🔍 Read the full analysis: AI And The Future Of Supermarket Refrigeration Security on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Refrigeration systems at more than 115 supermarkets and other shops across at least six European countries were reportedly disrupted overnight on Nov. 1–2, 2026. The reported method resembles attacks in France in October, but no perpetrator has been identified and there is no evidence that AI was used.
More than 115 stores in at least six European countries reported disrupted supermarket refrigeration overnight on Nov. 1–2, as attackers reportedly changed settings on internet-connected cooling controllers. The incidents affected stores in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, with Finnish authorities and retailer Kesko also reporting problems; investigators have not identified who was responsible or established whether artificial intelligence played any role.
In Belgium, refrigeration installer Sabcobel said technicians began disconnecting affected installations at about 1 a.m. Chief executive Stephan Moelans told Belgian media that the company itself had not been hacked and that attackers had reached controllers in stores directly over the internet. He told The Record that about 20 of the several hundred installations Sabcobel manages in Belgium were affected.
Retailers reported incidents at both chain stores and smaller independently run businesses. Ahold Delhaize said an IT incident affected refrigeration at several dozen stores; BleepingComputer put the figure at about 40 in Belgium and Luxembourg. Carrefour Belgium said 15 of its 700 stores were affected, while Colruyt reported problems at about five Spar stores operated by independent entrepreneurs with their own refrigeration systems. In Sweden, ICA reported at least four affected stores outside its central network, and Coop said seven of its more than 800 stores were affected.
Other reports included 13 SuperValu stores in Ireland, one Selver store in Estonia, about 15 Intermarché outlets and one IKEA store in Belgium. A Danfoss spokesperson told Dutch broadcaster NOS that systems at at least 17 businesses in the Netherlands had been affected, mostly butchers and neighbourhood shops. Finnish authorities and Kesko also reported temperature anomalies at a few smaller stores. Counts vary between reports, so the precise total and geographic scope remain unsettled.
Security briefing · Europe · Nov. 2026
AI And The Future Of Supermarket Refrigeration Security
A reported cross-border disruption changed cooling settings at supermarkets and small shops. The incident puts connected building systems in focus—but investigators have not identified a perpetrator, and there is no evidence AI was used.
01 / Incident map
A multi-country refrigeration disruption
Reports described affected stores in at least six countries, with Finnish authorities and retailer Kesko also noting problems. Counts vary because sources refer to stores, businesses or installations.
What the counts show
Retailer and media reports named chain stores as well as independently operated shops. Examples included about 40 Ahold Delhaize stores in Belgium and Luxembourg, 15 Carrefour Belgium stores, seven Coop stores in Sweden and 13 SuperValu stores in Ireland. These figures are reported counts, not a reconciled final total.
02 / Exposure pattern
Why independent sites matter
Some affected locations reportedly operated outside a retailer’s central network or used their own refrigeration equipment. That can make consistent monitoring and protection harder to coordinate across many small sites.
Internet-reachable equipment
Installers said attackers reached store controllers directly over the internet. Exposed management interfaces can create a route to equipment settings.
Different levels of oversight
Some stores sat outside central networks or relied on independently managed systems. The reporting does not show that every affected controller was outdated.
Temperature changes can cost
At one Proxy Delhaize, freezers reportedly reached 15°C instead of about −22°C, with at least €60,000 in discarded food estimated by the store.
03 / Reported store counts
Selected figures from retailers and reports
These examples illustrate the reported scale. They use different sources and counting units, so they should not be added as a definitive incident total.
* BleepingComputer’s reported figure for Belgium and Luxembourg. ** At least 17 businesses in the Netherlands, mostly butchers and neighbourhood shops. Other reports named Coop, ICA, Selver, Intermarché, IKEA and smaller Finnish stores.
04 / How disruption can unfold
A short path from access to food loss
The following chain summarizes the reported mechanism and possible operational consequences. It does not establish every technical step used in each affected store.
Reach a controller
An exposed remote-management interface may provide access to refrigeration controls.
Change settings
Reports say evaporators were remotely switched into defrost mode.
Temperatures shift
Cooling can be disrupted; reported temperatures varied by location.
Assess stock
Stores check product safety, equipment status and potential losses.
05 / Context & evidence
Similar to France—without a confirmed link
The reported method resembles refrigeration disruptions in France on Oct. 11–12, when authorities warned about exposed remote-management interfaces. Similarity alone does not establish a shared attacker or operation.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
Ahold Delhaize“Currently 15 of our 700 stores are affected, both in Flanders and Wallonia.”
Carrefour Belgium06 / What remains unknown
Evidence gaps shape the story
Belgium’s federal prosecutor opened a criminal investigation. The reported scope and technical details may change as authorities and businesses verify affected sites.
Who was responsible?
No perpetrator has been identified, and the reporting provided contains no claim of responsibility.
How many sites were affected?
Reports say more than 115 stores or businesses across at least six countries, with Finland also reporting problems. The final count is unsettled.
Was AI involved?
