserving clear accountability.
A counter-drone system can identify an approaching aircraft within seconds. Determining who is authorised to stop it remains a matter for national law.
The company spent $34.91 billionin capital expenditures during the third quarter of 2026. That's up from the second quarter's sum, $31.08 billion.
For the year 2026, Meta said it expects to spend between $135-145 billionin capital expenditures, narrowedfrom its prediction of $130-145 billion last quarter.
Meta's forecast includes the yearly capex prediction that analysts expected: $139.79 billion.
As Meta bets big on AI, it is investing heavily in its development. It has built massive, costly data centers and spent big on computing power.
The spending uptick was expected. On the "Cheeky Pint" podcast earlier this month, CEO Mark Zuckerberg recounted early conversations about the investment — and said he'd bet up to $200 billion on AI, before he knew the models would work.
Investors haven't loved Meta's massive capex forecasts in past quarters. The stock tumbled almost 10% last quarter after earnings per share missed Wall Street estimates, and sank 6% the quarter before on raised capex guidance.
This quarter, Meta has a new hero product: Muse.
The AI assistant has reached over 2 million daily users and 3 million downloads. It quickly scaled the App Store. Muse users told Business Insider they chatted with it to help plan trips and ace exams.
The energy around the company is ebullient, as Alexandr Wang, Meta's chief AI officer, continues to post memes of Muse's squishy-looking mascot.
At Meta's Connect keynote event in September, Zuckerberg said Muse "has a novel business model."
"We believe that Muse will make you money, and we're standing behind this by making Muse free for a huge number of tokens with the expectation that over time, we will profit by taking a small fee from transactions," he said.
Muse could help justify the capex guidance for some investors. The stock was trading up 4.12%after-hoursat the time of publication.
Acting Naftogaz CEO Serhii Fedorenko said that Russia had struck the company's facilities more than 400 times since the beginning of 2026 — twice as often as during the same period last year.
Stratford International train station in east London will receive funding in next week’s budget, according to reports, putting it on track to live up to its name and become a hub for cross-Channel services.
London’s mayor, Sadiq Khan, has been making a case to ministers for funding to upgrade the station to allow it to start running international rail services.
AWS expected to get $5 billion of Nvidia GB300 racks, followed by $3 billion more each month.
Some of these GPU systems are being stored elsewhere due to lack of data center power.
Amazon CEO Andy Jassy sees AI as a major opportunity, but getting capacity online is a challenge.
Amazon is racing to secure AI hardware earlier than before, even as data center power shortages leave some GPU systems waiting in warehouses.
Under a new Early Rack Receipt process, AWS expected to receive roughly $5 billion in Nvidia's GB300 server racks at US facilities before final deployment, according to August internal emails reviewed by Business Insider. The company projected roughly $3 billion more in GB300 racks each month "for the foreseeable future," one of the emails said.
Some AWS sites had room for more racks but not enough available power to turn them on, people familiar with the effort said, leaving finished equipment to be staged at intermediary warehouses until the facilities were ready.
At least one AWS team did not have "a clear forecasted path" for getting the incoming racks into data centers at the time, according to one of the emails.
Dark GPUs
A lack of new electricity capacity is one of several bottlenecks slowing the buildout of some AI data centers. This has led to a phenomenon known as dark GPUs, where AI chips and servers are purchased but can sit idle due to power supply issues or other challenges. (Dark GPUs can also refer to system design flaws that mean this gear isn't fully used after being plugged in).
This is partly why financial pressure is mounting on big data center projects. Money must be spent upfront to secure supplies of Nvidia GPUs and other valuable AI components. But if some data centers aren't ready to run, those early investments can tie up huge amounts of cash. Debt financing can fill in the gaps, but the market has become less willing to lend against some of these projects lately.
Trade-off
Amazon's early-rack program is one piece of the cloud leader's broader AI buildout, which is putting new pressure on its cash flow, as Business Insider exclusively reported this week. Amazon expects roughly $220 billion in capital expenditures this year — more than any Big Tech peer. Its free-cash-flow turned negative last quarter for the first time since 2023, and could stay negative for a while.
