🔍 Read the full analysis: AI And Europe’s Vulnerable Supermarket Refrigeration Systems on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Retailers and authorities reported overnight disruptions to supermarket refrigeration systems in multiple European countries on Nov. 1–2. Reports describe internet-accessible controllers switched into defrost or heating modes, but the total number of affected sites remains uncertain, and no attacker has been identified. There is no confirmed evidence that AI was used.
Refrigeration systems at more than 115 stores across at least six European countries were disrupted overnight on Nov. 1–2, according to reports collated by BleepingComputer, as controllers were remotely switched into defrost or heating modes. The incident resembles attacks on French supermarkets in October, but no perpetrator has been identified, and there is no confirmed evidence that artificial intelligence was involved.
Retailers and media outlets reported affected sites in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller stores. The figures vary among reports and are still being assembled. BleepingComputer counted more than 115 locations overall, while The Record reported more than 50 in Belgium. Those totals should be treated as reported counts, not a final official tally.
In Belgium, refrigeration installer Sabcobel chief executive Stephan Moelans told Belgian media that technicians began disconnecting installations around 1 a.m. He said roughly 20 of several hundred installations managed by his company were affected, and that the company itself had not been hacked: the stores’ internet-reachable controllers were targeted directly. Ahold Delhaize told BleepingComputer it had identified an IT incident affecting refrigeration systems in several dozen stores. Carrefour Belgium said 15 of its 700 stores were affected, while Colruyt said the reported incidents involved about five Spar stores run by independent operators.
Reported consequences ranged from disrupted equipment to food losses. VRT NWS reported that a Proxy Delhaize in Hoepertingen found freezers at 15 °C instead of about minus 22 °C and estimated at least €60,000 in discarded food. In Sweden, ICA and Coop reported affected stores outside their central networks. Coop said the effects varied, including stopped or partly functioning refrigerators; in one case, a system began generating heat. The store-level reports describe different temperatures and damage, so they do not establish a single uniform effect across the affected countries.
Europe · Retail infrastructure · Reported Nov. 2, 2026
AI And Europe’s Vulnerable Supermarket Refrigeration Systems
Overnight disruptions affected refrigeration equipment across multiple countries. Reports describe controllers switched remotely into defrost or heating modes, while the total scope and the method behind the incidents remain under investigation.
Count collated by BleepingComputer; not a final official tally.
No cited source confirms that AI was used in these attacks.
At a glance · reported picture
The reported development
Reports describe a second wave of refrigeration disruption following an incident in France in October.
Retailers and media outlets reported affected sites in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller stores.
The counts vary by source and are still being assembled. BleepingComputer counted more than 115 locations overall; The Record reported more than 50 in Belgium. These figures should be read as reported counts, not a final official total.
Accounts describe internet-accessible refrigeration controllers switched into defrost or heating modes. No public technical report cited here establishes that every site shared the same access path or configuration.
Controllers were reachable through internet-facing interfaces, according to reports.
Some equipment was reportedly switched to defrost or heating.
Stores reported stopped, partial, or heating refrigeration systems.
Technicians isolated equipment as retailers and authorities investigated.
Store reports vary
Public statements and local accounts describe different effects; they do not establish one uniform outcome across countries.
Installations disconnected
Sabcobel CEO Stephan Moelans said technicians began disconnecting installations around 1 a.m. Roughly 20 of several hundred systems managed by the company were affected; he said Sabcobel itself had not been hacked.
Several dozen to 15 stores
Ahold Delhaize reported an IT incident affecting refrigeration in several dozen stores. Carrefour Belgium said 15 of 700 stores were affected. Colruyt cited about five independently operated Spar stores.
Stopped, partial, or heating
ICA and Coop reported affected stores outside their central networks. Coop said impacts varied, including stopped or partly functioning refrigerators; in one case, a system generated heat.
“Exactly the same” mechanism as in France.
