🔍 Read the full analysis: Does AI Change The Risk To Supermarket Refrigeration? on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Reports say more than 115 supermarkets and other businesses across at least six European countries experienced refrigeration disruptions overnight on Nov. 1–2, 2026. The method reportedly resembles an October attack in France, but investigators have not identified the attacker or established whether AI was involved.
Refrigeration systems at more than 115 stores in at least six European countries were reportedly disrupted overnight on Nov. 1–2, after attackers remotely changed settings on internet-reachable controllers. Retailers and authorities have not said who was responsible, and there is no confirmed evidence that AI was used; the incidents matter because they show how exposed building equipment can disrupt food storage even without a reported break-in to store networks.
Reports from Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia describe refrigeration units switched into defrost or heating modes. Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller stores. The total is not settled: BleepingComputer put the number above 115, while media accounts use different counts and ranges. These figures should be treated as reported estimates, not a final tally.
In Belgium, refrigeration installer Sabcobel chief executive Stephan Moelans told Belgian media that technicians began disconnecting installations at about 1 a.m. He said the controllers at stores had been reached directly over the internet and that the mechanism matched the French incidents earlier in October. Sabcobel said about 20 of the several hundred installations it manages in Belgium were affected; the company itself, Moelans said, was not hacked.
Retailers described damage at individual sites. A Proxy Delhaize in Hoepertingen reported freezer temperatures of 15°C, rather than its usual minus 22°C, and estimated that at least €60,000 worth of food had to be discarded, according to local reporting cited by VRT NWS. Carrefour Belgium said 15 of its 700 stores were affected, while Coop Sweden reported disruption at seven stores. Some operators said affected sites were outside their central networks or used independently managed refrigeration equipment.
Europe • Refrigeration disruption • Nov. 1–2, 2026
Does AI Change the Risk to Supermarket Refrigeration?
Reports describe remote changes to store refrigeration controllers across Europe. The incidents expose an operational risk, but investigators have not identified an attacker or established any use of AI.
01 / The reported incident
When cooling settings become a food risk
Accounts from Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia describe refrigeration units switched into defrost or heating modes. Finland’s National Cyber Security Centre and retailer Kesko also reported temperature anomalies at a few smaller stores.
Access pattern
Controllers reached online
Belgian installer Sabcobel said store controllers were accessed directly over the internet. Its technicians began disconnecting installations at about 1 a.m.
Reported impact
Temperatures rose sharply
A Proxy Delhaize in Hoepertingen reportedly reached 15°C in its freezers, versus a usual −22°C. Local reporting cited an estimated €60,000 in food loss.
Counts are provisional
No final tally yet
Outlets reported different counts and ranges. Sabcobel said about 20 of several hundred Belgian installations it manages were affected; it said its own company was not hacked.
02 / What the reports establish
Operational exposure is clear; attribution is not
The events link cyber access to an immediate business problem: refrigeration settings affect food safety, inventory and store operations. Reports also raise questions about how independently managed equipment is monitored.
Some locations may have had to discard food. Total losses and disruption duration across all reported sites have not been confirmed.
Some operators said affected sites were outside central networks or used independently managed refrigeration equipment. This does not prove one weakness explains every incident.
Belgium’s federal prosecutor opened a criminal investigation. No perpetrator has been identified in the supplied reporting.
03 / The October connection
A reported French wave preceded the disruption
French authorities and media reported attacks on supermarket refrigeration on the night of Oct. 11–12. The Paris prosecutor’s office counted about 700 victims, according to the source material.
Exposed interfaces
CERT-FR warned that remote management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice.
Remote changes
Sabcobel described the November mechanism as matching France: evaporators were reportedly switched into defrost mode.
Store disruption
Cooling was disrupted, with reports of units entering defrost or heating modes and temperature anomalies at some sites.
Open questions
Similarities suggest a possible equipment and access pattern, but do not establish a shared attacker or identical cause.
Reported technical lead
Finland’s National Cyber Security Centre said attacks in Finland and elsewhere targeted specific Danfoss models, according to news agency STT.
AI evidence
No case-specific finding was reported. A general warning about AI-assisted attacks is not evidence AI was used in this campaign.
04 / What remains unknown
Keep the claims in proportion to the evidence
Unconfirmed
Who was responsible?
No group has claimed responsibility in the reporting provided. Belgian authorities have cautioned that identifying the perpetrator may not be possible.
Unsettled
How many sites?
Counts differ between outlets. The reported 115-plus figure and country coverage are estimates, not a final confirmed total.
Not established
Did AI change the risk?
The supplied reporting gives no forensic finding or official statement that AI was involved. Its role in these incidents is unknown.
05 / Practical checks
Security review follows the reported access path
Businesses using remote refrigeration controls may review whether management interfaces are exposed online and whether independently operated locations receive the same security oversight as centrally managed stores. These are precautionary checks, not findings about every affected system.
