🔍 Read the full analysis: AI In Focus: Europe’s Supermarket Refrigeration Under Attack on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Retailers and authorities reported refrigeration disruptions at more than 115 stores across at least six European countries overnight on November 1–2, 2026; Finnish reports add a few smaller stores. The method appears to match an October attack in France, but the attackers’ identity and any role for AI remain unknown.
Refrigeration systems at more than 115 stores across at least six European countries were disrupted overnight on November 1–2, after attackers apparently accessed internet-reachable controllers and changed cooling settings, according to retailers, broadcasters and cybersecurity reporting. The incidents resemble a wave of attacks in France in October, but no attacker has been identified and there is no confirmed evidence that artificial intelligence was used.
Reports describe affected businesses in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish authorities and retailer Kesko also reported temperature irregularities at a few smaller stores. The counts vary by source and are not a verified final total. In Belgium, retailer and media accounts include affected Delhaize, Carrefour, Intermarché and Spar locations, as well as an IKEA store in Mons. Carrefour said 15 of its 700 Belgian stores were affected; Ahold Delhaize reported an IT incident involving refrigeration at several dozen stores.
The reported changes included freezers switched into defrost or heating modes. VRT NWS reported that a Delhaize store in Eeklo recorded freezer settings of 50 °C; a store in Hoepertingen reported freezers at 15 °C rather than the usual minus 22 °C. The latter estimated that at least €60,000 of food had to be discarded, according to local reporting cited by VRT. Other stores reported losses, but a complete, independently verified damage estimate is not available.
Sabcobel chief executive Stephan Moelans told Belgian media that technicians began disconnecting affected installations at about 1 a.m. He said roughly 20 of the several hundred installations his company manages in Belgium were affected. Sabcobel said the company itself was not hacked: the store controllers were directly reachable online. The Belgian installer described the mechanism as the same as in France, where the Paris prosecutor’s office has counted about 700 victims of the October 11–12 incident.
AI IN FOCUS · INCIDENT BRIEF · NOVEMBER 2026
Europe’s Supermarket Refrigeration Under Attack
Retailers and authorities reported disrupted refrigeration at more than 115 stores across at least six European countries overnight on November 1–2. The method appears to echo an October attack in France. Who was behind it—and whether AI played any role—remains unknown.
01 / INCIDENT AT A GLANCE
A cross-border disruption
Reports describe overnight incidents across several markets. Published totals use different snapshots and definitions, so they do not yet form a verified final count.
02 / WHAT HAPPENED
From controller access to store disruption
Reporting indicates that refrigeration controllers were reachable online and that cooling settings were changed. Details and impact varied from store to store.
Controllers exposed
Some refrigeration controls were reportedly reachable over the internet.
Settings changed
Units were reportedly switched into defrost or heating modes.
Temperatures rose
Freezers at some sites warmed far above normal operating levels.
Checks and losses
Stores assessed equipment and food inventory while restoring safe operation.
03 / REPORTED IMPACT
Local figures show the possible cost
Belgian reports provide specific examples, but no complete, independently verified estimate of damage across affected countries is available.
Selected Belgian reports
Read with care: These figures refer to separate reports and different measures. They are examples, not a Europe-wide damage total.
Temperature report
Up to 50 °C
VRT NWS reported freezer settings of 50 °C at a Delhaize store in Eeklo.
Food loss estimate
€60,000+
A Hoepertingen store estimated at least €60,000 in food had to be discarded, according to local reporting cited by VRT.
Belgian retailer
Several dozen
Ahold Delhaize reported an IT incident involving refrigeration at several dozen stores.
Store network
Separate systems
Some affected locations were independently operated or outside central corporate networks.
04 / FRANCE CONNECTION
A reported pattern, not a proven link
The November incidents follow a French wave on October 11–12. Similarities in reported methods offer context, but do not establish that every site shared an access route or attacker.
October 11–12 · France
Earlier incident
The Paris prosecutor’s office counted about 700 victims in the October refrigeration incident.
October 12 · CERT-FR
Exposure warning
France’s national cybersecurity agency warned that remote refrigeration management interfaces had been exposed online in ways that did not follow good practice.
November · Europe
Similarities reported
Belgian installer Sabcobel said the mechanism matched the French incidents. That claim does not independently connect every reported country or site.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
Ahold Delhaize
05 / ATTRIBUTION & AI
What remains unknown
Investigations are open, but public reporting has not established who carried out the incidents or whether the October and November events share an operator.
Attacker identity
Unattributed
No group has publicly claimed responsibility. Belgium’s federal prosecutor has opened a criminal investigation.
Artificial intelligence
Unconfirmed
There is no confirmed evidence that AI was used to access controllers, change settings, or coordinate the incidents.
Technical picture
Still developing
Entry routes, affected controller models, site totals and financial losses remain unclear and may differ by location.
Evidence boundary
A broader warning about attacks that partly involve AI does not show that AI was involved in these refrigeration incidents.
06 / QUESTIONS & NEXT STEPS
What to watch next
Retailers, technicians and authorities are checking affected installations and investigating the incidents. No shared Europe-wide remediation plan or final report has been announced in the available reporting.
