🔍 Read the full analysis: AI, Freezers, And The Second Wave Of European Refrigeration Attacks on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Refrigeration systems at more than 115 stores across at least six European countries were reportedly disrupted overnight on Nov. 1–2. Belgian authorities are investigating, but the attackers’ identity and whether AI was involved remain unknown.
Refrigeration systems at more than 115 European stores were reportedly disrupted overnight on Nov. 1–2, with controllers switched into defrost or heating modes, according to reports compiled by BleepingComputer. The incidents affected businesses in at least six countries and followed a similar attack on French supermarkets in October; no suspect or motive has been identified.
Retailers and broadcasters reported incidents in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller Finnish stores. The reported totals vary by source and remain subject to confirmation. A Belgian installer, Sabcobel, said remote attacks switched refrigeration evaporators into defrost mode using a mechanism it described as “exactly the same” as in France.
The effects differed from store to store. A Proxy Delhaize in Hoepertingen reported freezers at 15 °C rather than the usual minus 22 °C and estimated that at least €60,000 of food had to be discarded, according to local newspaper Het Belang van Limburg, as cited by VRT NWS. In Sweden, ICA manager Rickard Nilsson told TV4 that staff could not change the settings and heat was blowing into freezers. Some businesses shut systems down or intervened before food was lost.
Retailers described incidents at individual outlets rather than across their entire chains. Carrefour Belgium said 15 of its 700 stores were affected, while Coop Sweden reported seven stores among more than 800. Ahold Delhaize reported an IT incident affecting several dozen stores; BleepingComputer put the number at about 40 in Belgium and Luxembourg. Belgian authorities have opened a criminal investigation. No public attribution or claim of responsibility was reported in the source material.
Operational technology · Europe · Nov. 1–2, 2026
AI, Freezers, and the Second Wave of European Refrigeration Attacks
More than 115 stores reportedly faced disrupted refrigeration overnight. Investigators are examining the incidents, while the attackers’ identity, motive, and any use of AI remain unknown.
Exactly the same mechanism as in France.
Stephan Moelans · Sabcobel chief executive · As reported by Belgian mediaControllers switched into defrost or heating modes, with effects varying by store.
01 / The incident
A cold chain turned into a business risk
The events were reported at individual outlets. Retailers have not described a single chain-wide outage.
Freezers reached 15 °C
A Proxy Delhaize outlet reported temperatures far above its usual −22 °C and estimated at least €60,000 in food had to be discarded.
Heat entered freezers
ICA manager Rickard Nilsson told TV4 that staff could not change the settings and heat was blowing into freezer units.
Some sites were contained
Carrefour Belgium said 15 of 700 stores were affected. Coop Sweden reported seven among more than 800 stores.
Counts are provisional. Ahold Delhaize reported an IT incident affecting several dozen stores; BleepingComputer put the figure at about 40 in Belgium and Luxembourg. Separate reports cite different totals and locations.
02 / How disruption can spread
From remote access to spoiled stock
The reporting describes internet-accessible refrigeration controllers. It does not establish a complete access path for every store.
Reachable controllers
Remote-management interfaces for refrigeration equipment may be exposed online.
Defrost or heating
Reports say settings were changed remotely; some systems could not be corrected by store staff.
Temperature rises
Effects ranged from abnormal readings to disrupted refrigeration and emergency shutdowns.
Stock and service
Food loss, lost revenue, technician callouts, and interrupted operations can follow.
03 / The pattern
Small outlets can sit outside central safeguards
The reports point to independently operated stores and equipment beyond some retailer-wide security controls.
Potential exposure
Distributed equipment
Smaller independently operated outlets may use their own equipment, including older installations. Central protections may not reach every controller.
Illustrative only: reporting provides no measured security-coverage data.
Prior incident · France
A similar attack in October
During the night of Oct. 11–12, refrigeration at hundreds of French supermarkets was reportedly disrupted. The Paris prosecutor’s office reportedly counted about 700 victims.
On Oct. 12, CERT-FR warned that exposed remote-management interfaces did not follow good practice and said campaigns were probably ongoing.
Updates are not a confirmed explanation. The source says manufacturers had shipped software updates months earlier, but does not establish whether each affected store installed them or whether they would have prevented these incidents.
04 / What remains unknown
The “AI” in the headline is an open question
Belgium’s cyber centre has issued broader warnings about attacks involving AI. That does not show AI was used here. The source material provides no evidence of AI involvement, a named attacker, or a public claim of responsibility.