For AWS, the trade-off is securing scarce GPU racks before competitors do, even if some data centers are not yet ready to turn them on. But taking ownership earlier can tie up billions in equipment before it starts generating cloud revenue.
Previously, AWS took ownership of a finished rack only upon delivery to a data center, according to internal documents. Under the new approach, it can pay for and record certain racks earlier in the supply chain.
An Amazon spokesperson said the company routinely stages finished hardware near deployment sites so it can install it once capacity becomes available, calling the practice "best business practice." The spokesperson added that Amazon has long-established systems for tracking infrastructure assets and disputed that the broader company lacked a path for getting racks into data centers.
Amazon CEO Andy Jassy previously said the company has a "clear line of sight" to strong returns from its AI investments, calling the technology a "once in a lifetime opportunity."
"We've been through this cycle with the first big AWS growth wave, and liked the results," Jassy wrote in Amazon's annual shareholder letter. "We expect to feel similarly about this next wave."
To avoid overloading previously damaged equipment, power limitation schedules for industry will be applied across all of Ukraine, as well as hourly outage schedules in some regions, Ukrenergo announced.
Transport hub will offer through trains between Leeds and Manchester with ‘turn-up-and-go’ service
A new railway station will be built in Bradford to “transform how people travel across the north”, the government has announced.
The station will be at the heart of the Northern Powerhouse Rail (NPR) scheme, built on the current Bradford Interchange site but allowing through trains between Leeds and Manchester.
Dutch-Belgian supermarket group Ahold Delhaize has confirmed that malicious activity was responsible for the cybersecurity incident that disrupted its operations across Europe and the United States, forcing the company to take websites, applications and other computer systems offline.
In an official statement issued on Monday, 19 October, the company announced that it had filed a formal complaint with Dutch police and was cooperating with national cybersecurity authorities. Although physical supermarkets have remained open, the disruption has affected online shopping, deliveries and some distribution operations.
The company said investigators had so far found no evidence that sensitive information belonging to customers, employees or business partners had been taken. However, its investigation remains open, and the identity and objectives of those responsible have not been publicly established.
Online services interrupted across several countries
The disruption began on 12 October, when Ahold Delhaize detected suspicious activity within its information technology infrastructure.
The group responded by taking a number of systems offline as a precaution, affecting most of its retail brands in Europe and the United States. The consequences varied considerably between businesses, with some experiencing prolonged interruption to digital services while others were able to restore operations more quickly.
Albert Heijn, the Netherlands’ largest supermarket chain, has been particularly affected. Its website and mobile application have returned online, but home grocery deliveries are not expected to resume until Friday, 23 October.
Orders scheduled before that date have been cancelled, while the company continues preparations for a gradual restoration of its online delivery service.
The incident also interrupted some supply and distribution arrangements, resulting in shortages on supermarket shelves in parts of the Netherlands and Belgium.
In Belgium, Delhaize has restored its online shopping operations. Certain promotional and personalised services were still experiencing difficulties, although the parent company confirmed that its Belgian e-commerce business was operational again.
Dutch retailers Etos and Gall & Gall have also restored their websites. Meanwhile, several American supermarket brands owned by Ahold Delhaize have continued to experience service interruptions.
The group said it expected additional online services in the United States to become available over the coming days.
Dutch authorities investigate
Ahold Delhaize said it notified the Netherlands’ National Cyber Security Centre within 24 hours of detecting the malicious activity.
The company has subsequently provided updates to the authorities and, on Monday, confirmed that a formal police report had been submitted.
Chief executive Frans Muller defended the decision to shut down digital systems, arguing that the investigation had demonstrated the necessity of taking preventive action.
The company has not identified the perpetrators, confirmed whether ransomware was involved or disclosed the technical method used to gain access to its infrastructure.
