🔍 Read the full analysis: AI And The Emerging Threat To Europe’s Supermarket Cooling on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Refrigeration systems at more than 115 supermarkets and other food businesses across at least six European countries were reportedly disrupted overnight on November 1–2, 2026. The reported method resembles attacks in France in October, but responsibility and any role for AI remain unknown.
Refrigeration systems at more than 115 stores in at least six European countries were reportedly disrupted overnight on November 1–2, with some controllers switched into defrost or heating modes, threatening food supplies and causing reported losses. The incidents, reported by broadcasters and news outlets including RTL, VRT NWS and BleepingComputer, resemble a wave that hit French supermarkets in October, but no one has been identified as responsible, and there is no confirmation that artificial intelligence was involved.
In Belgium, refrigeration installer Sabcobel chief executive Stephan Moelans said technicians began disconnecting systems from about 1 a.m. He told Belgian media that internet-reachable controllers at stores were attacked directly and that Sabcobel itself was not hacked. About 20 of several hundred installations managed by his company in Belgium were affected, he told The Record.
Retailers described damage at stores with different owners and equipment. Ahold Delhaize said it had identified an IT incident affecting refrigeration at several dozen stores; BleepingComputer put the figure at about 40 stores in Belgium and Luxembourg. Carrefour Belgium said 15 of its 700 stores were affected. Colruyt said around five independently operated Spar stores were affected, while its own stores were not.
Reports also described disruptions at ICA and Coop stores in Sweden, SuperValu outlets in Ireland, an IKEA store in Belgium, and businesses in the Netherlands and Estonia. Finnish authorities and retailer Kesko reported overnight temperature anomalies at a few smaller stores. The totals and country-by-country counts vary among reports, so 115 is a reported estimate, not a settled official count.
Europe · Retail infrastructure · Incident briefing
AI and the Emerging Threat to Europe’s Supermarket Cooling
A reported overnight wave disrupted refrigeration at supermarkets and food businesses across Europe. The systems were affected; responsibility and any role for artificial intelligence remain unconfirmed.
The reported scale
115+ stores and food businesses reportedly affected across at least six European countriesAI status: unconfirmed. No evidence in the available reporting establishes that AI was used in these incidents.
01 / What was reported
Cooling controls became an operational weak point
Reports say refrigeration controllers at multiple businesses were switched into defrost or heating modes. Stores described separate impacts, and the reported totals remain estimates rather than a settled official count.
Cooling interrupted
Some systems were reportedly switched remotely into defrost or heating settings. Conditions and temperatures differed by location.
Food and revenue at risk
Warming freezers can force businesses to discard stock, shut equipment down, and absorb lost sales or replacement costs.
Counts and links unsettled
Reports differ on affected sites and countries. Investigators have not confirmed whether all cases are connected.
The key distinction: the reported attack pattern resembles the October incidents in France, but resemblance does not prove the same actor. There is also no confirmation that AI was involved.
02 / Reported footprint
More than 115 is an estimate, not a final tally
Coverage from broadcasters, retailers and security news outlets describes incidents in several countries. Figures below are examples reported for individual businesses, not a complete country-by-country census.
Reports also mentioned ICA and Coop in Sweden, SuperValu in Ireland, an IKEA store in Belgium, and Finnish temperature anomalies at a few smaller Kesko stores. Finland appears in some accounts beyond the six countries listed by BleepingComputer.
03 / Direct statements
Retailers confirmed refrigeration incidents
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
Ahold Delhaize
The supplied reporting describes direct access to store refrigeration controllers. It does not establish a compromise of installers’ or retailers’ central corporate networks.
04 / Operational consequences
Food loss can follow a single control change
The immediate concern is food safety and spoilage, alongside lost revenue and the cost of replacing stock. Some businesses detected problems early and shut systems down, which limited losses.
Remote access
A controller reachable online is accessed, according to the reported attack pattern.