05 / Investigation and next steps
Store checks and inquiries continue
Belgium’s federal prosecutor has opened a criminal investigation. Businesses and service providers are assessing damage and affected systems.
How many stores were affected?
BleepingComputer reported more than 115 across at least six countries. Finnish authorities and Kesko also noted anomalies at a few smaller stores. The final count is unsettled.
What happened to the systems?
Reports describe controllers switched into defrost or heating modes. Effects and temperatures differed by location; the figures are from separate reports, not one verified incident log.
Has anyone been identified?
No. The source material reports no attribution or claim of responsibility. Belgian authorities are investigating.
Was food lost?
Some businesses reported discarding food, including an estimate of at least €60,000 at one outlet. Total losses across all affected businesses are not established.
Why Independent Stores Were Exposed
The incidents show how digital access to building equipment can create a direct risk to food and business operations. Refrigeration controllers are not conventional checkout or inventory systems, but disrupting them can lead to spoiled stock, lost revenue and emergency repair work. The source reports that smaller independently operated stores were among those hit, often using their own equipment outside a retailer’s central network or safeguards.
That pattern matters for businesses that rely on internet-connected systems to control physical equipment. Central security measures may not cover every independently run outlet or older installation. The available reporting does not establish that every affected controller was equally exposed, or provide a complete accounting of financial losses. The reported food losses nevertheless show the potential cost of a short-lived intrusion into operational technology.
Products Worth Considering
Samsung 27-inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Attack in October
The November incidents followed a reported attack during the night of October 11–12, when refrigeration systems at hundreds of French supermarkets were disrupted. The Paris prosecutor’s office reportedly counted about 700 victims. On Oct. 12, France’s national cybersecurity agency, CERT-FR, warned that remote-management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice, and said attack campaigns were probably still ongoing.
The source says manufacturers had shipped software updates months before the November incidents, but it does not establish whether every affected store installed them or whether those updates would have prevented these attacks. In Belgium, Sabcobel chief executive Stephan Moelans said technicians began disconnecting installations from about 1 a.m. He told Belgian media that Sabcobel itself was not hacked and that attackers reached internet-accessible controllers at stores.
““Exactly the same” mechanism as in France.”
— Stephan Moelans, chief executive of Sabcobel, as reported by Belgian media
The Scale and Cause Remain Unclear
Reported store counts do not align precisely. BleepingComputer cited more than 115 stores across six countries, while other reports gave different totals for Belgium alone. The source also cites varying temperatures across affected sites, from 15 °C in Hoepertingen to 50 °C in Eeklo and reports of comparable readings in Sweden and Estonia. These figures come from separate outlets and locations, not a single verified incident log.
The attackers’ identity, their motive and the full route used to reach each controller have not been established publicly. The source does not confirm whether every affected system used a Danfoss model or whether a particular software update would have blocked access. It also provides no evidence that AI was used. Belgium’s cyber centre has warned more broadly about attacks involving AI, but that is not evidence of AI involvement in these incidents.
Investigations and Store Checks Continue
Belgium’s federal prosecutor has opened a criminal investigation, and stores and service providers are assessing affected systems and damage. Retailers have reported that some incidents were contained, while technicians responded to sites and disconnected installations. Authorities and businesses may update the country and store totals as assessments continue.
For now, the source material does not give a timetable for identifying suspects or a full public account of the technical findings. The next useful updates would be confirmation of affected systems, any findings on how the controllers were accessed, and whether further incidents or food losses are reported.
Key Questions
How many stores were affected?
BleepingComputer reported more than 115 stores across at least six countries. Other reports give different totals, and Finnish authorities and Kesko also reported problems at a few smaller Finnish stores, so the final count is not settled.
What happened to the refrigeration systems?
Reports say controllers were remotely switched into defrost or heating modes. The effects varied by location, including stopped refrigeration, heating and abnormal temperatures.
Has anyone been identified as responsible?
No. The source material reports no attribution and no claim of responsibility. Belgium’s federal prosecutor has opened an investigation.
Was artificial intelligence used in the attacks?
That is unknown. General warnings about AI-related cyberattacks do not confirm AI was used in this incident, and the source provides no evidence that it was.
Was food lost?
Some businesses reported food losses. A Proxy Delhaize in Hoepertingen estimated at least €60,000 in discarded food, while other stores reportedly discarded hundreds of kilograms. The total losses across all affected businesses have not been established.
Source: ThorstenMeyerAI.com