These distinctions are important because malicious activity does not necessarily establish that information was stolen or that attackers obtained control over every system subsequently taken offline.
The retailer has instead described a controlled restoration process intended to ensure that affected systems can be brought back into operation without exposing the business to further risks.
Ahold Delhaize operates thousands of supermarkets and related retail businesses, including Albert Heijn, Delhaize, Food Lion, Giant Food, Hannaford and Stop & Shop.
Its geographical reach means that a disruption originating within shared corporate infrastructure can affect several national markets, even where individual retail chains maintain separate commercial operations.
Cybersecurity becomes a supply-chain concern
The attack comes amid increasing scrutiny of the vulnerability of European food retailers to digital disruption.
Earlier this month, investigators in France began examining cyberattacks against refrigeration control systems used by hundreds of supermarkets.
Those incidents reportedly affected equipment at chains including Carrefour, Intermarché and Monoprix, with some retailers forced to discard products after refrigeration systems malfunctioned.
There is no established connection between the French incidents and the attack affecting Ahold Delhaize.
Nevertheless, both episodes illustrate the dependence of modern retail operations on interconnected digital systems supporting stock management, refrigeration, logistics, payments and customer services.
The consequences of a serious cyber incident can extend beyond the loss of access to websites. Interruptions to inventory systems, warehouse operations or communications with suppliers can affect the availability of physical products.
This creates particular difficulties for food retailers, where delays in transport and storage can result in the loss of perishable goods.
European regulatory implications
The incident also draws attention to the European Union’s NIS2 cybersecurity framework, which establishes stricter risk-management and incident-reporting obligations for organisations operating in designated sectors.
Food production, processing and distribution are among the activities covered by the directive, although its application to particular companies and operations depends on the relevant legal definitions and national implementing arrangements.
The legislation requires organisations within its scope to establish appropriate cybersecurity protections, address supply-chain risks and notify competent authorities of significant incidents.
Separately, the General Data Protection Regulation establishes notification requirements where personal-data breaches meet the relevant reporting threshold.
Ahold Delhaize’s statement that it has found no evidence of sensitive data being taken does not conclude the technical investigation, but it means that a confirmed theft of personal information should not presently be presented as a fact.
For the company, the immediate challenge remains restoring online services while maintaining normal supermarket operations. The wider commercial consequences, including the cost of the interruption and its effect on sales, have not yet been quantified publicly.
A cyberattack affecting approximately 700 supermarkets in France has exposed serious weaknesses in the digital systems used to control commercial refrigeration, raising concerns about the vulnerability of European food distribution networks and other essential infrastructure.
The attack began overnight on 11–12th October, when intruders gained access to remotely managed refrigeration equipment and altered operating settings, causing refrigerators and freezers to overheat.
Stores belonging to several major supermarket chains were affected, including Intermarché, Netto, Coopérative U, Carrefour and Monoprix. Some were forced to discard substantial quantities of fresh and frozen food.
French Finance Minister Roland Lescure confirmed that approximately 700 of the country’s 10,000 supermarkets had been affected, although the severity of the disruption varied between locations.
The Paris prosecutor’s office has opened an investigation into the attack, including the damage caused by destroyed merchandise and reported fires.
The incident has drawn attention to industrial control systems that are routinely connected to the internet but may receive less cybersecurity protection than corporate networks and customer databases.
Refrigeration systems remotely manipulated
Investigators have established that refrigeration equipment was targeted through vulnerabilities associated with remote monitoring and control systems.
Some of the affected systems used older equipment that no longer received regular security updates.
According to information released by the companies and cybersecurity specialists, certain industrial controllers had been accessible through public internet connections, creating opportunities for unauthorised access.
Hackers reportedly manipulated defrost cycles and increased temperature settings, preventing equipment from maintaining the cold conditions required to preserve food.
The attack affected approximately 300 Intermarché and Netto stores, while Coopérative U reported disruption at around 80 outlets.
Several retailers managed to contain the damage, but others lost substantial quantities of stock.
