🔍 Read the full analysis: AI And The Changing Risks Facing Supermarket Refrigeration on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Reports say more than 115 supermarkets and other businesses in at least six European countries experienced refrigeration problems overnight on November 1–2. Companies and authorities describe internet-accessible refrigeration controllers being switched into defrost or heating modes, but the attacker’s identity and any use of AI remain unknown.
More than 115 stores and other businesses in at least six European countries reported overnight refrigeration disruptions on November 1–2, after internet-accessible controllers were reportedly switched into defrost or heating modes. Retailers and authorities describe a pattern similar to attacks on French supermarkets in October, but no attacker has been identified, and there is no confirmation that AI was used.
Reports compiled by BleepingComputer put the affected sites in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller stores. The exact count remains unsettled because outlets and companies use different totals and definitions. Belgian reports alone range from more than 50 affected stores, as reported by The Record, to about 75 in figures cited by Euronews from Le Soir.
Several retailers confirmed incidents affecting some locations. Ahold Delhaize said it had identified an IT incident involving refrigeration systems in several dozen stores; BleepingComputer put the number at about 40 in Belgium and Luxembourg. Carrefour Belgium reported 15 of its 700 stores affected, while Colruyt said the incidents involved about five independently operated Spar stores, not its own shops. In Sweden, ICA reported at least four affected stores outside its central network, and Coop reported seven stores among more than 800.
Other reported cases included 13 SuperValu stores in Ireland, one Selver in Estonia, about 15 Intermarché outlets and an IKEA store in Belgium, and at least 17 businesses in the Netherlands, according to a Danfoss spokesperson quoted by NOS. In Finland, Kesko said a few smaller stores experienced overnight temperature anomalies. These figures come from different reports and company statements and should not be treated as a single independently verified tally.
Reported consequences varied. A Proxy Delhaize in Hoepertingen estimated it had to discard at least €60,000 in food after freezers reached 15°C, according to Het Belang van Limburg as cited by VRT NWS. A butcher in Hove reportedly discarded hundreds of kilos of food. In contrast, a butcher in Antwerp noticed the issue early and shut down its systems in time, VRT reported. Sabcobel chief executive Stephan Moelans told Belgian media that technicians began disconnecting installations from about 1 a.m.; he said about 20 of the several hundred installations managed by his firm in Belgium were affected.
Cyber incident briefing · Reported November 2, 2026
AI and the Changing Risks Facing Supermarket Refrigeration
A reported overnight disruption affected refrigeration controllers at supermarkets and other businesses across Europe. AI involvement remains unconfirmed.
01 / Reported footprint
A cross-border picture, still unsettled
Reports compiled by BleepingComputer cited affected sites in six countries. Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller stores. Counts vary by source and definition, so they do not form a single independently verified total.
Finland: Kesko said a few smaller stores experienced overnight temperature anomalies. Belgian figures alone ranged from more than 50 affected stores to about 75 in different reports.
02 / Store-level reports
Different chains, different exposure
Retailers described incidents at a portion of their locations. Some affected stores were independently operated or outside central networks, but reports do not show that every site shared the same weakness.
Belgium & Luxembourg
Chain locations
Ahold Delhaize confirmed an IT incident involving refrigeration systems in several dozen stores. Carrefour Belgium reported 15 of its 700 stores affected. Intermarché and an IKEA store were also reported among affected locations.
Sweden
Outside central safeguards
ICA reported at least four affected stores outside its central network. Coop reported seven stores among more than 800. The chains described the affected sites as outside central systems or safeguards.
Independent operators
Local systems matter
Colruyt said about five independently operated Spar stores were involved, not its own shops. Reported cases also included 13 SuperValu stores in Ireland and one Selver in Estonia.
These figures come from company statements and media reports. They use different scopes and have not been independently reconciled.
03 / How disruption can spread
From controller access to store impact
The reports describe refrigeration settings changing remotely. The consequences depend on how quickly a site detects the change and responds.
Controller reachable
Some remote-management interfaces were reportedly accessible online.
Setting changed
Controllers were reportedly switched to defrost or heating modes.
Temperature rises
Freezers or refrigeration systems may warm, threatening food safety.
Staff intervene
Teams may shut down equipment, check stock, or discard food.
This is a reported impact path, not a confirmed sequence for every affected business. Sabcobel said technicians began disconnecting installations at about 1 a.m.; around 20 of its several hundred managed Belgian installations were affected.
04 / Previous incidents
A reported resemblance to France
The November disruption followed attacks on French supermarkets overnight on October 11–12. France’s Paris prosecutor’s office counted about 700 victims, according to supplied reporting.
“Exactly the same.”
Stephan Moelans · Sabcobel CEORemote-management interfaces were exposed online contrary to good practice.
CERT-FR warning · October 12The installer said stores’ internet-reachable controllers were attacked directly.
Sabcobel’s accountSabcobel described the mechanism as matching the French incidents. That is the installer’s assessment; it does not establish a common attacker or prove every incident had the same cause. The company said its own systems were not hacked.
