🔍 Read the full analysis: Can AI Help Secure Europe’s Supermarket Refrigeration? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
More than 115 supermarkets and other food businesses in at least six European countries reported refrigeration disruptions during the night of November 1–2, according to reports compiled by BleepingComputer. Retailers and authorities say the affected equipment was remotely tampered with, but no attacker has been identified and no evidence has established that AI was involved.
More than 115 stores and food businesses in at least six European countries reported refrigeration problems during the night of November 1–2, in a second reported wave of attacks on internet-accessible refrigeration controllers. Retailers and service providers described equipment being switched into defrost or heating modes, while investigators have not identified who was responsible or confirmed any role for artificial intelligence.
Reports compiled by BleepingComputer put the affected locations in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller Finnish stores. Counts vary between reports and may not cover the same businesses. In Belgium, for example, Carrefour said 15 of its 700 stores were affected, while Ahold Delhaize reported an incident affecting several dozen stores. A Danfoss spokesperson told Dutch broadcaster NOS that systems at at least 17 businesses in the Netherlands were hit.
The reported effects ranged from refrigerators shutting down to systems generating heat. Belgian refrigeration installer Sabcobel chief executive Stephan Moelans told Belgian media that controllers had been remotely switched into defrost mode, matching the mechanism reported in France in October. He said technicians began disconnecting installations at about 1 a.m. and that roughly 20 of the several hundred Belgian installations managed by his company were affected. He also said Sabcobel itself was not hacked; the controllers reachable over the internet were targeted directly.
Some businesses reported losses. The Proxy Delhaize in Hoepertingen said its freezers reached 15 °C and estimated that at least €60,000 worth of food had to be discarded, according to a local newspaper cited by VRT NWS. Other shops said they stopped equipment in time or lost food. The Belgian federal prosecutor has opened a criminal investigation. The available accounts do not establish a complete count of damaged goods or affected sites.
Europe · Retail infrastructure · Incident brief
Can AI Help Secure Europe’s Supermarket Refrigeration?
More than 115 food businesses across at least six European countries reported refrigeration disruptions on the night of November 1–2, 2026. Remote tampering has been reported; the attacker and any role for AI remain unconfirmed.
01 / The reported impact
One night, many operating environments
Counts vary between sources and may reflect different reporting cutoffs. Finland also reported anomalies at a few smaller stores.
Stores disrupted
Carrefour said 15 of its 700 stores were affected. Ahold Delhaize reported an IT incident affecting several dozen stores.
At least 17 businesses
A Danfoss spokesperson told NOS that systems at at least 17 businesses in the Netherlands were hit.
Controllers in defrost
Sabcobel’s chief executive said roughly 20 of the company’s several hundred managed Belgian installations were affected. The installer said its own systems were not hacked.
02 / Risks to food and operations
When cooling becomes heating
Refrigeration is part of both food safety and everyday store operations.
A controller compromise can reach beyond IT
Reported effects ranged from refrigerators shutting down to systems generating heat. Stores may need to discard stock, stop equipment, close affected areas or call technicians urgently.
Some businesses said they stopped equipment in time; others reported food losses. The accounts do not provide a complete count of damaged goods or affected sites.
03 / How exposure can matter
Remote access is the key concern
French cybersecurity guidance warned that exposed remote-management interfaces can create an avenue for unauthorized access.
Controller reachable online
Remote-management interfaces may be exposed contrary to recommended practice.
Settings reportedly changed
Accounts describe equipment moved into defrost or heating modes.
Cooling disrupted
Temperatures can rise, forcing urgent checks and operational decisions.
Stock and service at risk
Food may be lost, equipment stopped, or store areas taken out of service.
04 / A reported precedent
France came first in October
A similar operating mode has been reported, but that alone does not establish a shared perpetrator.
French supermarkets hit
The Paris prosecutor’s office counted about 700 victims in that earlier wave, according to the source material.
CERT-FR warning
France’s national cyber agency warned that refrigeration control interfaces were exposed online and campaigns might be ongoing.
Disruptions reported again
Sabcobel described the method as “exactly the same.” This is an installer’s assessment, not a public forensic attribution.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
Ahold Delhaize
05 / Attribution and AI
The central questions remain open
The public accounts describe an active investigation, not a completed technical explanation.
Was AI involved?
No confirmed evidence in the supplied reporting. General warnings about AI and cybercrime do not show that AI was used in this incident.
Who was responsible?
No group has claimed responsibility, and no suspect or organization has been identified publicly. Belgium’s federal prosecutor has opened a criminal investigation.
How many sites were affected?
Reports cite more than 115 businesses across at least six countries, but counts differ and may not describe the same locations.
Were all systems reached the same way?
The reporting does not establish a complete inventory, common configuration, shared vulnerability or access route for every affected controller.
06 / What comes next
Investigators are tracing controller access
Further findings may clarify scope, access methods, losses and any technical link to the French wave.