The consequences extended beyond malfunctioning equipment. Businesses faced the cost of replacing spoiled food, repairing refrigeration systems and restoring normal operations.
The precise financial damage is still being assessed, although estimates from the retail sector indicate that losses across France could amount to tens of millions of euros.
Vulnerabilities in connected equipment
The incident illustrates the security problems created by the growing use of internet-connected industrial equipment.
Modern refrigeration installations allow contractors and maintenance specialists to monitor temperatures, adjust settings and diagnose faults remotely.
These arrangements can reduce operating costs and improve efficiency, but they also create additional access points that attackers may exploit.
Cybersecurity specialists have identified vulnerabilities in commercial refrigeration platforms manufactured by Danfoss and Copeland.
The manufacturers subsequently addressed identified flaws, although older or unsupported equipment remained a concern.
A critical problem for businesses is that industrial machinery often remains operational for many years after its original software has become obsolete.
Replacing entire refrigeration installations can involve substantial expense and operational disruption, encouraging operators to retain equipment that may no longer meet contemporary cybersecurity standards.
The risks are particularly difficult to manage when responsibility for maintenance, software updates and network security is divided between retailers, equipment suppliers and external contractors.
France’s delayed cybersecurity legislation
The attack has renewed scrutiny of France’s implementation of the European Union’s NIS2 Directive, which is intended to strengthen cybersecurity across sectors providing important economic and public services.
Its scope extends beyond traditional critical infrastructure such as energy, telecommunications and transport to include certain businesses involved in food production, processing and distribution.
EU member states were required to incorporate the directive into national legislation by 17 October 2024.
French cybersecurity specialists have since warned that delays have complicated efforts to establish consistent obligations for organisations operating industrial and commercial systems.
However, NIS2 does not automatically cover every supermarket. Its application depends on the nature and size of an organisation and the provisions of national implementing legislation.
The incident therefore raises questions not only about the pace of legislative implementation but also about the practical protection of equipment already in use.
Wider implications for European infrastructure
The disruption demonstrates how a cyberattack can cause physical damage without directly targeting a conventional industrial facility.
Unlike breaches intended to steal customer information, the French incident interfered with machinery responsible for preserving essential products.
The distinction is important for European policymakers, who increasingly face threats to infrastructure that combines digital controls with physical operations.
The European Union’s cybersecurity agency ENISA has organised cross-border exercises to test how authorities and companies would respond to disruption affecting essential services.
The attack itself has been established, but responsibility for it has not been publicly attributed.
French authorities have said there is no immediate threat to national food supplies. Nevertheless, the destruction of merchandise and interruption of ordinary retail operations have demonstrated the potential economic consequences of weaknesses in relatively commonplace equipment.
The continuing investigation must establish how access was obtained, which systems were compromised and whether the vulnerabilities were known to operators before the attack.
For Brussels and national regulators, the case provides a practical test of whether European cybersecurity legislation can translate into effective protection for the connected equipment on which ordinary commercial activities increasingly depend.
As regular Russian strikes on energy facilities leave parts of Kyiv without running water, fears are mounting that further power outages could spark a serious humanitarian and public health crisis in Kyiv.
Russia attacked Kyiv with ballistic missiles in two waves overnight on 18–19 October. Information from partners did not arrive before the first wave, at around 23:00, Air Force spokesperson Yurii Ihnat said on national television. A warning came before the second wave, at around 03:00, but the window was short, he told NV.
Hours earlier, Ukrainian President Volodymyr Zelenskyy told NBC that US warnings of Russian ballistic launches were working again after three days without them, and that only the United States has that intelligence. Those warnings have for years given Ukrainian authorities several minutes to sound alarms and let civilians reach shelters before ballistic missiles hit.
“Once again, a Russian ballistic attack in several waves overnight, and once again there was no warning from partners,” Zelenskyy wrote. It was at least the third ballistic strike on Kyiv in a week to begin without warning from partners, following attacks on 12 October and 13 October.
