🔍 Read the full analysis: Are Supermarket Refrigeration Attacks Becoming An AI Concern? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Retailers and news organizations reported refrigeration disruptions at more than 115 stores across at least six European countries overnight on November 1–2, 2026; Finnish reports also described problems at a few smaller stores. Belgian installer Sabcobel said the method matched an earlier French incident, but the attacker has not been identified. No source in the reports says AI was used.
Refrigeration systems at more than 115 European stores were reportedly disrupted overnight on November 1–2 after attackers accessed controllers and changed operating settings, according to BleepingComputer and retailer and broadcaster reports. The incidents affected at least six countries, with separate reports of problems at a few smaller Finnish stores; no evidence cited so far establishes that AI was used, and the attacker has not been identified.
In Belgium, installer Sabcobel chief executive Stephan Moelans told Belgian media that technicians began disconnecting affected installations from about 1 a.m. He said the company itself was not hacked and that attackers accessed internet-reachable refrigeration controllers at stores. Sabcobel said the equipment had been switched into defrost mode, matching the mechanism reported in France in October. It manages several hundred installations in Belgium, about 20 of which Moelans said were affected.
Retailer figures vary. Ahold Delhaize described an IT incident affecting refrigeration systems in several dozen stores; BleepingComputer put its reported total at about 40 across Belgium and Luxembourg. Carrefour Belgium said 15 of its 700 stores were affected, involving a limited number of units, mainly freezers. Colruyt said about five independently operated Spar stores were affected, while its own stores were not. In Sweden, ICA reported at least four affected stores outside its central network, and Coop said seven of its more than 800 stores had varying levels of disruption.
Reports also identified affected businesses in Ireland, Estonia, the Netherlands and Finland. They include 13 SuperValu stores in Ireland, one Selver store in Estonia, and at least 17 Dutch businesses, mostly butchers and neighborhood shops, according to a Danfoss spokesperson cited by NOS. Finnish authorities and Kesko reported temperature anomalies at a few smaller stores. Individual losses also varied: a Belgian shop reported freezers reaching 15 °C and estimated food losses of at least €60,000, while other stores reported food being discarded or systems being shut down in time.
Risks to Food and Store Operations
The incident shows how a digital intrusion into building and refrigeration equipment can disrupt ordinary retail operations, even without a reported break-in to a store. If refrigeration fails or warms, businesses may have to discard perishable goods, close units, or pay for repairs and replacement stock. The reported losses at some locations indicate a direct cost, though a reliable total for all affected stores has not been published.
The reported pattern also points to a potential security gap: some affected shops were outside their chains’ central networks or used independently managed equipment. That does not establish that every independently run store is vulnerable, nor does it explain how each controller was reached. It does make the incident relevant to operators of internet-connected building systems, including companies whose refrigeration is managed by outside suppliers.
The AI angle remains a question, not a finding. Belgium’s cyber centre has warned more generally about attacks that may involve AI, but that broad warning is not evidence that an AI system found or accessed these controllers. The reports describe remote access and altered settings; they do not identify the tools or methods used by the intruder.
Products Worth Considering
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The October French Refrigeration Wave
The reported November incidents came less than three weeks after a similar event in France on the night of October 11–12. The Paris prosecutor’s office counted about 700 victims in that case, according to the source material. France’s national cybersecurity agency, CERT-FR, warned on October 12 that remote management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice. It said attack campaigns were probably still ongoing.
Sabcobel said the Belgian mechanism was “exactly the same” as in France: refrigeration equipment was remotely switched into defrost. That is a company’s assessment of the method, not proof that the same person or group carried out both waves. The reports describe a range of affected temperatures and different outcomes, from systems being stopped in time to freezers warming and food being discarded.
Reported totals should be treated as provisional. BleepingComputer counted more than 115 stores across six countries, while other outlets gave different country and retailer totals. Some lists include smaller businesses and independently run outlets, and Finnish reports add a few stores. The figures do not reconcile into one verified count in the available material.
““exactly the same””
— Stephan Moelans, chief executive of Sabcobel, as reported by Belgian media
Attribution and AI Evidence
No perpetrator has been named, and the source material reports no claim of responsibility. Belgium’s federal prosecutor has opened a criminal investigation; Belgium’s cyber centre has cautioned that the attacker may never be identified. It is also not clear whether the October French wave and the November incidents were conducted by the same person or group.
There is no confirmed evidence in the cited reporting that AI was involved. A general warning from Belgium’s cyber centre about attacks partly involving AI cannot be applied to this case without incident-specific evidence. The reports do not say whether attackers used automated tools, AI-generated content, or any other AI system.
The final number of affected sites, the full financial losses, and the extent of any food-safety consequences remain unclear. Reported store counts differ by outlet, and some figures refer to businesses rather than supermarket branches. The exact route used to reach each controller, and whether all affected systems had the same exposure, has not been established publicly.
Investigations and Controller Security
Belgium’s criminal investigation and responses from retailers and cybersecurity authorities may clarify how the controllers were accessed, how many sites were affected, and whether the incidents are connected to the French case. Retailers are also likely to review access to refrigeration systems and their arrangements for equipment outside central corporate networks, though the source material does not announce a shared remediation plan or deadline.
France’s CERT-FR had already warned about exposed remote-management interfaces after the October incident. Manufacturers had reportedly issued updates months earlier, but the available reporting does not establish which affected stores installed them or whether those updates would have prevented the November events. Further verified counts and technical findings are needed before the scale, cause, and any role for AI can be stated with confidence.
Key Questions
What happened to the supermarket refrigeration systems?
Reports say attackers remotely changed settings on refrigeration controllers, including switching equipment into defrost mode. Some units warmed or stopped working, while some shops shut systems down or discarded food.
How many stores were affected?
BleepingComputer reported more than 115 stores across at least six countries. Other outlets gave different totals, and Finnish authorities and Kesko separately reported problems at a few smaller stores. The overall count remains provisional.
Is there evidence that AI was used?
No incident-specific evidence cited in the reports confirms AI use. Belgium’s cyber centre has issued broader warnings about attacks partly involving AI, but it has not been reported as saying AI was used in these refrigeration incidents.
Who carried out the attacks?
The attacker has not been identified, and no claim of responsibility has been reported. Belgium’s federal prosecutor has opened an investigation; it is also unknown whether the November incidents were linked to the October attack wave in France.
Why were smaller or independent stores affected?
Some retailers said affected locations operated outside central networks or used their own refrigeration equipment. The reports do not establish that this applied to every affected store or explain the access route used at each site.
Source: ThorstenMeyerAI.com
