🔍 Read the full analysis: AI And The Risks To Europe’s Supermarket Cooling Infrastructure on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Refrigeration systems at more than 115 supermarkets and other businesses across at least six countries were reportedly disrupted overnight on Nov. 1–2. Authorities and companies say internet-accessible controllers were targeted, but the attackers’ identity and any role for AI have not been established.
Refrigeration systems at more than 115 stores and businesses across at least six European countries were reportedly disrupted overnight on Nov. 1–2, after attackers accessed controllers and changed their settings. The incidents affected outlets in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, with Finnish authorities and retailer Kesko also reporting problems; who carried out the attacks, and whether AI was involved, remain unknown.
In Belgium, refrigeration installer Sabcobel chief executive Stephan Moelans told Belgian media that technicians began disconnecting affected installations at about 1 a.m. He said the company itself had not been hacked and that the internet-reachable controllers at stores were targeted directly. About 20 of several hundred installations managed by Sabcobel in Belgium were affected, he told The Record.
Retailers described different levels of disruption. Ahold Delhaize said it had identified an IT incident affecting refrigeration systems in several dozen stores; BleepingComputer put the figure at about 40 in Belgium and Luxembourg. Carrefour Belgium said 15 of its 700 stores were affected, while Colruyt reported problems at about five independently operated Spar stores and said its own stores were not affected. ICA reported at least four affected Swedish stores, and Coop said seven of its more than 800 stores experienced effects ranging from shut-down units to heating.
Reports also named about 15 Intermarché outlets and one IKEA store in Belgium, 13 SuperValu stores in Ireland, one Selver store in Estonia and at least 17 businesses in the Netherlands, mostly butchers and neighbourhood shops, according to a Danfoss spokesperson quoted by NOS. In Finland, Kesko and the National Cyber Security Centre reported temperature anomalies at smaller stores. A butcher in Antwerp stopped its system in time, VRT NWS reported; a Proxy Delhaize in Hoepertingen estimated at least €60,000 in food losses after freezers warmed to 15°C, according to local reporting cited by VRT.
Cyber incident · Europe · November 2026
AI and the Risks to Europe’s Supermarket Cooling Infrastructure
Refrigeration controllers at stores and other businesses were reportedly altered overnight. The operational disruption is documented; the attackers’ identity and any role for AI remain unknown.
The incident at a glance
Reported counts vary across outlets and countries. The figures are preliminary, not a single authoritative total.
Finland also reported temperature anomalies. The full number of sites, overall losses and links between incidents have not been confirmed.
Where disruption was reported
Effects ranged from altered settings and shut-down units to heating. Counts below reflect the reporting cited in the source material.
Belgium
Reports included Carrefour, Ahold Delhaize, Colruyt-linked independent Spar stores, Intermarché outlets and an IKEA store.
Netherlands
At least 17 businesses, mostly butchers and neighbourhood shops, according to a Danfoss spokesperson cited by NOS.
Sweden
ICA reported at least four stores; Coop said seven stores experienced effects, from stopped units to heating.
Finland
Kesko and the National Cyber Security Centre reported temperature anomalies at smaller stores.
Ireland & Estonia
Reports named 13 SuperValu stores in Ireland and one Selver store in Estonia.
Luxembourg
Included in reports of affected outlets, though a separate country total was not established.
Different chains, different impacts
Carrefour Belgium said 15 of 700 stores were affected. Ahold Delhaize reported several dozen stores; BleepingComputer put Belgium and Luxembourg at about 40. Colruyt said its own stores were unaffected, while about five independently operated Spar stores reported problems.
Why cooling equipment matters
An attack on building equipment can disrupt ordinary store operations without taking down checkout systems or a corporate network. Changed refrigeration settings can force businesses to shut down units, discard stock and arrange urgent repairs.
Some affected outlets were reportedly outside their chains’ central networks or used independently operated refrigeration systems. That may help explain the pattern, but it does not establish that every independent store has the same exposure.
Of several hundred Belgian installations managed by Sabcobel were affected, its chief executive told The Record. He said technicians began disconnecting affected installations at about 1 a.m.
Company account · BelgiumA similar attack preceded it
France’s October incident offers technical context, but does not prove the same actor or access method in every November case.
Hundreds of supermarkets reportedly hit
Refrigeration systems were reportedly switched into defrost mode. Paris prosecutors counted about 700 victims.
Exposed remote interfaces flagged
CERT-FR warned that remote management interfaces for refrigeration controllers were exposed online, contrary to recommended practice.
Disruption reported across countries
Sabcobel said the mechanism was “exactly the same” as in France. CERT-FR had warned campaigns were “probably still ongoing.”
What is known—and what is not
Separate confirmed reporting from open questions as investigations and store assessments continue.
Controller settings were changed
Reports describe refrigeration units moved into defrost or heating modes, with impacts ranging from partly functioning equipment to shut-down refrigerators and freezers.