Metro station damaged on Kyiv’s left bank
One person was killed and eight injured in Kyiv, Ukrainian Prime Minister Serhii Koretskyi said. A strike damaged a metro station on Kyiv’s left bank, and debris broke the rails beside it, Mayor Vitali Klitschko said. City authorities said the damaged station was above ground, closed Chernihivska and Lisova stations, and said red-line trains would run only between Akademmistechko and Darnytsia. The attack also damaged a 25-story building, a medical facility, and the Cosmo Multimall shopping center in the Solomianskyi district, NV reported, and Zelenskyy said a school was hit too.
The attack also damaged one of Ukraine’s main ice arenas, on Shalett Street in Kyiv, which hosts Ukrainian championship hockey games and youth training, hockey Telegram channel Flamingo reported. Parts of the facade, metal structures, and roof were damaged, but the ice surface showed no significant visible damage, according to preliminary information, Suspilne reported.
Damage in 11 oblasts, three missing in Irpin
Koretskyi said energy and infrastructure were the main targets, with damage in 11 oblasts. Russia also hit warehouses of medicines, railway stations, shops, and homes, he said. In Kyiv Oblast, Russian strikes injured six people in Irpin, including three children, and three more were missing, oblast head Tymur Tkachenko said. In Kharkiv Oblast, six people were injured, including two children, Koretskyi said. In Rivne Oblast, four people were injured, and one of them was hospitalized, regional police reported.
Zelenskyy said that more than 10 energy facilities were damaged and at least 550,000 families lost power. Ukrenergo reported new outages in 10 oblasts: Volyn, Zhytomyr, Rivne, Ternopil, Khmelnytskyi, Vinnytsia, Kirovohrad, Kharkiv, Odesa, and Mykolaiv. In Volyn Oblast, about 15 jet-powered Shahed-type drones targeted the region, and around 66,000 customers were without power on the morning of 19 October, oblast head Roman Romaniuk said. Kovel, Manevychi, and Lutsk were hit hardest, and no casualties were reported. In Vinnytsia Oblast, a critical infrastructure facility in Koziatyn was damaged, and power there would stay unstable for some time, city council secretary Iryna Repalo said, Suspilne reported.
Zelenskyy said Russia fired 16 ballistic missiles at Kyiv and Kyiv Oblast. The Air Force reported that Russia also used Iskander-K cruise missiles and 269 drones, and that by 09:00 air defenses had shot down or suppressed four Iskander-K cruise missiles and 243 drones. Its preliminary count did not list any ballistic missiles among the intercepted targets.
Rubio denies any pause and points to a software problem in Ukraine’s warning system
On 19 October, Rubio told reporters in Samarkand, Uzbekistan, that “there’s been no pause” in intelligence-sharing with Ukraine, Reuters reported. He said he did not know where Zelenskyy was getting such claims and that he should focus on ending the war. He also said he did not know whether a failure had happened the previous night, but that a few nights earlier there had been a software problem with “their early warning system,” and that US European Command was looking into the strikes, The Guardian reported. US officials had not mentioned a software glitch before, and in at least one case Ukraine was told that bad weather over southern Russia had hidden launch preparations, the newspaper noted.
Ihnat said Ukrainian specialists and their partners were working to establish why information about the first launch had not arrived. He added that similar gaps had occurred during earlier attacks.
Zelenskyy wrote that when missile supplies for Ukraine’s air defense are blocked while Russia gets sanctions relief or delays, “this is, unfortunately, a denial of reality on the part of partners.” A night earlier, Russia had hit Ukraine’s energy system again, while Ukrainian drones set fire to St. Petersburg’s oil terminal despite Washington’s pressure to stop refinery strikes.
Russia has started fitting its enlarged Gerbera-2 drones with a 10-kg warhead and an extra bag of incendiary mixture, Ukrainian military outlet Militarnyi reported on 18 October. The setup is designed to start a fire where the drone hits and is probably meant for attacks on critical infrastructure and warehouses, the outlet said.
