🔍 Read the full analysis: AI’s Potential Role In Attacks On European Supermarket Freezers on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Reports say more than 115 supermarkets and other businesses in at least six European countries experienced refrigeration disruptions overnight on Nov. 1–2, 2026. The reported method matches a French incident in October: remotely changing settings on internet-accessible refrigeration controllers. No attacker has been identified, and there is no evidence that AI was used.
Refrigeration systems at more than 115 stores and other businesses in at least six European countries were reportedly disrupted overnight on Nov. 1–2, after attackers remotely changed settings on controllers connected to the internet. The incident follows a similar wave in France in October; authorities have not identified who was responsible, and no evidence has been reported that AI was used.
Retailers and media outlets reported affected businesses in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish authorities and retailer Kesko also reported temperature problems at a few smaller Finnish stores. The counts vary between reports and are still being compiled. BleepingComputer put the total at more than 115 businesses, while The Record reported more than 50 affected stores in Belgium alone.
The reported disruption involved refrigeration units being switched into defrost or heating modes. Belgian installer Sabcobel chief executive Stephan Moelans told Belgian outlets that the mechanism was the same as in the French incidents earlier in October. He said technicians began disconnecting installations at about 1 a.m. and that roughly 20 of the several hundred installations his company manages in Belgium were affected. He also said Sabcobel itself had not been hacked; the controllers at stores were accessed directly over the internet.
The effects differed by location. A Proxy Delhaize store in Hoepertingen reported freezers at 15 °C and estimated that at least €60,000 worth of food had to be discarded, according to local reporting cited by VRT NWS. In Sweden, ICA manager Rickard Nilsson told TV4 that staff could not adjust temperatures and that heat was entering freezers. Some businesses shut systems down in time to limit losses; others reported spoiled stock.
Cross-border incident brief · Europe · Nov. 1–2, 2026
AI’s Potential Role in Attacks on European Supermarket Freezers
More than 115 businesses reportedly faced refrigeration disruptions after internet-accessible controllers were switched into defrost or heating modes. The reported method echoes incidents in France. Responsibility remains unknown, and no evidence shows AI was used.
A control-system disruption
Reports describe remotely changed settings on network-connected refrigeration controllers. Some units entered defrost or heating modes, disrupting normal temperature control.
Internet-reachable controllers
Some store systems could be accessed remotely.
Settings changed
Reports say units were switched to defrost or heating modes.
Temperatures rose
Staff reported heat entering freezers and difficulty adjusting settings.
Checks and losses
Some sites shut systems down; others reported spoiled stock.
Freezer trouble can become food loss
Building-control equipment can affect everyday operations even when checkout systems and customer-facing websites remain available.
Sales interrupted
Businesses may need to close sections, suspend sales or shut equipment down while systems are checked and restored.
Losses vary by site
A Proxy Delhaize store in Hoepertingen reported freezers at 15 °C and estimated at least €60,000 in food losses, according to local reporting cited by VRT NWS.
Separate systems matter
Reports point to some independently operated sites and older or separately managed equipment that may be harder to monitor consistently.
This is a site-specific estimate, not a measure of losses across all affected businesses. Overall food losses remain unclear.
Risk discussion is not proof of use
AI appears in broader cyber-risk warnings, but the available reporting does not connect AI tools to finding, accessing or changing these controllers.
| Question | What reports say | Evidence status |
|---|---|---|
| Were refrigeration settings changed remotely? | Yes. Reports describe internet-accessible controllers switched into defrost or heating modes. | Reported method |
| Has an attacker been identified? | No responsible party has publicly claimed the attacks or been attributed them. | Unknown |
| Was AI used in the incidents? | No evidence has been reported linking AI tools to the incidents. | Unconfirmed |
| Are the French and November events linked? | Reports describe a similar method, but do not establish a shared operator or campaign. | Unresolved |
A reported pattern, still under investigation
The latest reports follow a French wave in October. Similarities in the described method do not establish who was responsible or whether the incidents are connected.
Earlier refrigeration incidents
Systems at hundreds of supermarkets were reportedly altered. The Paris prosecutor’s office counted about 700 victims, according to the source material.
Exposed interfaces flagged
France’s CERT-FR warned that remote management interfaces were exposed online in ways that did not follow security best practice. It said campaigns were “probably still ongoing.”
New disruption reported
Belgium’s federal prosecutor opened an investigation. Belgium’s cyber centre said the attacker may never be identified.
Counts and conditions differ
Reports do not use a single agreed count or consistently distinguish supermarkets from smaller shops and other businesses.
More than one count
BleepingComputer put the total above 115 businesses. The Record reported more than 50 affected stores in Belgium alone. Finland also reported temperature problems at a few smaller stores.
Site-specific temperatures
Reports cited different measurements, including 15 °C at Hoepertingen and 50 °C at some locations. These are reported local readings, not one confirmed temperature across all sites.
No public attribution
Authorities have not identified the responsible party. Similarity in method alone does not prove that the French and November incidents share an operator.
Technical details pending
Public reporting has not established how each controller was reached, which weaknesses were exploited or whether every reported case is connected.