Mode switched
Equipment is reportedly changed to defrost or heating mode.
Temperature rises
Freezers and refrigerators warm, with conditions varying between stores.
Stock assessed
Operators isolate equipment and decide whether products remain safe.
Business absorbs loss
Discarded food, replacement costs and interrupted trading can follow.
VRT NWS reported that a Proxy Delhaize store in Hoepertingen estimated at least €60,000 in discarded food after freezers warmed to 15 °C. A butcher in Hove reportedly discarded hundreds of kilograms of food. No Europe-wide loss total has been confirmed.
05 / The October comparison
A similar reported method, with no confirmed shared actor
The November wave follows supermarket attacks in France during the night of October 11–12, 2026. Reporting describes similarities in the equipment and mode changes, while leaving responsibility unresolved.
| Reported detail | France · October 11–12 | Europe · November 1–2 |
|---|---|---|
| Scale described | About 700 victims counted by the Paris prosecutor’s office | More than 115 stores or businesses reported; total unsettled |
| Equipment concern | Exposed remote management interfaces flagged by CERT-FR | Internet-reachable controllers described in reporting |
| Reported change | Evaporators switched into defrost mode, according to Sabcobel | Controllers reportedly switched into defrost or heating modes |
| Equipment models | Remote interfaces for refrigeration controllers highlighted | Finnish NCSC said specific Danfoss models were targeted, according to STT |
| Shared responsibility | Not established in supplied reporting | Not confirmed; no suspect publicly identified |
France’s CERT-FR warned that exposed remote-management interfaces were contrary to recommended practice and said campaigns were probably still ongoing. A similar method alone cannot show that the same person or group carried out both waves.
06 / What remains unknown
Evidence has not settled the central questions
Belgium’s federal prosecutor has opened an investigation. Authorities have not publicly identified a suspect, and the Belgian cyber centre cautioned that an attacker may never be identified.
No group has claimed responsibility, and investigators have not named a suspect.
It is unclear whether November cases are linked to each other or to France’s October incidents.
The precise way each controller was accessed, and how long systems were exposed, is not yet clear.
Reported totals and country counts differ; there is no final official Europe-wide count in the supplied reporting.
Temperatures reportedly ranged by site, including 15 °C at one Belgian store and 50 °C in other reports. Total food loss is unknown.
No evidence confirms AI was used to access or operate these refrigeration systems.
07 / Security checks and key questions
What operators and readers should watch next
The reporting raises a practical security issue beyond corporate IT: internet-connected building equipment can affect daily operations. Exposure does not mean every independent store or older controller is vulnerable.
Review remote reachability
Store operators may need to check whether refrigeration controllers can be reached remotely, how those connections are protected, and whether affected equipment has been isolated or updated.
Measures vary by business
France’s warning called attention to exposed interfaces. Available reporting does not say which businesses completed particular security measures.
How many stores were affected?
Reports put the figure above 115 across at least six countries. There is no final official total in the reporting provided.
Who carried out the attacks?
No one has been identified or claimed responsibility. Belgium’s federal prosecutor is investigating.
Was AI involved?
There is no confirmation that AI was involved. Broader warnings about AI do not establish its use in these incidents.
Were the French incidents connected?
The reported method resembles the October attacks, but investigators have not confirmed a shared actor.
Traceability / current picture
Reported disruption → ongoing investigation → attribution unresolved
Further updates may clarify the final store count, confirmed food losses, cross-border links and whether investigators can connect the November incidents to France’s October cases.
Food Losses and Exposed Store Systems
When refrigeration controls are changed, the immediate concern is food safety and spoilage, as well as lost revenue and the cost of replacing stock. VRT NWS reported that a Proxy Delhaize store in Hoepertingen estimated at least €60,000 in discarded food after freezers warmed to 15 °C. A butcher in Hove reportedly threw away hundreds of kilograms of food. Some businesses detected the problem in time to shut systems down, limiting losses.