05 / Evidence check
What is known—and what is not
Reported
Refrigeration controllers were reportedly switched into defrost or heating modes at affected sites.
Not established
How access was obtained at each store, whether one actor was responsible, or whether all sites shared a route.
Under investigation
Belgium’s federal prosecutor has opened a criminal investigation. No public timetable for findings is available.
AI involvement
There is no confirmed evidence that AI found controllers, enabled access, or changed settings in these incidents.
Belgium’s cyber centre has warned more generally about cyberattacks that may involve AI. A general warning does not demonstrate AI use in this case.
06 / Questions to watch
What investigators may clarify next
How many sites?
More than 115 were reported across at least six countries, but totals differ. Finnish cases add reports beyond that tally.
Was it one campaign?
Similarities to the October attacks in France have been reported, but technical findings linking the incidents are not yet public.
Was AI used?
Unknown. Any conclusion about attacker identity or AI use should wait for evidence from investigators or named technical sources.
Food Loss and Store Operations
The incidents show how a cyber intrusion into building equipment can affect ordinary store operations, not just payment systems or customer data. If refrigeration fails or begins heating, food may become unsafe or have to be discarded, while stores may need to shut down equipment or parts of their operations. The reported losses in Hoepertingen illustrate the potential cost to individual businesses, though the full financial impact across affected countries is not yet known.
Reports also point to a difference between centrally managed chain locations and smaller or independently operated sites. ICA and Coop said affected stores operated outside central networks or safeguards; Colruyt said the affected Spar locations were independently run with their own refrigeration systems. That pattern is relevant to businesses using remotely managed equipment, but the available reports do not establish that every affected site shared the same security weakness.
Products Worth Considering
Withings BPM Connect Wi-Fi and Bluetooth Blood Pressure Monitor
Hyperice Normatec 3 Leg Compression Boots – Full Leg Recovery, Standard Size
Bowflex SelectTech 840 Adjustable Kettlebell
As an affiliate, we earn on qualifying purchases.
A Similar October Refrigeration Attack
The reported November incident follows a wave affecting supermarkets in France overnight on October 11–12. France’s Paris prosecutor’s office counted about 700 victims, according to the supplied reporting. On October 12, France’s national cybersecurity agency, CERT-FR, warned that remote-management interfaces for refrigeration controllers were exposed online in ways contrary to good practice and said campaigns were probably still ongoing.
Belgian installer Sabcobel said the latest incidents involved evaporators remotely switched into defrost mode using a mechanism it described as exactly the same as in France. That is the installer’s assessment; it does not identify who carried out either wave or establish that every incident in each country had the same cause. The company said its own systems were not hacked and that internet-reachable controllers at stores were attacked directly.
The story’s connection to AI is not established. Belgium’s cyber centre has warned of a general rise in cyberattacks partly involving AI, but the source material provides no evidence that AI was used to find exposed controllers, access them or alter refrigeration settings in these incidents.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize
Attacker and AI Role Unknown
No group or individual has been publicly identified, and no one has claimed responsibility in the source material. Belgium’s federal prosecutor has opened a criminal investigation, while the Belgian cyber centre has cautioned that the attacker may never be identified. The reports do not establish how access was obtained at each store, whether a single actor was responsible across countries, or whether all affected sites were targeted through the same route.
The total number of affected locations is also unresolved. Counts differ among media reports and company updates, and Finnish reports add cases outside the six-country tally cited by BleepingComputer. Temperatures and damage varied by site, and the full amount of discarded food or business losses has not been reported. There is no confirmed evidence of AI involvement; warnings about AI in cybercrime generally are not proof that it was used here.
Investigations and Store Checks
Authorities and affected companies are expected to continue investigating the incidents, checking refrigeration controllers and determining which locations were accessed. Belgium’s criminal investigation is underway, but the source material gives no public timetable for findings or for a final tally of affected businesses. Retailers have described the situation at some chains as contained, while the broader investigation remains open.
For now, the key developments to watch are official updates on the number of affected sites, the technical findings about the controllers and any evidence linking the November incidents to the October attacks in France. Any conclusion about attribution or AI use should wait for evidence from investigators or named technical sources.
Key Questions
How many businesses were affected?
BleepingComputer reported more than 115 stores in at least six countries. Other reports give different totals, and Finnish authorities and Kesko reported additional problems at a few smaller stores, so a definitive count is not yet available.
What happened to the refrigeration systems?
Reports say refrigeration controllers were remotely switched into defrost or heating modes. Sabcobel said the mechanism resembled the October attacks in France, but the cause and access route at every affected site have not been publicly established.
Was AI used in the attacks?
That is unknown. The source material offers no evidence that AI played a role. A general warning from Belgium’s cyber centre about attacks partly involving AI does not confirm its use in this incident.
Has anyone been identified as responsible?
No. The source material reports no attribution and no claim of responsibility. Belgium’s federal prosecutor has opened a criminal investigation.
How much food was lost?
The full loss across affected countries has not been established. A Proxy Delhaize in Hoepertingen estimated at least €60,000 of food had to be discarded; other local reports described food losses at individual businesses.
Source: ThorstenMeyerAI.com
