🔍 Read the full analysis: Exploring AI’s Connection To Europe’s Supermarket Refrigeration Threats on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Refrigeration systems at more than 115 stores and other businesses across at least six European countries were reportedly disrupted overnight on Nov. 1–2. Retailers and officials link the incidents to remotely accessed refrigeration controllers, but the attacker’s identity and any role for AI remain unconfirmed.
Refrigeration systems at more than 115 stores and other businesses across at least six European countries were reportedly disrupted overnight on Nov. 1–2, in a second wave of attacks that left some freezers heating instead of cooling. Retailers and refrigeration specialists said the incidents involved remotely accessed controllers; no evidence has been presented that AI was used, and investigators have not identified who was responsible.
Reports cited by BleepingComputer put the affected locations in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish authorities and retailer Kesko also reported temperature problems at a few smaller Finnish stores. Counts vary across media reports and company statements, so 115 is a reported total, not a settled official count.
In Belgium, retailer Ahold Delhaize said it had identified an IT incident affecting refrigeration systems in several dozen stores. Carrefour Belgium reported 15 affected stores out of 700, while Colruyt said problems involved about five independently operated Spar stores rather than its own shops. In Sweden, ICA reported at least four affected stores and Coop said seven of its more than 800 stores were affected. Reported incidents also included 13 SuperValu stores in Ireland, one Selver store in Estonia, and at least 17 businesses in the Netherlands, mostly butchers and neighbourhood shops, according to a Danfoss spokesperson quoted by NOS.
The disruption caused food losses at some locations. A Proxy Delhaize in Hoepertingen reported freezer temperatures of 15 °C and estimated that at least €60,000 of food had to be discarded, according to Het Belang van Limburg as cited by VRT NWS. A butcher in Hove reportedly threw away hundreds of kilos of food. At one Antwerp butcher, staff noticed the tampering early and shut down the systems in time, VRT reported.
Europe · Infrastructure security · Nov. 1–2, 2026
When Freezers Turn Warm: Europe’s Supermarket Refrigeration Threat
A reported second wave disrupted refrigeration controllers across Europe. Food losses are documented, but the attacker’s identity and any role for AI remain unconfirmed.
Disruption across the cold chain
Reports describe freezers switching into defrost or heating modes after remote access to refrigeration controllers. Totals differ by outlet and company statement.
Multiple retail groups
Ahold Delhaize cited several dozen stores; Carrefour Belgium reported 15 of 700. Colruyt said problems involved about five independently operated Spar stores.
ICA and Coop
ICA reported at least 4 stores; Coop said 7 of more than 800 were affected.
SuperValu
Reports included 13 stores with refrigeration disruption.
Independent businesses
A Danfoss spokesperson cited at least 17 businesses, mostly butchers and neighbourhood shops.
Selver
One Selver store was reported affected.
Additional reports
Luxembourg appeared in reports of the wider wave. Finnish authorities and Kesko reported temperature problems at a few smaller stores.
Country and store figures are source-dependent and provisional; they should not be treated as a settled official tally.
Food loss, operational risk
An attack on building technology can create immediate costs even when reporting does not describe a compromise of checkout systems or customer data.
A costly freezer failure
A Proxy Delhaize in Hoepertingen reported freezer temperatures of 15 °C and estimated at least €60,000 in food had to be discarded. A butcher in Hove reportedly threw away hundreds of kilos of food.
Intervention limited losses
At one Antwerp butcher, staff noticed tampering early and shut down systems in time, according to VRT. For independent shops, a single outage can mean substantial waste and business disruption.
What is known—and what is not
The reported method points to remotely accessed controllers. That alone does not establish whether AI played any role.
AI involvement is unsubstantiated
Belgium’s cyber centre has discussed a broader rise in attacks that may involve AI, according to the source material. No retailer, investigator, or technical authority cited here has said AI was used in these refrigeration incidents.
Remote access is the concern
Several affected locations were described as outside a retailer’s central network or safeguards, sometimes with older, independently managed equipment. This makes controller exposure and equipment management relevant security concerns, but does not explain the vulnerability at every site.
A warning preceded the November wave
The French incident and a CERT-FR advisory provide context. Reporting does not establish whether every affected business shared a controller model or security history.
Oct. 11–12
Reported attack on French supermarkets; Paris prosecutors counted about 700 victims.
Oct. 12 advisory
CERT-FR warned that remote management interfaces for refrigeration controllers were exposed online contrary to good practice.
Nov. 1–2
A second reported wave disrupted refrigeration in multiple European countries.
Investigation ongoing
Belgian authorities opened a criminal investigation; attribution and technical findings remain pending.
“Refrigeration evaporators were switched remotely into defrost mode.”Belgian installer Sabcobel, describing the reported mechanism
CERT-FR said campaigns were probably still ongoing. The advisory preceded the November incidents by about three weeks, but available reporting does not show what corrective steps individual operators took.