The reports also point to a practical security issue beyond supermarket IT networks: internet-connected building equipment can affect daily operations. Several retailers said affected locations were independent stores or sites operating outside a chain’s central network, with separate or older refrigeration systems. That pattern is reported by companies and broadcasters; it does not establish that every independent store or older controller is vulnerable.
Despite the article topic, AI is not a confirmed part of this incident. Belgium’s cyber centre has warned about a broader rise in attacks that partly involve AI, according to the supplied reporting, but officials have not said AI was used to access or operate these refrigeration systems. Linking AI to this specific wave would go beyond what is known.
Products Worth Considering
Samsung 32-inch Odyssey OLED G8 (G80SH) 4K QD-OLED Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Attack in October
The November incidents follow attacks on supermarkets in France during the night of October 11–12, 2026. France’s Paris prosecutor’s office counted about 700 victims, according to the source material. On October 12, France’s CERT-FR warned that remote management interfaces for refrigeration controllers were exposed online contrary to recommended practice, and said attack campaigns were probably still ongoing.
Belgian installer Sabcobel described the mechanism in the new incidents as “exactly the same” as in France: evaporators were remotely switched into defrost mode. Finland’s National Cyber Security Centre also said the attacks in Finland and elsewhere targeted specific Danfoss models, according to Finnish news agency STT. These reports indicate similarities, but do not by themselves prove that the same person or group carried out both waves.
In Belgium, the federal prosecutor has opened a criminal investigation. The Belgian cyber centre has cautioned that the attacker may never be identified. The reporting available so far describes direct access to store refrigeration controllers, rather than a confirmed compromise of the installers or retailers’ central corporate networks.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Who Accessed the Controllers
Attribution remains unknown: no group has claimed responsibility, and investigators have not publicly identified a suspect. It is also unclear whether the November wave was carried out by the same actor as the October attacks in France. Similar reported methods are evidence of a resemblance, not proof of shared responsibility.
The precise number of affected businesses is unsettled. Reports differ on the Belgian total and on the number of countries involved; Finland appears in some accounts in addition to the six countries listed by BleepingComputer. Reported temperatures also vary by location, from 15 °C in one Belgian store to 50 °C in reports about other sites. There is no confirmed Europe-wide damage or food-loss total.
It is not yet clear exactly how each controller was accessed, whether all reported cases are linked, or how long systems were exposed. Nor is there evidence in the supplied reporting that AI played a role in these attacks.
Investigations and Security Checks
Belgium’s federal prosecutor is investigating, while authorities and affected retailers work to establish which sites and systems were involved. Store operators may need to review whether refrigeration controllers can be reached remotely, how those connections are protected, and whether affected equipment has been isolated or updated. France’s October warning had already called attention to exposed remote-management interfaces, but the available reporting does not say which businesses completed particular security measures.
Further updates should clarify the final number of affected stores, any confirmed food losses, and whether investigators can connect the incidents across countries or to the October French cases. Until authorities release findings, the actor, motive and any AI involvement remain unconfirmed.
Key Questions
How many stores were affected?
Reports put the total at more than 115 stores or businesses across at least six countries. Counts vary by source, and there is no final official total in the reporting provided.
What happened to the refrigeration systems?
Reports say controllers were remotely switched into defrost or heating modes, causing some freezers and refrigerators to warm or stop cooling. The exact conditions differed by store.
Who carried out the attacks?
No one has been identified, and no one has claimed responsibility. Belgium’s federal prosecutor has opened an investigation.
Was artificial intelligence used?
There is no confirmation that AI was involved. A general warning about attacks partly involving AI does not establish that AI was used in these incidents.
Were the November incidents linked to the French attacks?
The reported method resembles attacks in France on October 11–12, but investigators have not confirmed that the same actor was responsible for both waves.
Source: ThorstenMeyerAI.com