Stephan Moelans · CEO of Sabcobel · as reported by Belgian media“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
Ahold Delhaize · statement to BleepingComputerFood loss and store-level exposure
Connected building equipment can interrupt operations separately from checkout systems or customer data.
VRT NWS reported that a Proxy Delhaize in Hoepertingen found freezers at 15 °C instead of about −22 °C, with at least this amount of food estimated for disposal.
Refrigeration failures can spoil perishable stock, interrupt trading and require technicians to isolate equipment. Some affected sites were outside central retailer networks or used independently operated equipment.
That pattern may mean individual locations have different safeguards and maintenance arrangements. It does not establish why a particular system was vulnerable or whether every affected store used the same setup.
Individual readings reported at different locations are not a common incident-wide measurement.
How the reports compare
Counts and technical descriptions come from different sources and may cover different sets of sites.
| Report detail | What was reported | How to read it |
|---|---|---|
| Overall count | ~More than 115 locations | BleepingComputer’s collated count; not a final official tally. |
| Belgium count | ~More than 50 sites | The Record’s report; counts may differ by outlet and scope. |
| System behavior | ✓Defrost or heating modes described | Reported controller behavior; no public report confirms identical mechanics at every site. |
| Attribution | ~No group or person identified | Belgian authorities are investigating; no public attribution cited. |
| AI use | ~Unconfirmed | General warnings about AI do not show that it was used in this incident. |
A similar incident in France
The reported French wave offers context, while the link between incidents still requires technical evidence.
Hundreds of supermarkets reportedly affected
The Paris prosecutor’s office was reported as counting about 700 victims in the French incident.
Warning on exposed interfaces
France’s national response team warned that remote-management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice. It said campaigns were “probably still ongoing.”
Another reported disruption
Sabcobel described the latest method as the same, but that account does not establish one cause across all countries and sites.
Attribution and AI remain unclear
No public evidence cited here identifies an attacker or confirms AI involvement.
No group has claimed responsibility. Belgium’s federal prosecutor has opened a criminal investigation; the cyber centre has warned the attacker may never be identified.
Reported totals differ, some figures cover businesses rather than supermarkets, and additional Finnish sites were described as having anomalies.
It is unclear which access path was used at each site, whether controllers shared configurations, or how many operators had applied available updates.
AI use is unconfirmed.
General warnings about AI-enabled attacks are not evidence of AI use in this case.“Currently 15 of our 700 stores are affected, both in Flanders and Wallonia.”
Carrefour Belgium · statementInvestigators trace controller access
Further findings would need to connect equipment, access methods and any cross-border technical link.
Belgium’s federal prosecutor is investigating while retailers and refrigeration providers assess affected equipment and losses. Public statements cited so far provide no timetable for findings.
For now, the confirmed picture is a multi-country refrigeration disruption with unsettled scope and no identified attacker. Any confirmed count, attribution or explanation of AI’s role would need to come from investigators, affected companies or released technical evidence.
Identify which controllers were accessed and how they were reached.
Establish whether separate national incidents share a technical link.
Check affected systems, isolate installations and review remote access and software status.
Key questions
What the reporting supports today—and what remains open.
How many stores were affected?
BleepingComputer reported more than 115 locations overall. Other figures differ, and no final official total has been presented.
Was AI used?
There is no confirmed evidence in the cited reporting that AI was involved.
Who was responsible?
No attacker has been publicly identified. Belgian authorities have opened an investigation.
Was it the same attack as France?
Some reported behavior appears similar, but public evidence has not established a shared technical cause across all affected sites.
Food Losses and Store-Level Exposure
The reported incidents show how internet-connected building equipment can create operational risks separate from a retailer’s checkout systems or customer data. Refrigeration failures can spoil perishable stock, interrupt trading and require technicians to isolate equipment. The reported €60,000 loss at one Belgian outlet gives a specific example, but it is not an estimate for the wider incident.