Attribution and scope remain uncertain
Authorities and businesses still need to establish how access occurred, what systems were affected, and whether the incidents share a source.
How many locations were affected?
Reports cited by BleepingComputer put the number above 115 across at least six countries. Company figures differ, and Finland also reported problems.
Were customer payment systems affected?
Available reports focus on refrigeration equipment and food losses. They do not confirm whether payment systems or customer data were affected.
Has an attacker been identified?
No. No attribution or responsibility claim appears in the reported material. Belgium’s federal prosecutor has opened a criminal investigation.
Were the French and November attacks linked?
The reported mechanism was described as similar, but available reporting does not establish whether one actor coordinated both waves.
From controller access to business impact
Remote interface
Online management access is a documented security concern raised by CERT-FR.
Controller change
Retailers and specialists reported remote changes to refrigeration operation.
Temperature rise
Some freezers warmed; reports describe temperatures varying by site.
Food and recovery
Some businesses discarded stock and restored safe settings; a shared recovery timetable is not available.
The evidence chain summarizes reported events and known concerns. It does not establish a single technical path for every affected location.
Food Losses and Exposed Controllers
The incidents show how an attack on building and refrigeration technology can create immediate costs without targeting checkout systems or customer data. When a controller changes a freezer’s operating mode, perishable stock can be lost before staff can intervene. For independent shops, even a single outage can mean substantial waste and business disruption.
The reported pattern also points to a security gap: several affected locations were described as operating outside a retailer’s central network or safeguards, sometimes with older, independently managed equipment. That does not establish why each site was vulnerable, but it makes remote access and equipment management relevant concerns for businesses running connected refrigeration systems.
The AI connection remains unsubstantiated. Belgium’s cyber centre has warned about a broader rise in attacks that may involve AI, according to the source material, but no retailer, investigator or technical authority cited here has said AI was used in this incident. The reported method—accessing internet-reachable controllers—does not by itself establish AI involvement.
Products Worth Considering
LG 24G414B-B 24-Inch UltraGear Full HD IPS Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Attack in October
The Nov. 1–2 incidents followed a reported attack on French supermarkets during the night of Oct. 11–12. France’s Paris prosecutor’s office counted about 700 victims in that earlier wave, according to the source material. Belgian installer Sabcobel said the later incidents used the same mechanism: refrigeration evaporators were switched remotely into defrost mode.
On Oct. 12, France’s national cybersecurity agency, CERT-FR, warned that remote management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice. It said campaigns were probably still ongoing. The warning preceded the November incidents by about three weeks, but the available reporting does not establish whether every affected business used the same controller model or had received relevant software updates.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize
Attribution, Counts and AI Role
No suspect or motive has been publicly identified, and no one has claimed responsibility, according to the source material. Belgium’s federal prosecutor has opened a criminal investigation; Belgium’s cyber centre has said the perpetrator may never be identified.
The scale also remains unsettled. Media and company figures differ, and reports describe different affected countries, retailer totals and freezer temperatures. These discrepancies mean the available counts should be treated as provisional and source-dependent, rather than combined into a definitive tally.
It is also unclear how access was obtained in each case, whether the November events were coordinated by the same actor as the French incidents, and whether any stolen data or systems beyond refrigeration were involved. Most importantly for the story’s AI framing, the available material contains no confirmation that AI played any part.
Investigations and Store Recovery
Belgian authorities’ criminal investigation is ongoing. Retailers and operators will need to establish which systems were accessed, restore safe refrigeration settings and assess losses; the source material does not give a common timetable for those steps. Further confirmed figures may also change as affected businesses report incidents.
Businesses that use remotely managed refrigeration equipment may review whether controller interfaces are exposed online and whether access controls and software are current. France’s CERT-FR had already warned about exposed remote-management interfaces, but the available reporting does not say what corrective actions individual retailers or equipment operators have taken since the latest wave. Further attribution and technical findings will be needed to determine the attackers’ method and whether the incidents share a single source.
Key Questions
How many locations were affected?
Reports cited by BleepingComputer put the number at more than 115 locations across at least six countries. Other outlets and company statements give different totals, and Finnish authorities and Kesko also reported problems, so the final count is not settled.
What happened to the refrigeration systems?
Retailers and refrigeration specialists said controllers were accessed remotely and units were switched into defrost or heating modes. Reports describe freezers reaching temperatures as high as 50 °C at some sites, though temperatures varied by location.
Has anyone confirmed that AI was used?
No. The source material says Belgium’s cyber centre has discussed a broader rise in attacks that may involve AI, but no source cited has confirmed AI use in these refrigeration incidents.
Have authorities identified the attacker?
No attribution has been announced, and no group has claimed responsibility in the reported material. Belgium’s federal prosecutor has opened a criminal investigation.
Were customer payment systems affected?
The available reports focus on refrigeration equipment and food losses. They do not confirm whether payment systems, customer data or other business systems were affected.
Source: ThorstenMeyerAI.com