There is no evidence in the cited reporting that AI played a role in discovery, access or control changes.
Were the French incidents connected?
The reported mechanism is similar, but investigators have not established whether the same actor was involved.
07 / Operator response
Practical priorities for refrigeration security
The reporting points to remote access and exposed management interfaces as areas for operators to review while investigations continue.
Review internet exposure
Check whether refrigeration controllers are reachable online and limit remote access to approved, protected paths.
Confirm updates and safeguards
Review available manufacturer updates and remote-management settings. Reporting does not establish which sites installed updates.
Verify equipment and stock
Coordinate safe temperature checks, product assessment and return to normal operation with qualified service providers.
Why Independent Stores Were Exposed
The incidents show how building systems can create cybersecurity risks beyond office computers and payment networks. Refrigeration controllers that are reachable from the internet may let an intruder alter equipment settings, with potential consequences for food safety, stock and business operations. The reported impact differed by site: some shops caught the change in time, while others said they had to discard food.
At the Proxy Delhaize in Hoepertingen, freezers reportedly reached 15°C rather than about –22°C, and the store estimated losses of at least €60,000 in discarded food, according to Het Belang van Limburg as cited by VRT NWS. A butcher in Hove said it threw away hundreds of kilos of food. These are reported individual losses, not a confirmed estimate for the overall incident.
Several affected retailers said stores were outside their central networks or used their own refrigeration equipment. That pattern suggests that smaller or independently operated sites may not receive the same centralized monitoring and safeguards as larger chain locations. It does not establish that every affected system was outdated or that all independent stores are vulnerable.
Products Worth Considering
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Samsung 27 Odyssey OLED G5 (G50SF) QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Incident in October
The reported method resembles a wave of refrigeration disruptions in France on the night of Oct. 11–12. French authorities issued warnings, and the Paris prosecutor’s office counted about 700 victims, according to the source material. Belgium’s installer Sabcobel described the latest incident as using the same mechanism: evaporators were reportedly switched into defrost mode remotely.
France’s national cybersecurity agency, CERT-FR, warned on Oct. 12 that remote-management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice. It said attack campaigns were probably still ongoing. That warning is relevant to the reported access method, but it does not identify who carried out either wave or prove that the same people were involved.
Belgium’s cyber centre has discussed a general increase in attacks that partly involve AI. However, the source reporting provides no evidence that AI was used to find vulnerable controllers, access systems or change temperatures in these incidents. The attacks’ precise technical details and their connection, if any, to the French cases remain under investigation.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize
Who Changed the Cooling Settings
No perpetrator has been identified, and no group has claimed responsibility in the reporting provided. Belgium’s federal prosecutor has opened a criminal investigation. The Belgian cyber centre has said the attacker may never be identified.
The reported number of affected businesses is not final: sources give different totals and some count stores while others refer to businesses or installations. Temperatures also varied by location, with reports including 50°C in Eeklo and Sweden, and 15°C in Hoepertingen. The available information does not establish a complete list of sites, total food losses or the full duration of each disruption.
It is also unclear whether the French and latest incidents were carried out by the same actor. Although the reported method is similar, similarity alone does not prove a shared source. AI involvement is unconfirmed; no cited authority or retailer said AI was used in these attacks.
Investigations and Controller Security
Belgium’s federal prosecutor is investigating, while retailers and refrigeration service providers are responding to affected equipment. The source material does not give a timetable for investigators’ findings or a final count of affected sites. Further updates may clarify whether additional countries or businesses experienced disruptions.
For operators, the immediate issue is to check whether refrigeration controllers are exposed to the internet and whether remote access is appropriately protected. CERT-FR had warned about exposed management interfaces after the October incidents, and manufacturers had reportedly shipped updates months earlier. The available reporting does not specify which affected sites installed those updates or whether applying them would have prevented the latest incidents.
Retailers will also need to determine the condition of affected stock and whether equipment can be safely returned to normal operation. Until investigators publish more, the key facts remain the reported cross-border disruptions and the apparent remote alteration of cooling controls—not a confirmed identity, motive or AI-based method.
Key Questions
How many stores were affected?
Reports put the total at more than 115 stores or businesses across at least six countries, with Finland also reporting problems. The counts differ by source and may change as retailers and authorities confirm sites.
Which countries reported refrigeration problems?
Reports named Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish authorities and Kesko also reported anomalies at a few smaller stores.
Was artificial intelligence used in the attacks?
That has not been established. Belgian officials have referred to a broader rise in attacks partly involving AI, but no source cited in the reporting said AI was used in this incident.
Who was responsible?
No perpetrator has been identified, and no group has claimed responsibility in the available reporting. Belgium’s federal prosecutor has opened an investigation.
How did the refrigeration systems get disrupted?
Reports say attackers reached internet-connected refrigeration controllers and changed their settings, including switching evaporators into defrost mode. Investigators have not publicly established the full technical details or whether the same actor was behind the October attacks in France.
Source: ThorstenMeyerAI.com