Russia’s industry makes about 3,000 jet-powered Geran-4 and Geran-5 drones a month, Ukraine’s military intelligence has said, and Russian strikes have destroyed 2.1 million m² of Ukraine’s modern warehouse space since the full-scale invasion began. A cheap drone that carries fire adds one more threat for air defenses that already let nearly half of Russia’s jet-powered Shaheds through.
A fire bag behind the warhead
Ukrainian Telegram channel Polkovnyk HSh posted photos of the payload on 17 October. Gerbera-2 strike and reconnaissance drones had begun to appear with a 10-kg high-explosive fragmentation-incendiary warhead and an extra package of incendiary mixture, the channel wrote. They navigate with Kometa-M12, a 12-element antenna array designed to resist jamming, it added.
Explore further
Russian drones set their own detonators at altitude: Why cutting wires won’t save from new Gerberas?
In the photos, the incendiary mixture sits in a separate soft plastic tank behind the main warhead, Militarnyi said. Gerbera-2s have been seen with warheads of 4 to 10 kg depending on range, while strike versions of the original Gerbera usually carried up to 5 kg, the outlet noted.
Half a Shahed engine
Russia has mainly fielded the Gerbera, a cheap drone shaped like a Shahed, as a decoy and reconnaissance platform flying alongside Shahed-type strike drones. It has also used bigger Gerberas to drop FPV drones.
Serhii Beskrestnov, now an adviser to Ukraine’s president, flagged a much bigger Gerbera in Ukraine’s skies on 7 August. The Gerbera-2 has a larger airframe, a reshaped wing, and a bigger tail fin, Militarnyi said. In August, the outlet reported it had a stronger piston engine: half of the one in the Shahed-type Geran-2, at about 275 cm³. Production of these engines was set up at the Izhevsk Motorcycle Plant, according to preliminary information the outlet cited.
Explore further
Russia equips Geran attack drones with image-based navigation using Google map imagery, reducing reliance on satellite navigation that Ukraine can jam, defense adviser warns
Earlier versions ran on a Chinese DLE60 model-aircraft engine of about 61 cm³. The switch was likely possible because Geran-2 engine output partly freed up as jet-powered Geran-4s took a growing share of Russia’s drones, Militarnyi said. The Gerbera-2’s fuel tank also holds up to 63 liters, against 10 liters on the original.
One reached Poland’s Baltic coast
In September, a drone preliminarily identified as a Gerbera-2 was recovered from the Baltic Sea near Rusinowo, on Poland’s coast. It carried a high-explosive fragmentation warhead of about 4 kg, a Polish military prosecutor said.
Russia has kept striking Ukraine’s energy sector throughout the week since US President Donald Trump announced an energy ceasefire, Ukrainian President Volodymyr Zelenskyy said on 18 October. From overnight into Sunday, Russian drones and a ballistic missile hit substations, homes, and industrial sites from Odesa to Volyn. They killed civilians and left tens of thousands of families without power.
Russia fights along the front line while hitting cities and the grid behind it with drones, missiles, and glide bombs. Ukraine says Moscow plans up to 1,000 such munitions against 60 key infrastructure sites this winter, and jet-powered drones partly free it to concentrate missiles on fewer targets, the Institute for the Study of War assessed. With Graham Act penalties on hold and US sanctions on Russian diesel suspended, Russia faces no new US cost for its strikes on Ukraine’s grid. Protecting and restoring the grid falls to Ukraine’s air defenses and repair crews.
Russia hit energy sites 76 times in a week
Zelenskyy counted 76 deliberate Russian strikes on energy and oil-and-gas facilities since Trump’s announcement. Overnight, Russia hit substations in Vinnytsia, Zhytomyr, Khmelnytskyi, and Odesa oblasts, he said. In the past week, Russia fired almost 2,700 attack drones, 1,700 aerial bombs, and 66 missiles, most of them ballistic, mainly to cause a blackout. His message was aimed at Washington.
