🔍 Read the full analysis: The Overlap Between AI And Attacks On European Supermarket Freezers on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Retailers and news outlets reported overnight disruptions to supermarket refrigeration systems across Europe on November 1–2, with more than 115 stores cited in at least six countries. The reported method resembles an October attack in France, but authorities have not identified who was responsible, and there is no confirmed evidence that AI was used.
Refrigeration systems at more than 115 stores in at least six European countries were reportedly disrupted overnight on November 1–2 after controllers were switched into defrost or heating modes. Retailers and media reports describe the incident as a cyberattack resembling a French supermarket refrigeration incident in October, but no attacker has been identified and any role for AI remains unconfirmed.
Reports from Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia described affected businesses; Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller stores. The precise total is unsettled: reports use different counts and coverage, and some describe individual shops while others group multiple sites. The figures should be treated as reported counts, not a final tally.
In Belgium, refrigeration installer Sabcobel chief executive Stephan Moelans told Belgian media that technicians began disconnecting affected installations at about 1 a.m. He said roughly 20 of the several hundred installations his company manages in Belgium were affected and that Sabcobel itself had not been hacked. According to The Record, he described internet-reachable controllers at stores as the direct target.
Retailers reported losses and service disruption. A Proxy Delhaize store in Hoepertingen said its freezers reached 15 °C and estimated that at least €60,000 of food had to be discarded, according to regional newspaper Het Belang van Limburg as cited by VRT NWS. Carrefour Belgium said 15 of its 700 stores were affected, while Coop Sweden reported problems at seven of its more than 800 stores. Those accounts describe impacts at particular businesses; they do not establish the total financial cost across Europe.
Retail systems · Incident brief · November 2026
The Overlap Between AI and Attacks on European Supermarket Freezers
Reports describe a multi-country refrigeration disruption after controllers were switched into defrost or heating modes. The reported method resembles an October incident in France. Investigators have not identified a perpetrator, and there is no confirmed evidence that AI was used.
Reports cite stores in at least six European countries; counts vary by source and remain unsettled.
No cited authority or company has said AI played a role in this incident.
01 / What was reported
A control-system problem with real-world consequences
Retailers and media reported refrigeration controls switched remotely into defrost or heating modes, affecting cold rooms, refrigerators, and freezers.
Internet-reachable controllers
Belgian installer Sabcobel said exposed, internet-reachable controllers at stores were directly targeted. The reports do not establish how each individual system was accessed.
Cooling interrupted
Some installations were disconnected as technicians responded. Refrigeration failures can rapidly affect stored food and interrupt store operations.
Counts are provisional
Reports count individual shops and grouped locations differently. The cited figures describe reported cases, not a final European tally.
02 / Reported sequence
From controller change to store disruption
Reported accounts point to a technical change that became a food-storage and recovery challenge. The detailed access path remains under investigation.
Controller reached
Reports describe refrigeration controls that could be reached over the internet.
Mode changed
Units were reportedly switched to defrost or heating modes.
Cold chain affected
Freezers warmed, temperatures varied, and food losses were reported at some sites.
Isolate and investigate
Technicians disconnected equipment while retailers and authorities assessed the incidents.
03 / Store-level snapshot
Some local impacts are known; the full cost is not
Company and local reporting gives a partial picture of affected sites. These examples do not establish the total number of stores or Europe-wide financial damage.
04 / October comparison
A similar reported mechanism in France
The November reports follow a French wave on the night of October 11–12. Similarity of method does not establish shared operators, infrastructure, or access route.
| Question | France · October 11–12 | Europe · November 1–2 |
|---|---|---|
| What was reported? | Remote management interfaces for refrigeration controllers were exposed online, according to CERT-FR. | Controllers were reportedly switched into defrost or heating modes at stores across several countries. |
| Scale cited | Paris prosecutor’s office counted about 700 victims. | More than 115 stores in at least six countries were cited; totals vary across reports. |
| Method link | CERT-FR warned campaigns were “probably still ongoing.” | Sabcobel described the mechanism as “exactly the same.” |
| What remains unknown? | Those details do not identify who carried out the activity. | Shared method does not prove the same person or group was responsible. |
05 / Attribution & AI
What is known—and what is not
Separate confirmed reporting from open questions while criminal and technical investigations continue.
06 / Investigation & next steps
Authorities are still establishing the record
Belgium’s federal prosecutor has opened a criminal investigation. Retailers and refrigeration specialists are restoring or isolating equipment and assessing stock losses.
Attribution is open
No person or group has been identified in the available reporting, and no one has claimed responsibility.
Site-by-site response
Retailers have not provided a common timetable for full recovery or a consolidated estimate of damage.
Confirmed counts and findings
Company tallies and national cyber authority or police findings may clarify scale, access paths, and whether events were connected.
07 / Key questions
Quick answers
How many stores were affected?
Reports cited more than 115 stores across at least six countries. Finnish authorities and Kesko also reported anomalies at a few smaller stores. The total remains unsettled.
Was this confirmed as a cyberattack?