Investigations and site checks continue
Authorities and retailers are working to establish which systems were affected and how access occurred. No common repair timetable or public findings deadline has been reported.
Reconcile the count
Confirm impacted sites and distinguish supermarkets from smaller shops and other businesses.
Review access and records
Inspect controllers and temperature logs before returning affected equipment to normal operation.
Await investigation findings
Determine how controllers were reached and whether the French and November incidents are connected.
The clearest answers so far
More than 115 reported
Reports cite businesses in at least six countries, plus a few smaller Finnish stores. Counts vary and are not yet reconciled.
Settings were reportedly altered
Internet-reachable controllers were described as switched into defrost or heating modes. The access route at each site remains unclear.
Not confirmed
General warnings discuss AI and cyber risk, but available reporting provides no evidence that AI was used in these incidents.
Food Losses and Exposed Store Systems
The reported incidents show how an attack on building-control equipment can affect ordinary business operations without disrupting a retailer’s checkout or customer-facing website. If freezer temperatures rise, stores may need to discard food, close sections or suspend sales while equipment is checked and restored. The reported €60,000 loss at one Belgian store illustrates the potential cost, but it should not be treated as an estimate for every affected business.
The pattern described by retailers points to a particular exposure: some affected locations were independently operated, outside a chain’s central network, or using older, separately managed refrigeration equipment. That can make it harder for a group to monitor and secure every site in the same way. The incident is relevant beyond supermarkets because refrigeration and other building systems are increasingly managed through network-connected controllers.
AI is part of the wider discussion around cyber threats, but its role in this event is not established. Belgium’s cyber centre has warned generally about attacks that may involve AI; that warning does not show that AI was used to find, access or alter the controllers in this case. Reporting the distinction matters: the confirmed concern is remote access to refrigeration systems, not a proven AI-assisted attack.
Products Worth Considering
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Incident in October
The overnight reports follow incidents in France on Oct. 11–12, when refrigeration systems at hundreds of supermarkets were reportedly altered. France’s CERT-FR warned on Oct. 12 that remote management interfaces for refrigeration controllers were exposed online in ways that did not follow security best practice. It said attack campaigns were “probably still ongoing.” The Paris prosecutor’s office has counted about 700 victims in the French case, according to the source material.
Belgium’s federal prosecutor has opened a criminal investigation into the latest incidents. The Belgian cyber centre has said the attacker may never be identified. Reports say the French and newer incidents share a method, but public information does not establish who carried out either wave or whether they were directed by the same person or group.
Retailers’ reports also suggest that centrally managed locations were not affected in the same way as some independently operated outlets. Colruyt said its own stores were not hit, while about five Spar stores run by independent entrepreneurs were reported affected. ICA in Sweden said affected sites operated outside its central network; Coop reported seven affected stores out of more than 800.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Attribution and AI Use Remain Unknown
The number of affected businesses is not settled. Reports use different totals, count different types of locations and do not always distinguish supermarkets from smaller shops or other businesses. Temperature readings also varied: reports cited 50 °C in some locations, 15 °C at the Hoepertingen store and other readings elsewhere. These figures are reported site-specific measurements, not a single confirmed temperature across the affected network.
No responsible party has claimed the attacks, and authorities have not publicly attributed them. The reported similarity to the French incidents concerns the method; it does not prove a shared perpetrator. It is also not yet clear how each controller was accessed, which security weaknesses were exploited, or whether every reported case is connected to the same campaign.
There is no reported confirmation that AI played a part. The source material cites broad warnings about AI and cybercrime, but offers no evidence linking AI tools to these incidents. The scale of food loss across all affected businesses and the final number of disrupted sites also remain unclear.
Investigations and Site Checks Continue
Belgium’s federal prosecutor is investigating, and national cyber authorities and retailers are working to establish which systems were affected. The next useful updates would include a verified count of impacted sites, findings about how the controllers were reached, and confirmation of whether the French and November incidents are linked.
Businesses affected by the disruption will need to check equipment and temperature records before returning systems to normal operation. The source material does not give a common timetable for repairs or a public deadline for investigators’ findings. Until authorities release more detail, the confirmed picture remains a reported cross-border disruption, a similar earlier French wave and unresolved questions about attribution and access.
Key Questions
How many businesses were affected?
Reports put the total at more than 115 businesses in at least six countries, with additional reports of problems at a few stores in Finland. Counts vary by outlet and are not yet reconciled.
What happened to the refrigeration systems?
Reports say attackers remotely changed settings on internet-reachable controllers, causing some units to enter defrost or heating modes. The exact access route for each site has not been publicly established.
Was AI used in the attacks?
That has not been confirmed. Authorities have issued general warnings about AI-related cyber risks, but the available reporting does not show that AI was involved in these incidents.
Has anyone been identified as responsible?
No. There has been no public claim of responsibility or attribution. Belgium’s federal prosecutor has opened an investigation, and the country’s cyber centre has said identifying the attacker may not be possible.
Is this connected to the October attacks in France?
Belgian installer Sabcobel said the reported mechanism was the same as in France, where refrigeration systems were affected on Oct. 11–12. That similarity does not establish that the same actor carried out both waves.
Source: ThorstenMeyerAI.com