“America must see that Russia is not taking steps in return for the lifting of sanctions or deals. On the contrary, they take every signal that they can make money as proof that their bet on war is working and they can keep fighting,” Zelenskyy wrote.
Explore further
22 House lawmakers press Trump to implement Russia sanctions law. Diesel deal draws bipartisan backlash
Overnight, Russia launched one Iskander-M ballistic missile and 180 Shahed-type drones, 26 of them jet-powered, the Air Force reported. Air defenses downed or suppressed 152 drones, but strikes hit 20 locations.
Rescuers at the site of a Russian strike on a residential area of Zaporizhzhia, 18 October 2026. Photo: State Emergency Service of Ukraine
Power cuts from Odesa to Ternopil
Strikes left about 24,000 consumers in Odesa Oblast without power, oblast head Oleh Kiper said. In Vinnytsia Oblast, the attack damaged critical infrastructure and forced emergency outages, oblast head Natalia Zabolotna wrote. Drones hit three energy facilities in Ternopil Oblast, one of them for the second time, and cut power to some consumers, oblast head Taras Pastukh said.
Civilians killed and injured
A Russian strike on Zaporizhzhia killed a 27-year-old woman and injured two others, including a 16-year-old, the State Emergency Service reported. In Poltava, an evening attack killed one person, injured four, and damaged 10 detached houses, city council secretary Kateryna Yamshchykova said.
Explore further
Five Russian bombs kill 17 in Ukraine’s Zaporizhzhia next day after Trump lets Russia ship first 300,000 tonnes of its diesel
A drone hit a high-rise in Odesa and set its roof on fire. A 13-year-old girl was hurt, city military administration head Serhii Lysak said, and Kiper put the number of injured at two.
In Dnipropetrovsk Oblast, Russian drones and artillery injured three people, oblast head Oleksandr Hanzha said. In Donetsk Oblast, Russian attacks killed seven civilians on Saturday, six of them in Sloviansk, oblast head Vadym Filashkin reported.
Fire on the roof of a high-rise apartment building after a Russian drone strike in Odesa, 18 October 2026. Photo: Odesa City Military Administration
Fires in the west, alerts across the border
A morning drone strike set warehouse and production buildings ablaze at an enterprise in Manevychi, Volyn Oblast, oblast head Roman Romaniuk said. With heavy smoke blowing toward the town, Romaniuk urged residents to stay indoors, shut windows and doors, and switch off ventilation. A repeat strike set an enterprise in the district on fire again, the State Emergency Service said, adding that air tests found no dangerous concentrations outside the site. In Lviv Oblast, drone debris damaged a logistics warehouse and two houses, oblast head Maksym Kozytskyi said.
Fire at an enterprise in Manevychi, Volyn Oblast, after a Russian drone strike, 18 October 2026. Photo: Volyn Oblast Military Administration
Polish military aircraft operated in Poland’s airspace twice during the attack, as the Government Security Centre warned residents of Lublin Voivodeship and later alerted Subcarpathian Voivodeship. In Lithuania, NATO jets failed to identify an object that apparently entered from Poland, Defense Minister Robertas Kaunas said.
A ceasefire Moscow never confirmed
Trump announced the energy ceasefire on 11 October, news that surprised Zelenskyy. A White House official said Russia was still weighing it. Hours later, Russia hit a Kharkiv power plant, and on 14 October it fired 39 ballistic missiles at the grid. Then Trump waived Graham Act penalties on buyers of Russian oil, and Secretary of State Marco Rubio said the administration wants 60 days to weigh the economic effects.
Development by UK firm Nscale heralded by ministers as largest of its kind in country loses anchor tenant
The development of a huge AI datacentre hailed by the UK government has received a fresh setback after Microsoft pulled out of the project over concerns about power supplies.
The development by the British company Nscale, heralded by ministers as the country’s largest AI datacentre when it was announced in 2025, was planned to open at Loughton in Essex next year.
Login
