🔍 Read the full analysis: The AI Angle On Attacks Against Europe’s Supermarket Refrigeration on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Reports say more than 115 supermarkets and other businesses in at least six European countries had refrigeration problems overnight on November 1–2, 2026. The incidents resemble an October attack in France and appear to involve internet-accessible refrigeration controllers, but responsibility and any use of AI remain unconfirmed.
Refrigeration systems at more than 115 stores across at least six European countries were reportedly disrupted overnight from November 1 to 2, with some units switching into defrost or heating modes. The incidents resemble an October attack on French supermarkets, but authorities have not identified who was responsible or confirmed whether artificial intelligence was used.
Reports of affected businesses came from Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, with Finnish authorities and retailer Kesko also reporting problems at a few smaller stores. Counts vary by source and remain preliminary. BleepingComputer reported more than 115 affected stores across six countries, while Belgian outlets published differing estimates for that country alone.
In Belgium, refrigeration installer Sabcobel chief executive Stephan Moelans told local media that technicians began disconnecting systems at about 1 a.m. He said the company itself was not hacked: attackers reached internet-accessible controllers at stores. About 20 of the several hundred installations Sabcobel manages in Belgium were affected, he told The Record.
Retailers described incidents at individual sites and chains. Ahold Delhaize said an IT incident affected refrigeration in several dozen stores; BleepingComputer put the figure at about 40 in Belgium and Luxembourg. Carrefour Belgium said 15 of its 700 stores were affected, and Coop Sweden reported problems at seven of its more than 800 stores. In Hoepertingen, a Proxy Delhaize outlet estimated it had to discard food worth at least €60,000 after freezer temperatures rose to 15 °C, according to Het Belang van Limburg as cited by VRT NWS.
Cyber incident brief · Europe · November 2, 2026
The AI Angle on Attacks Against Europe’s Supermarket Refrigeration
A reported second wave disrupted refrigeration at more than 115 businesses overnight. Internet-accessible controllers appear to be involved, but investigators have not identified an attacker or confirmed any use of AI.
01 / The impact
When store freezers become cyber targets
A change to refrigeration settings can threaten food stocks and interrupt local businesses—even when checkout networks and office computers keep running.
Operational disruption
Remote controls, physical consequences
Belgian installer Sabcobel said attackers reached internet-accessible store controllers and switched refrigeration evaporators into defrost mode. Some systems reportedly entered heating or defrost settings.
Uneven losses
Some stores lost food
A Proxy Delhaize outlet in Hoepertingen estimated at least €60,000 in food losses after freezer temperatures rose to 15 °C. Other operators detected tampering and stopped systems in time.
Reported footprint
Different operators, different counts
Ahold Delhaize cited several dozen stores; Carrefour Belgium reported 15 of 700, and Coop Sweden reported seven of more than 800. Counts are preliminary and vary by source.
02 / Reported attack path
From exposed controller to store-level disruption
Details come from company and media accounts. Investigators have not established the access method at every affected site.
Remote interface exposed
France’s CERT-FR warned about refrigeration controller interfaces reachable online without good security practice.
Controller accessed
Sabcobel said attackers reached internet-accessible controllers at stores; precise access routes remain under investigation.
Settings changed
Refrigeration units were reportedly switched into defrost or heating modes, allowing temperatures to rise.
Food and operations at risk
Businesses checked equipment, isolated systems or reported food losses. The total damage is not yet consolidated.
03 / A possible pattern
A similar attack hit France
The November reports follow a reported French supermarket attack during the night of October 11–12, 2026.
France · October 11–12
About 700 victims reported
France’s Paris prosecutor’s office counted about 700 victims, according to the source material. The cases were associated with disrupted supermarket refrigeration.
Belgium · November
Mechanism described as similar
Sabcobel said the latest incidents used the same mechanism: refrigeration evaporators remotely switched into defrost mode. That does not prove a shared attacker.
Official warning
Exposed interfaces flagged
On October 12, CERT-FR warned that remote-management interfaces were exposed online and said attack campaigns were “probably still ongoing.”
04 / What sources say
Company and agency accounts
Statements describe reported effects and warnings; they do not establish responsibility for the incidents.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
Ahold Delhaize
05 / Attribution & AI
Who accessed the controllers?
The evidence available in these reports leaves core questions open.
Attribution
No attacker identified
No responsibility claim is reported. Belgium’s federal prosecutor has opened a criminal investigation, and the country’s cyber centre has warned the attacker may never be identified.
Artificial intelligence
No confirmed AI use
Belgium’s cyber centre has warned broadly about attacks partly involving AI. No cited investigator, retailer or official has said AI was used in these refrigeration incidents.
Shared campaign?
Similarity is not proof
The French and November incidents resemble each other in reported technique, but available information does not establish one perpetrator, motive or precise method across all sites.
Damage assessment
Totals remain fluid
Store counts and temperature readings differ across reports. There is no consolidated public assessment of food losses or confirmation of update status at affected locations.
Keep the AI angle in perspective
AI is part of the broader cybersecurity discussion, but its role here is unverified. The reported operational issue is access to refrigeration controls connected to the internet; technical investigations are still needed to determine how each site was reached.