Establish what happened
Authorities and businesses are assessing equipment and losses. No final incident count, public attribution or complete technical analysis has been announced in the reports.
Check remotely managed systems
The source material points to limiting remote exposure and checking refrigeration equipment, especially at sites outside central networks. It does not document remediation at every affected business.
Risks to Food and Store Operations
Refrigeration is essential to food safety and daily retail operations, so a controller compromise can cause more than a technical outage. When cooling stops or equipment heats, stores may need to discard stock, close affected sections or bring in technicians urgently. The reported losses at some Belgian businesses show the potential cost, though there is no consolidated estimate across the countries involved.
The pattern also highlights a risk in building systems that are connected for remote management. According to the French national cybersecurity agency’s warning, exposed remote-management interfaces on refrigeration controllers can create an avenue for unauthorized access. The incident reports suggest that independently operated shops and sites using equipment outside a retailer’s central network were among those affected. That does not establish that every such system is vulnerable, but it helps explain why a retailer’s central safeguards may not cover all franchisees or small businesses.
The question in the headline remains open: AI use has not been confirmed. Belgium’s cyber centre has warned generally about attacks involving AI, but the supplied reporting does not attribute this incident to AI or describe evidence that AI was used. The confirmed public concern is access to refrigeration controls, not a demonstrated AI-driven attack.
Products Worth Considering
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
Samsung 32-inch Odyssey OLED G8 (G80SH) 4K QD-OLED Gaming Monitor
Samsung 27-inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A French Wave Preceded the Disruptions
The November incidents followed a reported attack on supermarkets in France on the night of October 11–12, 2026. The Paris prosecutor’s office counted about 700 victims in that earlier wave, according to the source material. France’s CERT-FR warned on October 12 that refrigeration controllers’ remote-management interfaces were exposed online in ways that did not follow recommended practice. It said campaigns were probably still ongoing.
Belgian installer Sabcobel said the method in the latest incidents was “exactly the same” as in France. That is the installer’s assessment, not a public forensic finding identifying a shared perpetrator. The reported targeting of particular Danfoss controller models in Finland and elsewhere also does not, by itself, establish who accessed the equipment or how each individual system was reached.
The accounts describe stores with independently managed systems or older equipment outside central networks, including some Swedish ICA stores and independent Spar businesses. The source material does not provide a complete technical inventory or establish that all affected stores used the same model, configuration or access route.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Attribution and AI Remain Unconfirmed
No group has claimed responsibility, and the supplied accounts do not identify a suspect or establish how the controllers were accessed in each case. Belgium’s cyber centre has cautioned that the attacker may never be identified. A criminal investigation is open, but no public findings tying the incidents to a person, organization or country are described in the reporting.
The total scale is also unsettled. BleepingComputer reports more than 115 businesses across at least six countries, while other outlets give different counts for Belgium and individual retailers. Those figures may use different definitions or reporting cutoffs, and they should not be treated as a single verified final tally. Reports also give varying peak temperatures, including 50 °C in some locations and 15 °C in Hoepertingen.
Finally, there is no confirmed evidence of AI involvement in the attack. General warnings about AI and cybercrime are not evidence that AI was used in this incident. The public reporting does not state whether investigators have completed technical analysis, whether every affected system shared a vulnerability, or what proportion of reported equipment failures has been forensically confirmed as malicious tampering.
Investigators Trace the Controller Access
Belgium’s federal prosecutor is investigating, while affected retailers and refrigeration specialists are assessing equipment and losses. Authorities and companies have not announced a final incident count or a public attribution. Further updates are likely to clarify which systems were affected, how access was obtained and whether the French and November events are linked beyond the reported similarity in operating mode.
For businesses, the immediate focus described in the source material is limiting remote exposure and checking refrigeration equipment, particularly at sites that operate outside central networks. The French CERT-FR warning called exposed management interfaces contrary to good practice, but the source material does not detail specific remediation actions taken by every affected retailer or manufacturer. Until more findings are released, the precise scope, financial impact and any AI connection remain unresolved.
Key Questions
How many European stores were affected?
BleepingComputer reports more than 115 businesses in at least six countries. Finnish authorities and Kesko also reported problems at a few smaller stores. Counts differ by outlet and may change as companies and investigators clarify which sites were affected.
Was AI used in the refrigeration attacks?
That has not been established. Belgium’s cyber centre has warned generally about cyberattacks involving AI, but the supplied reporting provides no evidence that AI played a role in these incidents.
How were the refrigeration systems affected?
Retailers and an installer reported controllers being switched into defrost or heating modes, disrupting cooling. French CERT-FR had warned that remote-management interfaces for refrigeration controllers were exposed online, but public reporting has not confirmed the exact access route for every affected system.
Were the November incidents linked to the French attacks?
Sabcobel said the reported mechanism matched the French wave of October 11–12. That is a comparison of the method, not a public finding that the same attacker was responsible. Investigators have not announced attribution in the material provided.
Source: ThorstenMeyerAI.com
