🔍 Read the full analysis: What AI Has To Do With Europe’s Supermarket Freezer Attacks on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Refrigeration systems at more than 115 supermarkets and other businesses in at least six European countries were reportedly switched into defrost or heating modes overnight on Nov. 1-2. Authorities and companies describe a cyberattack involving internet-accessible controllers, but the attacker’s identity and any role for AI remain unconfirmed.
More than 115 stores in at least six European countries reported overnight disruptions to refrigeration systems on November 1-2, with controllers apparently switched into defrost or heating modes, according to media reports and company statements. The incident follows a similar wave in France in October; officials have not identified the attacker, and there is no confirmation that artificial intelligence was used.
Reports describe affected businesses in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, with Finnish authorities and retailer Kesko also reporting problems at a few smaller stores. The exact total remains unsettled: BleepingComputer counted more than 115 sites, while other reports gave different country and store totals. In Belgium, Sabcobel chief executive Stephan Moelans said technicians began disconnecting refrigeration installations at about 1 a.m. He told The Record that around 20 of several hundred installations managed by his company were affected, and said Sabcobel itself had not been hacked. The controllers at stores were reachable over the internet, he said.
Retailers described disruptions at individual locations, rather than a uniform impact across their networks. Ahold Delhaize said an IT incident affected refrigeration systems in several dozen stores; BleepingComputer put the figure at about 40 in Belgium and Luxembourg. Carrefour Belgium said 15 of its 700 stores were affected, while Colruyt said problems involved about five Spar stores run by independent operators with their own refrigeration systems. In Sweden, ICA reported at least four affected stores outside its central network, and Coop said seven of more than 800 stores were affected. Reports also listed 13 SuperValu stores in Ireland, one Selver store in Estonia, and at least 17 businesses in the Netherlands, mostly butchers and neighbourhood shops, according to a Danfoss spokesperson cited by NOS.
Some affected operators reported food losses. The Proxy Delhaize in Hoepertingen said its freezers had reached 15°C and estimated that at least €60,000 in food had to be discarded, according to Het Belang van Limburg as cited by VRT NWS. A butcher in Hove reported throwing away hundreds of kilos of food. At another Antwerp butcher, De Laet & Van Haver, staff noticed the tampering around 3 a.m. and stopped the systems in time, VRT NWS reported. Temperatures varied: reports cited 50°C in Eeklo and some locations in Sweden and Estonia, and 15°C or 17°C at other Belgian sites.
Cyber incident briefing · Europe · November 2026
What AI Has To Do With Europe’s Supermarket Freezer Attacks
Refrigeration controllers at businesses across Europe were reportedly switched into defrost or heating modes overnight. The disruption is documented; any role for artificial intelligence remains unconfirmed.
01 / At a glance
A reported overnight wave
Counts differ across reports and may reflect different publication times, definitions, and store lists.
Counted by BleepingComputer
Across northern and western Europe
Overnight refrigeration disruptions
No incident-specific evidence reported
02 / Where disruption was reported
A patchwork of local impacts
Reported effects varied by operator and store. Some were independent businesses or locations outside a chain’s central network.
Belgium
Retailer reports included 15 Carrefour stores; around five independent Spar stores also had problems.
Netherlands
At least 17 businesses, mostly butchers and neighborhood shops, according to a Danfoss spokesperson cited by NOS.
Sweden
ICA reported at least four stores outside its central network; Coop reported seven.
Luxembourg
Included in reports of the wider incident; some store counts combine Belgium and Luxembourg.
Ireland
Reports listed 13 SuperValu stores affected.
Estonia & Finland
One Selver store was reported in Estonia; Finnish authorities and Kesko reported problems at a few smaller stores.
Reported totals are not reconciled: coverage cited more than 115 sites overall, more than 50 in Belgium in one account, and about 75 Belgian locations in another.
03 / How the disruption is described
From exposed controller to spoiled stock
This is the reported pattern—not a complete forensic account of every affected location.
Reachable equipment
Controllers were reportedly accessible over the internet at affected sites.
Settings changed
Refrigeration was reportedly switched into defrost or heating modes.
Temperatures rose
Reports described varied readings, including 15°C, 17°C, and higher extremes.
Business losses
Some operators discarded food; emergency shutdowns helped limit damage elsewhere.
Reported loss · Belgium
At least €60,000
The Proxy Delhaize in Hoepertingen said its freezers reached 15°C and estimated that at least €60,000 of food had to be discarded. A butcher in Hove reported throwing away hundreds of kilos of food. These are local accounts, not a confirmed total across affected businesses.
04 / The AI question
What is known—and what is not
A general warning about AI-enabled attacks does not establish AI use in this specific operation.
Remote access risk
Reports point to internet-reachable refrigeration controllers. France’s CERT-FR had previously warned that exposed remote management interfaces were contrary to good practice.
How access happened
There is no public forensic account establishing the entry path across every site, or showing that all affected businesses used the same controller model or configuration.
Any role for AI
Belgium’s cyber centre warned generally about attacks partly involving AI. No cited authority or company tied AI to finding controllers, gaining access, or changing settings here.
05 / A recent precedent
France saw a similar wave in October
The reported timing and method drew comparisons, but similarity alone does not identify a culprit.
About 700 victims counted
France’s Paris prosecutor’s office counted about 700 victims, according to the source report. CERT-FR warned that exposed refrigeration remote-management interfaces were a security concern and said campaigns were probably ongoing.