06 / What happens next
Investigations and store checks continue
Further reporting may clarify the affected-site count, food losses and whether incidents across countries share a method or perpetrator.
Investigators
Trace access and scope
Belgium’s criminal investigation is the clearest formal next step. Investigators will need to establish which controllers were accessed and how they were exposed.
Retailers & operators
Check controls and safe operation
Businesses are assessing refrigeration controls and network access before returning affected units to normal service. The sources provide no coordinated timeline.
Technical inquiry
Details may narrow the search
French warnings focused on exposed remote-management interfaces; Finnish reporting mentioned specific Danfoss models. Neither detail confirms one universal vulnerability or remedy.
When Store Freezers Become Cyber Targets
The reported incidents show how an intrusion into building equipment connected to the internet can have direct consequences beyond a company’s office computers. A change to refrigeration settings can put food stocks at risk, interrupt local businesses and create costs even when the attack does not involve a break-in or a disruption to a retailer’s checkout network.
The reported damage was uneven. Some operators detected the tampering and stopped systems in time; other businesses said they lost food. Independent shops and some stores outside retailers’ central networks appear especially exposed in the accounts available so far. That pattern is reported by retailers and broadcasters, not an independently established assessment of every affected site.
The episode also puts attention on the security of equipment used to manage refrigeration remotely. France’s national cybersecurity agency had warned that exposed remote-management interfaces for refrigeration controllers were a risk. The latest reports suggest that warnings and available updates have not prevented another wave, though the sources provided do not establish which businesses installed updates or whether doing so would have stopped these incidents.
Products Worth Considering
LG 24G414B-B 24-Inch UltraGear Full HD IPS Gaming Monitor
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar Attack Hit France
The November incidents follow a reported attack on supermarkets in France during the night of October 11–12. France’s Paris prosecutor’s office counted about 700 victims, according to the source material. Belgium’s installer Sabcobel described the mechanism in the latest incidents as the same as in France: refrigeration evaporators were remotely switched into defrost mode.
On October 12, France’s CERT-FR warned that remote-management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice. The agency said attack campaigns were “probably still ongoing.” That warning establishes that authorities had identified a security concern; it does not by itself confirm who carried out either wave or how each store was accessed.
The reported incidents have affected different operators and countries, and their totals do not match across reports. BleepingComputer cited more than 115 stores in six countries; Euronews, citing the Belgian newspaper Le Soir, listed about 75 affected Belgian sites. Finnish reports also describe a few smaller stores. These figures may reflect different reporting cutoffs or counting methods, so they should not be treated as a single settled total.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Who Accessed the Controllers?
No attacker has been identified, and the source material reports no claim of responsibility. Belgium’s federal prosecutor has opened a criminal investigation. The country’s cyber centre has warned that investigators may never identify the attacker.
Whether AI played any part is also unknown. Belgium’s cyber centre has warned more broadly about an increase in attacks partly involving AI, but no cited official, retailer or investigator has said AI was used in these refrigeration incidents. The available information does not establish the attackers’ motive, whether the same person or group was behind the French and November incidents, or the precise access method at each affected site.
The total number of affected businesses and the scale of food losses are still developing. Reports cite different store counts and temperature readings, from units set to 15 °C to reports of 50 °C. The sources do not provide a consolidated assessment of damage, nor do they confirm which sites had applied available software updates.
Investigations and Store Checks Continue
Belgium’s criminal investigation is the clearest formal next step. Retailers and equipment operators will need to establish which controllers were accessed, how those systems were exposed and whether affected units can safely return to service. The source material does not give a timetable for investigative findings or report a coordinated public update covering every country.
Businesses are also likely to check refrigeration controls and network access as they assess the incidents. France’s CERT-FR warning focused on remote-management interfaces exposed online, while Finnish reporting said attacks targeted specific Danfoss models. Those details may help investigators and operators narrow their technical inquiries, but they do not establish a single vulnerability or a confirmed remedy for all affected systems.
Further reporting should clarify the final count of affected sites, the amount of food lost and whether the events across countries share one perpetrator or method. Until authorities or companies provide those findings, claims about attribution, motive or AI involvement remain unconfirmed.
Key Questions
How many businesses were affected?
Reports describe more than 115 stores across at least six countries, with additional reports from Finland. Counts differ by outlet and may change as businesses report incidents; there is no final consolidated total in the available material.
How were the refrigeration systems disrupted?
Sabcobel said attackers reached internet-accessible controllers and remotely switched refrigeration evaporators into defrost mode, a mechanism it described as matching the October incidents in France. The access method has not been independently detailed for every affected store.
Has anyone confirmed that AI was used?
No. Authorities have discussed AI as part of a broader rise in cyberattacks, but the sources do not say that AI was involved in these incidents.
Who is responsible for the attacks?
No responsible person or group has been identified, and no claim of responsibility has been reported. Belgium’s federal prosecutor has opened an investigation.
Was food destroyed?
Some stores reported losses. A Proxy Delhaize in Hoepertingen estimated food thrown away at at least €60,000, according to a local newspaper cited by VRT NWS. Other businesses reported discarding food, but a total loss estimate is not available.
Source: ThorstenMeyerAI.com
