🔍 Read the full analysis: What Europe’s Supermarket Refrigeration Attacks Mean For AI Security on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
More than 115 supermarkets and other food businesses across at least six European countries reported refrigeration problems overnight on Nov. 1–2, 2026, according to reports compiled by BleepingComputer. Officials and companies described remotely altered refrigeration controllers, but the attacker’s identity and any role for AI remain unknown.
More than 115 stores and food businesses across at least six European countries reported refrigeration disruptions overnight on Nov. 1–2, after controllers were reportedly switched remotely into defrost or heating modes. The incidents echo a wave that struck French supermarkets in October, but no attacker has been identified and officials have not said AI was used.
In Belgium, refrigeration installer Sabcobel chief executive Stephan Moelans told Belgian media that technicians began disconnecting installations around 1 a.m. He said the company itself was not hacked and that internet-reachable controllers at stores were attacked directly. About 20 of several hundred installations Sabcobel manages in Belgium were affected, he told The Record.
Retailers described disruptions at stores operating outside their central networks. Ahold Delhaize said it had identified “an IT incident affecting the refrigeration systems in several dozen stores.” Carrefour Belgium said 15 of its 700 stores were affected, mostly in freezers and other refrigeration units, while Colruyt reported incidents at about five independently operated Spar stores. ICA reported at least four affected Swedish stores; Coop said seven of its more than 800 stores were affected.
Reports also named businesses in the Netherlands, Luxembourg, Ireland, Estonia and Finland. Specific losses varied: a Proxy Delhaize store in Hoepertingen reported freezers at 15 °C instead of about minus 22 °C and estimated at least €60,000 in discarded food, according to local reporting cited by VRT NWS. Other stores reported different temperatures and levels of damage. The published totals differ by source and may not represent a final count.
Cybersecurity · Physical infrastructure · Nov. 1–2, 2026
What Europe’s Supermarket Refrigeration Attacks Mean for AI Security
A reported cross-border disruption shows how exposed industrial equipment can hit everyday operations. The attacker’s identity and any role for AI remain unknown.
01 / What happened
Cooling systems became a business risk
More than 115 supermarkets and food businesses reported refrigeration problems. Counts vary by source and may change as investigations continue.
Internet-reachable controllers
Belgian installer Sabcobel said affected store controllers were reached directly over the internet. The route used at each site has not been fully described.
Defrost or heating modes
Retailers and specialists described equipment switched remotely into modes that disrupted normal refrigeration and cooling.
Food, repairs, and downtime
Stores may need to discard perishables, close equipment, and bring in technicians. A Hoepertingen store estimated at least €60,000 in discarded food.
02 / Reported scope
A patchwork of affected sites
Retailer statements described incidents at individual stores and smaller groups, including sites operating outside central networks.
15 of 700 Carrefour Belgium stores
The company said affected equipment included freezers and other refrigeration units across Flanders and Wallonia. Colruyt reported incidents at about five independently operated Spar stores.
Countries named in reports
- Belgium
- Netherlands
- Sweden
- Luxembourg
- Ireland
- Estonia
- Finland
ICA reported at least four affected Swedish stores; Coop said seven of more than 800 stores were affected. Finnish authorities and Kesko also described problems at a few smaller stores. Published totals differ and are not a reconciled official count.
03 / A pattern under investigation
The French incident came first
The reported November wave follows a similar incident in France, but public reporting does not confirm one actor or one technical path across all affected sites.
“exactly the same” mechanism
Sabcobel’s characterization of the latest reports
“probably still ongoing”
France’s CERT-FR on attack campaigns, Oct. 12
About 700 victims
Count attributed to the Paris prosecutor’s office
Oct. 11–12
Refrigeration systems at French supermarkets were reportedly altered.
Oct. 12 warning
CERT-FR warned that remote management interfaces were exposed online.
Nov. 1–2
New reports described refrigeration disruptions across Europe.
Now
Authorities investigate while stores and specialists assess and restore equipment.
04 / What this means for AI security
AI is not established in this incident
Belgium’s cyber centre has discussed a broader rise in attacks involving AI. The reporting cited here does not say AI was used to carry out or coordinate these attacks.
There is no confirmed evidence here that attackers used AI-generated tools, voices, or messages. Connecting this event to AI would go beyond what is currently established.
AI role · unconfirmedWho was responsible?
No public attribution or claim of responsibility is reported. Belgium’s federal prosecutor has opened a criminal investigation; the cyber centre says the perpetrator may never be identified.
How did access happen?
Internet-reachable controllers were reportedly targeted. The specific vulnerabilities, configurations, and access method at each site remain unclear.
What safeguards failed?
France had warned about exposed refrigeration management interfaces. Reports do not establish which sites were unpatched or what would have prevented each disruption.
05 / What comes next
Investigations and equipment checks
A full technical account and consolidated list of affected models have not yet been published.
