🔍 Read the full analysis: How AI Is Shaping The Second Wave Of Attacks On Europe’s Supermarket Refrigeration on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A November 1–2 attack disrupted refrigeration systems at more than 115 stores across at least six European countries, according to BleepingComputer; Finnish authorities and retailer Kesko also reported problems in Finland. The method reportedly matched a wave in France in October, but the attackers’ identity and any role for AI remain unknown.
More than 115 stores across at least six European countries reported problems with refrigeration systems overnight on November 1–2, in what Belgian installer Sabcobel said used the same remote defrost method as a French incident in October. The disruptions affected supermarket freezers and other food businesses; no attacker has been identified, and the available reporting does not establish that AI was used.
Reports described refrigeration controllers being accessed remotely and switched into defrost or heating modes. In Belgium, Sabcobel chief executive Stephan Moelans told RTL and Belga that technicians began disconnecting installations at about 1 a.m. He said the company itself had not been hacked: the affected controllers in stores were reachable over the internet. About 20 of several hundred installations managed by Sabcobel in Belgium were affected, he told The Record.
Retailers reported incidents at stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, according to BleepingComputer. Finnish authorities and Kesko also reported temperature anomalies at a few smaller Finnish stores. Reported impacts varied. A Proxy Delhaize outlet in Hoepertingen said its freezers reached 15 °C and estimated that at least €60,000 of food had to be discarded, according to Het Belang van Limburg as cited by VRT NWS. A butcher in Antwerp, by contrast, reportedly stopped its systems in time.
Companies described different numbers of affected sites. Ahold Delhaize said an IT incident affected refrigeration systems in “several dozen stores”; BleepingComputer put the figure at about 40 in Belgium and Luxembourg. Carrefour Belgium said 15 of its 700 stores were affected, while Colruyt said the incidents involved about five independently operated Spar stores, not its own stores. In Sweden, ICA reported at least four affected stores outside its central network, and Coop reported seven of more than 800 stores affected. Separate reports cited 13 SuperValu stores in Ireland, one Selver store in Estonia and at least 17 businesses in the Netherlands.
Europe · Retail infrastructure · November 2026
How AI Is Shaping the Second Wave of Attacks on Europe’s Supermarket Refrigeration
A cross-border disruption put supermarket refrigeration under pressure. Remote controller changes and the scale of reported impact are documented; an attacker’s identity and any role for AI remain unconfirmed.
The evidence boundary
AI use is unconfirmed.Available reporting does not establish that AI helped find, access, or alter the refrigeration controllers.
01 / What happened
A remote change with physical consequences
Reports described refrigeration controllers being accessed remotely and switched into defrost or heating modes. In Belgium, technicians began disconnecting installations at about 1 a.m., according to Sabcobel chief executive Stephan Moelans. He said the affected in-store controllers were internet-reachable and that Sabcobel itself had not been hacked.
Reported method
Remote defrost
Controllers were reportedly switched into defrost or heating settings, disrupting normal cooling.
Belgium · installer account
Systems isolated
About 20 of several hundred Belgian installations managed by Sabcobel were affected, Moelans told The Record.
Operational impact
Food and service at risk
Stores faced spoiled stock, interrupted operations, technician callouts, and repair costs.
One reported outlet · Hoepertingen
€60,000+Proxy Delhaize estimated at least this much food had to be discarded after freezers reportedly reached 15°C, according to Het Belang van Limburg as cited by VRT NWS.
A location-specific estimate
This figure illustrates possible losses at one store. It is not a total for the affected countries. A butcher in Antwerp reportedly stopped its systems in time, showing that outcomes varied by site.
02 / Reported footprint
A wide footprint, provisional counts
BleepingComputer reported more than 115 stores in at least six countries. Retailer counts cover different store groups and reporting windows, so they do not form a single definitive total.
03 / The reported sequence
From exposed interface to store response
The public accounts outline an operational sequence, but do not provide a complete technical explanation for every affected location.
04 / October precedent
Similar method reported in France
The November incidents followed a reported refrigeration attack in France during the night of October 11–12. Similarity of method is not proof of shared perpetrators.
October · France
Paris prosecutors counted about 700 victims, according to the source material. On October 12, CERT-FR warned that remote-management interfaces for refrigeration controllers had been exposed online in ways that did not follow good practice.
“Probably still ongoing”CERT-FR’s warning about attack campaigns at that time.
November · Europe
Sabcobel said the Belgian incident used “exactly the same” mechanism as the French wave. That is the installer’s assessment of similarity, not a public finding that the same people were responsible.
No public attributionNo group has claimed responsibility in the available reporting.
The source material says specific Danfoss models were targeted, citing Finnish news agency STT on the Finnish National Cyber Security Centre’s assessment. It does not establish that every affected store used the same equipment or that every site shared an identical weakness.
05 / AI and the evidence
What the reporting does—and does not—say
Belgium’s cyber centre has warned of a general rise in cyberattacks partly involving AI. That broader warning is not evidence of AI use in this incident.
Remote access and controller setting changes were described; multiple retailers reported refrigeration disruptions.
No cited authority or company says AI was used to find exposed controllers, access systems, or change settings.
The exact access path at each site, whether the November and October attacks shared an actor, and total losses remain unclear.