Who carried out the attacks?
No suspect or group has been identified in the cited reporting, and no one has claimed responsibility. Belgian federal prosecutors have opened a criminal investigation.
Was AI involved?
No cited source says AI was used to find controllers, alter settings or coordinate incidents. Broader warnings about AI-related attacks do not establish AI use here.
How large was the total impact?
Reported counts and temperatures differ. A complete site count, total food losses and whether incidents share one operator have not been confirmed in a single authoritative accounting.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
Ahold Delhaize
Questions readers are asking
What current reporting can—and cannot—answer.
What happened to the refrigeration systems?
Reports say attackers remotely changed controller settings, causing some units to enter defrost or heating modes. Effects varied by store.
How many businesses were affected?
BleepingComputer reported more than 115 stores across six countries. Finland was also reported to have cases. A final authoritative count is unavailable.
Was artificial intelligence used?
That has not been established. The source reporting provides no evidence that AI was involved in these incidents.
Who is responsible?
No suspect or group has been identified in the reporting. Belgium’s federal prosecutor has opened an investigation.
Food Losses and Store Disruption
The incidents show how an attack on building equipment can affect ordinary business operations without disrupting a store’s checkout systems or corporate network. When refrigeration controllers are altered, businesses may have to shut down equipment, discard stock and arrange urgent repairs. The reported losses in Hoepertingen illustrate the potential cost, though the overall financial damage across affected countries has not been established.
The pattern also highlights exposure among smaller or independently operated outlets. ICA said the affected stores operated outside its central network; Colruyt attributed the Spar incidents to independent operators using their own refrigeration systems. Such arrangements can leave equipment outside the safeguards applied to centrally managed sites. That is a reported pattern in these incidents, not proof that every independent store has the same vulnerability.
Products Worth Considering
Samsung 27-inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD Gaming Monitor
Samsung 49-inch Odyssey OLED G9 (G91SD) Dual QHD Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Attack in October
The November incidents followed a wave in France on the night of Oct. 11–12, when refrigeration systems at hundreds of supermarkets were reportedly switched into defrost mode. France’s Paris prosecutor’s office counted about 700 victims. Belgium’s Sabcobel said the mechanism in the later incidents was “exactly the same” as in France.
France’s national cybersecurity agency, CERT-FR, warned on Oct. 12 that remote management interfaces for refrigeration controllers were exposed online, contrary to recommended practice, and said attack campaigns were “probably still ongoing.” That warning provides relevant technical context, but it does not by itself establish how every store in the November incidents was accessed or whether all cases were carried out by the same person or group.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize
Attackers and AI Use Unknown
No attacker has been identified, and no group has claimed responsibility in the source reporting. Belgium’s federal prosecutor has opened a criminal investigation; the Belgian cyber centre has warned that identifying the perpetrator may prove impossible. No source cited here says AI was used to find vulnerable controllers, change their settings or coordinate the incidents. Belgium’s cyber centre has discussed a broader rise in attacks that partly involve AI, but that general warning is not evidence of AI use in this case.
The reported totals also differ. BleepingComputer counted more than 115 affected stores in six countries, while other reports give different figures for Belgium and describe additional Finnish cases. Store counts and reported temperatures vary by outlet, and assessments may still be changing. The complete number of affected sites, the total food losses and whether the incidents share one operator have not been confirmed in a single authoritative accounting.
Investigations and Store Checks
Belgian prosecutors are investigating, while affected retailers and refrigeration providers continue to assess equipment and losses. The incident reports point to internet-accessible controllers as a concern, and stores may need to check whether remote-management interfaces are exposed and whether their systems have the relevant security updates. The source material says manufacturers had shipped updates months earlier, but it does not establish which affected sites had installed them.
Further reporting from national authorities, retailers and investigators may clarify the final number of affected businesses, the technical access route and whether the October and November incidents were linked. Until those findings are public, the identity of the attackers and any AI involvement remain unconfirmed.
Key Questions
What happened to the supermarket refrigeration systems?
Reports say attackers remotely changed settings on refrigeration controllers, causing some units to enter defrost or heating modes. Effects varied by store, from partly functioning equipment to shut-down refrigerators and freezers.
How many businesses were affected?
BleepingComputer reported more than 115 affected stores across six countries. Other outlets reported different national totals, and Finland was also reported to have cases. A final, authoritative count is not available.
Was AI used in the attacks?
That has not been established. The source reports no evidence that AI was involved. A general warning about AI-related cyberattacks does not confirm its use in these incidents.
Who is responsible?
No suspect or group has been identified in the reporting, and no one has claimed responsibility. Belgium’s federal prosecutor has opened a criminal investigation.
Why were some smaller stores affected?
Some affected outlets were reportedly outside their chains’ central networks or used independently operated refrigeration equipment. This may help explain why they were affected, but the reporting does not establish the security arrangements at every store.
Source: ThorstenMeyerAI.com