What happened to the systems?
Reports say controllers were accessed remotely and switched into defrost or heating modes, disrupting normal cooling.
Was AI used?
That has not been established. The reports provide no evidence that AI was used in these incidents.
Why mention independent stores?
Some retailers said affected sites operated outside central networks or used independently managed equipment. The reports do not show this applied to every location.
What could clarify the picture?
Confirmed counts, damage assessments and technical findings may establish whether the November events shared the French wave’s access method or equipment pattern.
Food Loss and Exposed Store Systems
The incidents connect a cyber risk to an immediate operational problem: refrigeration settings can affect food safety, inventory and store operations. When temperatures rise, businesses may have to discard stock, as the Hoepertingen estimate illustrates. The reported effects ranged from disrupted units to systems generating heat, but the scale of food loss across all affected locations has not been established.
The accounts also point to a practical security concern for businesses that rely on internet-connected building controls. Several retailers said affected sites operated outside their central network or safeguards. That does not prove a single weakness explains every incident, but it suggests that smaller or independently managed locations may have different levels of oversight and protection. The incidents do not establish that AI increased the attackers’ capabilities or changed the risk to refrigeration systems.
Popular right now
Roborock H60 Ultra-B Cordless Stick Vacuum Cleaner
Ninja Foodi Smart Dual Heat Air Fry Oven, 13-in-1, Silver (SP351)
Dyson Ball Animal 3 Upright Vacuum
As an affiliate, we earn on qualifying purchases.
A Similar French Incident in October
The reported November disruptions followed a separate wave in France on the night of Oct. 11–12. French authorities and media reported attacks on supermarket refrigeration, with the Paris prosecutor’s office counting about 700 victims, according to the source material. France’s national cybersecurity agency, CERT-FR, warned on Oct. 12 that remote management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice. It said attack campaigns were probably still ongoing.
The Belgian installer Sabcobel described the November mechanism as the same as in France: evaporators were reportedly switched remotely into defrost mode. Finland’s National Cyber Security Centre said attacks in Finland and elsewhere targeted specific Danfoss models, according to Finnish news agency STT. These reports identify a suspected equipment and access pattern, but do not by themselves establish who carried out the attacks or whether every reported incident had the same cause.
Discussion of AI should be kept separate from evidence about this operation. Belgium’s cyber centre has warned generally about a rise in attacks partly involving AI, but the reporting supplied here does not say investigators found AI in use in the refrigeration incidents. A general warning is not evidence that AI was part of this specific campaign.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize
Attribution and AI Remain Unconfirmed
No attacker has been identified, and no group has claimed responsibility in the reporting provided. Belgium’s federal prosecutor has opened a criminal investigation; Belgium’s cyber centre has cautioned that identifying the perpetrator may not be possible. It is also unclear whether all incidents across the countries involved were carried out by the same actor or through identical access paths.
The affected-store totals and damage estimates remain provisional and differ between reports. Accounts list different country coverage and store counts, while reported temperatures varied by site. The full amount of spoiled food, the duration of disruption, and whether additional businesses were affected have not been confirmed. AI involvement has not been established; the source material provides no case-specific forensic finding or official statement saying AI was used.
Investigations and Security Checks Continue
Belgium’s criminal investigation is open, and affected retailers and equipment operators will need to establish which controllers were accessed, how settings were changed and whether systems are secure before returning them to normal operation. The supplied reporting does not give a timetable for investigative findings or describe a single coordinated response across all affected countries.
Businesses using remote refrigeration controls may review whether management interfaces are exposed online and whether independently operated sites receive the same security oversight as centrally managed stores. That is a precaution suggested by the reported access pattern, not a finding that every affected system had the same configuration. Further confirmed counts, damage assessments and technical findings could clarify whether this was a coordinated repeat of the French wave and how broadly the same equipment or access method was involved.
Key Questions
What happened to the supermarket refrigeration systems?
Reports say refrigeration controllers at stores in several European countries were accessed remotely and switched into defrost or heating modes, disrupting normal cooling.
How many stores were affected?
BleepingComputer reported more than 115 stores in at least six countries, with additional reports of anomalies at a few smaller Finnish stores. Counts vary by outlet and remain provisional.
Was AI used in the attacks?
That has not been established. The reporting says Belgian authorities have warned generally about attacks partly involving AI, but it provides no evidence that AI was used in these incidents.
Who was behind the disruptions?
No perpetrator has been identified in the supplied reporting, and no group has claimed responsibility. Belgium’s federal prosecutor has opened an investigation.
Why were smaller or independent stores mentioned?
Some retailers said affected stores operated outside central networks or used independently managed refrigeration systems. The reports do not show that this was true of every affected site or the sole reason for the incidents.
Source: ThorstenMeyerAI.com