06 / Investigation & response
Key questions remain open
Belgium’s federal prosecutor has opened a criminal investigation. The cyber centre has warned that identifying the attacker may prove impossible. Retailers and refrigeration technicians have been isolating or restoring systems, but public reporting gives no complete timetable for recovery.
How many stores were affected?
BleepingComputer reported more than 115 stores across at least six countries. Finnish authorities and Kesko separately reported problems at a few smaller stores. Counts remain provisional and differ by source.
Was AI used in the attack?
That is unconfirmed. Available reporting does not establish whether attackers used AI at any point.
Who was behind the attacks?
No group has claimed responsibility, and investigators have made no public attribution in the available material.
What happens next?
Investigators and operators will need to clarify access paths, affected equipment, store recovery, and the scale of food and financial losses.
Food Losses and Gaps in Store Networks
The reported damage shows how a cyber incident involving building-control equipment can affect physical operations, not just business data. When refrigeration controllers are changed remotely, stores may face spoiled food, disrupted service and repair costs. The Hoepertingen estimate illustrates the potential scale at an individual outlet, though it should not be taken as a total loss across the affected countries.
Several retailers said affected sites were outside their central networks or operated their own refrigeration systems. Colruyt said the affected Spar stores were run by independent entrepreneurs with separate equipment; ICA described its affected stores as outside the central network. Those accounts point to a possible security gap around older or independently managed systems, but do not prove that every affected site shared the same weakness.
The reports also warrant care with totals. The number of affected businesses varies by outlet and country, and some figures cover different groups of stores. The cross-border reach and reported food losses make the incident significant, while the precise overall damage remains unsettled.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Dyson W1 PencilWash Cordless Wet and Dry Floor Cleaner with Dock
Dyson Airwrap i.d. Multi-Styler for Straight and Wavy Hair
As an affiliate, we earn on qualifying purchases.
The October French Refrigeration Attack
The November incidents followed a reported attack in France during the night of October 11–12. France’s Paris prosecutor’s office counted about 700 victims, according to the source material. On October 12, France’s national cybersecurity agency, CERT-FR, warned that remote-management interfaces for refrigeration controllers had been exposed online in ways that did not follow good practice. It said attack campaigns were “probably still ongoing.”
Sabcobel said the Belgian incident used “exactly the same” mechanism as the French wave. That is an attribution of similarity from the installer, not a public finding that the same people carried out both incidents. The source material says attacks targeted specific Danfoss models, citing Finnish news agency STT on the Finnish National Cyber Security Centre’s assessment. It does not establish that every affected store used the same equipment or that the vulnerability was identical at each location.
The story’s AI framing needs a clear boundary. Belgium’s cyber centre has warned of a general rise in cyberattacks partly involving AI, according to the source material. But no cited authority or company said AI was used to find exposed controllers, access them, or change their settings in these incidents. That broader warning is not evidence of AI involvement in this particular attack.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize
Who Was Behind the Attacks?
No group has claimed responsibility, and the source material reports no public attribution by investigators. Belgium’s federal prosecutor has opened a criminal investigation; Belgium’s cyber centre has warned that identifying the attacker may prove impossible. It is also unclear whether the November incidents were carried out by the same actor or actors responsible for the October attack in France.
The affected-site totals remain provisional and do not align across reports. BleepingComputer counted more than 115 stores in six countries, while other outlets gave different figures for Belgium alone. The reports also vary on temperatures and impacts: accounts include freezers reaching 50 °C in Eeklo and Sweden, 15 °C in Hoepertingen, and other reported readings. These are location-specific reports, not a single temperature reading for all affected sites.
AI use is unconfirmed. The available material does not say whether attackers used AI at any point. It also does not give a complete technical account of how each controller was accessed, whether all affected systems were exposed in the same way, or the total food losses and financial damage.
Investigations and Store Repairs
Belgium’s federal prosecutor is investigating, while affected retailers and refrigeration technicians have been working to isolate or restore systems. The source material does not provide a timetable for the investigation or a complete account of which stores have returned to normal operation.
Retailers and equipment operators will need to determine whether exposed remote-management interfaces, specific controller models, or other weaknesses enabled each incident. France’s CERT-FR had already warned about internet-accessible interfaces and said campaigns were probably ongoing; whether that warning’s recommended actions were applied consistently across affected businesses is not established by the reports.
Further statements from investigators, national cybersecurity agencies and retailers may clarify the attack method, the number of affected locations and the losses. Until those details are confirmed, the incidents are best described as a second reported wave of refrigeration-system attacks—not as a proven AI-enabled campaign.
Key Questions
How many stores were affected?
BleepingComputer reported more than 115 stores in at least six countries. Finnish authorities and Kesko separately reported problems in a few smaller Finnish stores. Figures differ by outlet and remain provisional.
Was AI used in the attacks?
That has not been established. Belgium’s cyber centre has warned about a broader rise in attacks partly involving AI, but no cited source says AI was used in these refrigeration incidents.
What happened to the refrigeration systems?
Reports say controllers were accessed remotely and switched into defrost or heating modes. The exact technical circumstances have not been publicly detailed for every affected store.
Have investigators identified the attackers?
No. The source material reports no claim of responsibility or public attribution. Belgium’s federal prosecutor has opened a criminal investigation.
Is this connected to the October attack in France?
Sabcobel said the method was “exactly the same” as the one used in France in October. That reported similarity does not confirm that the same attacker was responsible for both waves.
Source: ThorstenMeyerAI.com