Trace access across sites
Investigators will need to determine how access was gained and whether separate incidents can be linked across countries.
Identify models and settings
Finland’s National Cyber Security Centre said reported incidents targeted specific Danfoss models, according to STT. A complete model list is still outstanding.
Confirm losses and recovery
Retailers and specialists continue to assess affected stores, restore systems, and estimate food losses. Counts and damage figures may change.
Food Losses and Exposed Store Systems
The incidents show how a cyberattack on building and refrigeration equipment can affect ordinary business operations without disrupting a retailer’s main corporate network. If cooling fails or a unit heats up, stores may have to discard perishable food, close equipment or bring in technicians, creating costs beyond the digital systems themselves.
Some of the affected locations were independently operated stores or used equipment outside a chain’s central safeguards, according to retailer statements and reports. That makes the incidents relevant to businesses whose physical infrastructure is connected to the internet, including smaller operators that may not manage those systems through a corporate network. The reports do not establish how many sites had been secured or what safeguards would have prevented each incident.
The attacks also raise questions about whether existing warnings and software updates reached the exposed systems. France’s national cybersecurity agency had warned in October about internet-accessible refrigeration management interfaces. That warning and the apparent repeat of a similar method point to a continuing security problem, but do not establish that every affected store used an unpatched controller.
Popular right now
Dreame H12 Pro Wet and Dry Vacuum Mop
Dyson Ball Animal 3 Upright Vacuum
KitchenAid 5.5-Qt Bowl-Lift Stand Mixer, Porcelain White (KSM55SXXX)
As an affiliate, we earn on qualifying purchases.
A Similar French Incident in October
The new reports follow attacks during the night of Oct. 11–12, when refrigeration systems at hundreds of French supermarkets were reportedly altered. France’s CERT-FR warned on Oct. 12 that remote management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice. The agency said attack campaigns were “probably still ongoing.”
The Paris prosecutor’s office counted about 700 victims in the French incident, according to the source material. Belgian installer Sabcobel described the latest reported incidents as using “exactly the same” mechanism as the French wave. That is an attributed assessment, not a public forensic report detailing every affected device or confirming a single actor across both episodes.
Reports about the Nov. 1–2 incidents place them in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; Finnish authorities and retailer Kesko also reported problems at a few smaller Finnish stores. Counts differ: BleepingComputer reported more than 115 locations across six countries, while other accounts listed varying totals for Belgium. Those figures are reports gathered during a developing incident, not a reconciled official tally.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Attribution and AI Use Remain Unknown
No public attribution has identified who carried out the attacks, and no group has claimed responsibility in the supplied reporting. Belgium’s federal prosecutor has opened a criminal investigation. Belgium’s cyber centre has warned that the perpetrator may never be identified.
The reported access route involved internet-reachable refrigeration controllers, but the available information does not explain how access was obtained in each case, which specific vulnerabilities or configurations were involved, or whether the same actor was behind the French and November incidents. The reported counts and damage estimates also remain subject to change.
Although Belgium’s cyber centre has discussed a general rise in attacks involving AI, no source cited here says AI was used to carry out or coordinate these incidents. There is also no confirmed evidence in the material that the attackers used AI-generated tools, voices or messages. Connecting this event to AI would go beyond what is currently established.
Investigations and Store Safeguards
Belgian authorities are investigating, while retailers and refrigeration specialists continue to assess affected sites and restore equipment. More information may emerge as companies confirm store counts, estimate food losses and determine which controller models and configurations were involved.
France’s October warning urged attention to remote access on refrigeration systems; the Finnish National Cyber Security Centre said the reported incidents there and elsewhere targeted specific Danfoss models, according to Finnish news agency STT. Authorities and affected businesses have not yet published a complete technical account of the November wave or a consolidated list of affected models.
For now, the immediate next steps are forensic investigations and equipment checks, alongside any further official advisories. Whether investigators can connect the incidents across countries, determine how access was gained and establish responsibility remains unresolved.
Key Questions
How many locations were affected?
BleepingComputer reported more than 115 stores or businesses across at least six countries. Other reports give different counts, and Finnish authorities and Kesko also described problems at a few smaller stores. The final total is not confirmed.
What did the attackers reportedly do?
Companies and installers reported that refrigeration controllers were remotely switched into defrost or heating modes, disrupting cooling. The available reporting does not give a complete technical account of how access was obtained at each site.
Was AI used in the attacks?
That has not been established. Officials have discussed AI in relation to a general rise in cyberattacks, but the source material does not say AI played a role in the supermarket refrigeration incidents.
Who is responsible?
No perpetrator has been identified publicly in the supplied reports, and no one has claimed responsibility. Belgian authorities have opened a criminal investigation.
Were all affected stores part of major chains?
No. Retailers and reports said some incidents involved independently operated stores or locations outside a chain’s central network. The affected businesses also included larger retail groups, and the complete list remains unsettled.
Source: ThorstenMeyerAI.com