Similar mechanism reported
Belgian installer Sabcobel said the method was “exactly the same,” with evaporators reportedly switched into defrost mode remotely. That is the company’s account, not a public forensic finding naming an attacker.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
Ahold Delhaize
06 / Investigation status
The attacker and full scope remain unknown
Belgium’s federal prosecutor has opened a criminal investigation. The cyber centre cautioned that the attacker may never be identified.
No attacker has been identified, and reports describe no claim of responsibility.
Published site counts differ. The total locations affected and full value of spoiled stock are unclear.
Retailers, service providers, and cybersecurity bodies are checking scope and cause; no findings timetable has been reported.
Why Small Stores Were Exposed
The reported pattern points to a risk for internet-connected building equipment, not only the central IT networks that retailers use for sales and administration. Several affected businesses were independent operators or stores running outside a chain’s central network or safeguards. That can leave older or locally managed refrigeration controllers with different security arrangements from those used across a large retailer’s main estate.
The immediate consequence is practical and costly: refrigeration failure can spoil stock, interrupt trading and require emergency repairs. In this incident, at least one Belgian store gave a loss estimate of €60,000, though that figure is a report from the operator rather than a confirmed total across all affected businesses. The disruptions also show how systems designed to control temperatures can affect food businesses when their remote management interfaces are exposed. The accounts available so far do not establish whether the attackers sought financial gain, caused disruption for another purpose, or caused any broader impact on food supply.
The AI angle requires particular care. Belgium’s cyber centre has warned of a general increase in attacks that partly involve AI, according to the source report. That warning is not evidence that AI enabled this incident. No authority or company cited in the reports said AI was used to locate the controllers, gain access or change settings. The confirmed concern is the reported remote access to refrigeration equipment; attributing a role to AI would go beyond the available evidence.
Popular right now
Ninja CREAMi Scoop & Swirl 13-in-1 Ice Cream and Soft Serve Maker (NC701)
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
Jura E6 Automatic Espresso Machine, Piano Black (15622)
As an affiliate, we earn on qualifying purchases.
A Second Refrigeration Attack Wave
The November incident came less than three weeks after refrigeration systems at hundreds of French supermarkets were reportedly switched into defrost mode overnight on October 11-12. France’s Paris prosecutor’s office counted about 700 victims, according to the source report. On October 12, France’s national cybersecurity agency CERT-FR warned that remote management interfaces for refrigeration controllers were exposed online contrary to good practice and said attack campaigns were “probably still ongoing.”
Belgian installer Sabcobel said the method in the latest incident was “exactly the same” as in France: evaporators were reportedly switched into defrost mode remotely. That is a company’s account of the mechanism, not a public forensic finding naming a culprit. The Belgian federal prosecutor has opened a criminal investigation. Belgium’s cyber centre has cautioned that the attacker may never be identified.
Coverage varies in how it counts affected sites and describes temperatures. BleepingComputer reported more than 115 stores across six countries; The Record reported more than 50 in Belgium, while Euronews, citing Le Soir, listed about 75 Belgian locations across several operators. These figures may reflect different reporting times, definitions or store lists. They should not be treated as a final, reconciled tally.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
The Attacker and AI Link Are Unknown
No attacker has been identified, and the source reports describe no claim of responsibility. Belgium’s federal prosecutor has opened an investigation, but authorities have not publicly explained who accessed the controllers, how access was obtained in each case, or whether the incidents in different countries were carried out by the same person or group.
There is also no confirmed forensic account establishing the precise entry path across every affected site. Reports point to internet-reachable refrigeration controllers and describe the method as matching the October incident in France, but the available material does not establish whether every store had the same controller model, configuration or vulnerability. Finland’s National Cyber Security Centre said the attacks targeted specific Danfoss models, according to STT; that reported finding does not by itself show that all affected systems used those models.
AI use is unconfirmed. The Belgian cyber centre’s general warning about attacks partly involving AI does not tie AI to this operation. The total number of affected locations and the full value of spoiled stock also remain unclear. Published counts differ, and reports vary by store and country.
Investigations and Store Checks Continue
Belgium’s criminal investigation is underway, while retailers, refrigeration service providers and national cybersecurity bodies are working to establish the scope and cause of the disruptions. The source material does not give a timetable for investigative findings or a confirmed deadline for a final count of affected sites.
For now, the next concrete developments are likely to be further company and authority updates on affected locations, equipment and losses. Operators will also need to check whether refrigeration controllers can be reached remotely and whether access is restricted and monitored. France’s CERT-FR had already warned about exposed management interfaces after the October attacks, but the available reports do not say which specific safeguards have since been installed at the affected businesses.
Key Questions
What happened to the supermarket freezers?
Reports say remote refrigeration controllers at stores in several European countries were switched into defrost or heating modes overnight on November 1-2, causing some freezers and cold rooms to warm up.
How many stores were affected?
BleepingComputer reported more than 115 stores in at least six countries. Other reports give different totals, and the figures have not been reconciled into a final count.
Has anyone confirmed that AI was used?
No. A general warning from Belgium’s cyber centre about attacks partly involving AI is not evidence that AI played a role in this incident. No cited authority or company has confirmed AI use.
Who carried out the attacks?
The attacker has not been identified, and the source reports describe no claim of responsibility. Belgium’s federal prosecutor has opened a criminal investigation.
Why were some independent stores affected?
Several retailers said affected sites operated outside their central networks or used their own refrigeration systems. The reports suggest those arrangements may have different safeguards, but they do not establish the security setup at every affected store.
Source: ThorstenMeyerAI.com