Carrefour Belgium called its incident a cyberattack, and multiple reports describe controllers remotely switched into defrost or heating modes. A full technical account has not been published.
Did AI carry out the attacks?
There is no confirmed evidence that AI was used. No cited source attributes these incidents to AI.
Who is responsible?
No person or group has been identified, and no one has claimed responsibility. Belgium’s federal prosecutor is investigating.
How does this relate to France?
The reported mechanism resembles the October French incidents, according to Sabcobel. That comparison does not prove the same operator or entry point.
Were food supplies widely affected?
Some stores reported losses and disruption. Available reports do not establish widespread shortages or a lasting impact on food supply.
Food Losses and Store Disruption
Refrigeration failures can quickly turn an intrusion into a direct operational and food-waste problem. Retailers reported damaged stock, technicians disconnecting equipment and some stores dealing with refrigerators or freezers that stopped working or began producing heat. The reported Hoepertingen loss illustrates the possible cost at a single location, but a Europe-wide damage assessment has not been published.
The incident also draws attention to building systems connected to the internet, not just corporate office networks or payment systems. A controller used to manage cold rooms can affect food storage even when a retailer’s central IT network is not reported compromised. Stores operating outside a chain’s centrally managed network may face different safeguards and response arrangements.
For customers, the immediate effects may include discarded food or temporary disruption at specific locations. The available reports do not establish widespread shortages or a lasting impact on food supply. The broader concern is whether exposed or older equipment can be secured and monitored consistently across independently run shops and large retail groups.
Products Worth Considering
Samsung 49-inch Odyssey OLED G9 (G91SD) Dual QHD Curved Gaming Monitor
Samsung 32-inch Odyssey OLED G8 (G80SH) 4K QD-OLED Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Incident in October
The reported November event follows a wave in France on the night of October 11–12. France’s national cybersecurity agency, CERT-FR, warned on October 12 that remote management interfaces for refrigeration controllers were exposed online contrary to good practice. The agency said attack campaigns were “probably still ongoing.” The Paris prosecutor’s office counted about 700 victims in the French incident, according to the source material.
Belgian installer Sabcobel said the later incidents used “exactly the same” mechanism as the French wave: evaporators were reportedly switched remotely into defrost mode. That comparison is attributed to the installer and does not, by itself, prove that the same person or group carried out both events. Finnish reporting also said particular Danfoss controller models were targeted, citing the country’s National Cyber Security Centre through news agency STT.
The reported weakness was internet exposure of refrigeration controls. The source material says manufacturers had shipped updates months earlier, but it does not establish which affected stores installed them, whether those updates addressed every relevant vulnerability, or how each controller was accessed. That distinction matters: a reported shared method is not the same as a confirmed shared entry point or perpetrator.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Who Accessed the Controllers?
No attribution has been announced, and the source material reports no claim of responsibility. Belgium’s federal prosecutor has opened a criminal investigation. Belgium’s cyber centre has warned that the attacker may never be identified.
Whether artificial intelligence was used is also unknown. Belgium’s cyber centre has warned more generally of a rise in cyberattacks partly involving AI, but no cited authority or company has said AI played a role in this refrigeration incident. The existence of AI-related cyber risks is not evidence that AI was used here.
Counts and damage remain incomplete. Reports differ on the number of affected shops, including the tally for Belgium, and temperature readings varied by location. It is also not clear from the available information how attackers reached each system, whether every affected controller was exposed in the same way, or whether the events across countries were coordinated.
Investigations and Store Repairs
Belgium’s federal prosecutor is investigating, while retailers and refrigeration specialists are working to restore or isolate affected equipment and assess stock losses. Further official findings may clarify how the controllers were accessed, whether the incidents share infrastructure or operators, and how many stores were affected in total.
Retailers have not provided a common timetable for full recovery or a consolidated damage estimate. The next useful updates will be confirmed counts from affected companies and findings from national cyber authorities and police. Until then, the available record supports a reported multi-country disruption and a resemblance to the October French incidents, but not a conclusion about who was behind it or whether AI was involved.
Key Questions
How many stores were affected?
Reports cited more than 115 stores across at least six countries, with additional reports of anomalies at a few smaller Finnish stores. The total is not settled because outlets and news organizations have published differing counts.
Was this confirmed to be a cyberattack?
Carrefour Belgium called its incident a cyberattack, and reports from several countries describe refrigeration controllers being remotely switched into defrost or heating modes. Investigations are ongoing, and the full technical account of how each system was accessed has not been published.
Did AI carry out the attacks?
There is no confirmed evidence that AI was used. Belgium’s cyber centre has discussed AI in warnings about cyber threats generally, but no cited source attributes these incidents to AI.
Who is responsible?
No person or group has been identified in the source material, and no one has claimed responsibility. Belgium’s federal prosecutor has opened a criminal investigation.
How does this relate to the incident in France?
The November reports describe a method that Sabcobel called “exactly the same” as the October incidents in France, where refrigeration controls were reportedly switched into defrost mode. That reported similarity does not confirm that the same attackers were involved.
Source: ThorstenMeyerAI.com