How many stores were affected?
Published reports put the number above 115 across at least six countries. Finnish authorities and retailer Kesko also reported irregularities at a few smaller stores. Counts remain provisional.
What happened to the systems?
Reports describe remote changes to refrigeration controls, including switching units into defrost or heating modes. Some stores reported warmed freezers and food losses.
Who carried out the attacks?
No one has been publicly identified. Belgium’s federal prosecutor is investigating, and no group has claimed responsibility.
Was AI used?
There is no confirmed evidence of AI involvement. A general warning about AI-related attacks does not establish a role in these incidents.
Are the incidents linked to France?
Belgian installer Sabcobel said the mechanism matched the October incidents in France. A common actor or route across all countries has not been proven.
What happens now?
Retailers and technicians are restoring safe operation and checking controller access. Further agency, police and company statements may clarify the scale and technical links.
Figures and technical details reflect reported accounts from retailers, broadcasters, cybersecurity reporting and authorities. Reports differ by date, scope and definition; country totals and cross-border links should be treated as provisional.
Risks to Store Food and Operations
Refrigeration is a physical service controlled by networked equipment. When settings change unexpectedly, the consequences can move quickly from an information-technology incident to spoiled inventory, lost revenue and disrupted store operations. The reported €60,000 loss at one Belgian shop illustrates the potential cost, though it should not be treated as a measure of total damage across affected countries.
The pattern also points to uneven protection. Retailers said many affected outlets were independently operated, outside central networks or using separate refrigeration equipment. ICA said its affected Swedish stores were outside the company’s central network; Colruyt said its own stores were not affected while some independently operated Spar stores were. This does not establish why each system was vulnerable, but it highlights the challenge of protecting older or separately managed building systems alongside central corporate networks.
Products Worth Considering
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
Samsung 27-inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From France to Multiple Markets
The reported November incidents follow a French wave on the night of October 11–12, 2026. France’s national cybersecurity agency, CERT-FR, warned on October 12 that remote management interfaces for refrigeration controllers had been exposed online in ways that did not follow good practice. The agency said attack campaigns were “probably still ongoing.” That warning provides relevant context, but it does not by itself prove that every November incident used the same access route.
Belgium’s installer Sabcobel has said the mechanism matched the French incidents: refrigeration evaporators were remotely switched into defrost mode. Finland’s National Cyber Security Centre said the attacks there and elsewhere targeted specific Danfoss models, according to Finnish news agency STT. Reports from stores in different countries describe varying temperatures and operational effects, so a common mechanism does not mean every site experienced identical damage.
Country and store totals remain provisional. BleepingComputer reported more than 115 stores in six countries, while The Record reported more than 50 in Belgium. Other Belgian media tallies differ, and Finland’s reported cases are additional to some published counts. These figures use different reporting snapshots and definitions; they should not be combined into a precise final total.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Attribution and AI Evidence
No public attribution or claim of responsibility has been reported. Belgium’s federal prosecutor has opened a criminal investigation, and Belgium’s cyber centre has warned that identifying the attacker may not be possible. It is also not yet clear how many affected systems were accessed, whether the same party was responsible for every country, or what the total financial and food losses will be.
AI involvement is unconfirmed. Belgium’s cyber centre has warned more generally about a rise in attacks that partly involve AI, but that broad warning is not evidence that AI was used in these refrigeration incidents. The available reporting does not establish an AI role in the access, the changes to controller settings or the coordination of attacks.
Reports also differ on affected store totals, specific temperatures and which controller models were involved. Authorities and retailers have not published a single consolidated incident account covering all countries. The precise entry route at each store, and whether any systems were accessed through shared weaknesses or separate exposures, remain unclear.
Investigations and Store Checks Continue
Belgium’s federal prosecutor is investigating, while retailers and refrigeration technicians continue to assess affected equipment and losses. The immediate focus is on restoring safe operation, checking controller access and determining which installations were reachable online. No public timetable for a final investigation report has been given.
Retailers have not announced a common Europe-wide remediation plan in the material available. Further statements from national cybersecurity agencies, police and affected companies may clarify the number of sites, the controller models and whether the October and November incidents can be tied to the same actor. Until those findings are published, the reported scale and technical links remain provisional.
Key Questions
How many stores were affected?
Reports put the number at more than 115 stores across at least six countries, with Finnish authorities and Kesko also reporting problems at a few smaller stores. Counts vary by source and remain provisional.
What happened to the refrigeration systems?
Reports say controllers were remotely accessed and refrigeration units were switched into defrost or heating modes. Some freezers warmed substantially, and some stores reported having to discard food.
Who carried out the attacks?
No one has been publicly identified. Belgium’s federal prosecutor has opened an investigation, but no group has claimed responsibility.
Was artificial intelligence used?
There is no confirmed evidence of AI involvement. A general warning about AI-related attacks from Belgium’s cyber centre does not establish that AI was used in these incidents.
Is this linked to the October attack in France?
The reported method appears similar. Sabcobel said the November incidents used the same mechanism as the French wave, but investigators have not publicly confirmed that the same attacker was behind both.
Source: ThorstenMeyerAI.com