Several retailers said affected sites were outside their central networks or used equipment operated independently. That pattern may leave individual locations with different safeguards and maintenance arrangements from a chain’s centrally managed stores. It does not, by itself, establish why those particular systems were vulnerable or whether every affected site had the same configuration.
The topic’s connection to AI also requires care. Belgium’s cyber centre has warned generally about a rise in attacks that may involve AI, according to the source account. No source cited here says AI was used to carry out these refrigeration attacks. The confirmed reporting concerns remotely accessed controllers and disrupted temperatures, not an AI-driven method.
Products Worth Considering
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
As an affiliate, we earn on qualifying purchases.
A Similar French Incident in October
The overnight disruption followed a reported wave in France on Oct. 11–12, when hundreds of supermarkets were affected. France’s CERT-FR warned on Oct. 12 that remote-management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice. It said attack campaigns were “probably still ongoing,” according to the source material. The Paris prosecutor’s office was reported as counting about 700 victims in the French incident.
Belgian installer Sabcobel described the latest method as “exactly the same” as in France: evaporators were switched remotely into defrost mode. That is an account from a service provider, not a publicly released forensic report establishing that every incident in every country had the same technical cause. The Finnish National Cyber Security Centre also said attacks targeted specific Danfoss models, according to Finnish news agency STT.
Warnings and software updates do not establish that all operators applied the same protections. The source account says manufacturers had shipped updates months earlier, but does not specify which product versions were affected in each store, which operators installed updates or whether updates alone would have prevented access. Those details matter when assessing how the incidents were connected and what remediation is needed.
““Exactly the same” mechanism as in France.”
— Stephan Moelans, chief executive of Sabcobel, as reported by Belgian media
Attribution and Damage Still Unclear
No group has claimed responsibility, and authorities have not publicly attributed the attacks to a person or organisation. Belgium’s federal prosecutor has opened a criminal investigation; Belgium’s cyber centre has warned that the attacker may never be identified. The source material does not provide a public technical report tying all affected countries to one operator or intrusion.
The scale is also unsettled. Reported totals differ by outlet, some figures cover businesses rather than supermarkets, and additional Finnish sites were described as having anomalies. Temperatures ranged from reported readings of 15 °C to 50 °C in different locations; those observations are not a common measurement for the incident as a whole. The final number of affected sites and total food losses remain unknown.
It is not clear which specific access path was used at each site, whether all affected controllers were running the same software or configuration, or how many operators had applied available updates. AI involvement is unconfirmed: general warnings about AI-enabled attacks do not establish its use in this case.
Investigators Trace Controller Access
Belgium’s federal prosecutor is investigating, while retailers and refrigeration providers are assessing affected equipment and losses. Further findings would need to establish which controllers were accessed, how they were reached and whether separate national incidents share a technical link. Public statements cited so far do not provide a timetable for those findings.
Stores and equipment operators may continue checking refrigeration systems, isolating affected installations and reviewing remote access and software status. Any confirmed count, attribution or explanation of AI’s role would need to come from investigators, affected companies or technical evidence released by relevant authorities. For now, the confirmed picture remains a multi-country refrigeration disruption with unsettled scope and no identified attacker.
Key Questions
How many stores were affected?
More than 115 locations is the overall count reported by BleepingComputer, but totals differ among reports and may change. The number has not been presented as a final official tally.
Which countries reported incidents?
Reports named Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish authorities and Kesko also reported anomalies at a few smaller stores.
Was AI used in the attacks?
That is not confirmed. The source material cites general Belgian cyber-centre warnings about attacks that may involve AI, but no cited authority or company said AI was used in these incidents.
Who was responsible?
No perpetrator has been identified, and no one has claimed responsibility in the reporting. Belgium’s federal prosecutor has opened an investigation.
What did the attackers reportedly do?
Reports say refrigeration controllers were accessed remotely and systems were switched into defrost or heating modes. The exact access method and whether the same technique was used at every site remain unclear.
Source: ThorstenMeyerAI.com
