🔍 Read the full analysis: Could AI Be Changing The Supermarket Refrigeration Threat? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A second wave of reported cyberattacks disrupted supermarket refrigeration in Europe overnight on Nov. 1–2, 2026. More than 115 stores in at least six countries were reported affected, but counts vary; investigators have not identified the attacker, and no evidence has established that AI was used.
Remote tampering with supermarket refrigeration controllers disrupted stores in several European countries overnight on Nov. 1–2, with more than 115 outlets reported affected in at least six countries. The incidents appear to match a French wave reported in October, but authorities have not identified who was responsible, and there is no confirmation that AI was involved.
Reports describe controllers being switched into defrost or heating mode, causing some freezers and refrigerators to warm or stop operating. Belgian broadcaster VRT NWS reported that freezers at a Delhaize in Eeklo reached 50 °C. In Sweden, ICA store manager Rickard Nilsson told TV4 that staff could not adjust the temperatures and that heat was entering the freezers. The effects differed by location, and reported temperatures should not be taken as a single reading for all affected stores.
Retailer and media accounts give different totals. BleepingComputer counted more than 115 stores across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; Finnish outlets also reported problems at a few smaller K stores. In Belgium, Ahold Delhaize said an IT incident affected several dozen stores. Carrefour Belgium said 15 of its 700 stores were affected, while Colruyt reported problems at about five independently operated Spar outlets. Swedish Coop said seven of more than 800 stores were affected; ICA reported at least four. Other reports included 13 SuperValu stores in Ireland and at least 17 businesses in the Netherlands.
Some stores reported substantial food losses. The Proxy Delhaize in Hoepertingen estimated that it had to discard food worth at least €60,000, according to Het Belang van Limburg as cited by VRT NWS. A butcher in Hove reportedly threw away hundreds of kilos of food. In other cases, including a butcher in Antwerp, staff noticed the tampering and shut systems down in time. The available reports do not provide a verified, Europe-wide estimate of losses.
Europe · Refrigeration systems · Nov. 1–2, 2026
Could AI Be Changing the Supermarket Refrigeration Threat?
A second reported wave of remote disruptions affected supermarket refrigeration overnight. Reports point to controller settings changed remotely; investigators have not identified the attacker, and no evidence establishes that AI was used.
01 / The reported disruption
What happened to the cold chain?
Accounts describe remote tampering with refrigeration controllers. Some equipment warmed or stopped working, but conditions differed by location; individual readings are not representative of every affected store.
Defrost or heating mode
Reports say evaporators were remotely switched into defrost mode, or units into heating mode, disrupting normal refrigeration.
Temperatures rose
Staff in Sweden said they could not adjust temperatures and that heat was entering freezers. Belgian reports described differing equipment conditions.
A Delhaize in Eeklo was reported to have freezer temperatures reaching 50 °C. This was a site-specific account.Food and trading at risk
Stores faced stock losses, interruptions and urgent technician callouts. Some operators detected the tampering and shut systems down in time.
02 / Reported footprint
One wave, uneven counts
Media and retailer totals differ, and some counts include businesses beyond supermarkets. These reported figures should not be added together as a verified Europe-wide total.
Several dozen
Ahold Delhaize reported several dozen stores affected. Carrefour Belgium said 15 of 700 stores; Colruyt reported issues at about five independently operated Spar outlets.
Chain reports
Coop Sweden reported seven stores; ICA at least four. Reports also cited 13 SuperValu stores in Ireland.
At least 17
Other coverage reported at least 17 businesses affected. Outlet-level definitions and confirmation differ.
Six countries or more
Reports named Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish outlets also described problems at a few smaller K stores.
03 / Why systems are exposed
Operational equipment can be a weak link
Refrigeration is essential to safe food storage. Internet-reachable management interfaces can create real operational and financial harm even when a retailer’s main business network is not reported to be compromised.
04 / Comparison & AI question
Reports resemble France’s October wave
The timing and described mechanism suggest a possible connection. Authorities and operators have not publicly confirmed a shared cause or identified the person or group responsible.
Exposure warning
CERT-FR warned that remote management interfaces for refrigeration controllers were exposed online contrary to good practice, and said campaigns were probably ongoing.
Similar controller changes
Belgian installer Sabcobel said the later incidents used the same mechanism: evaporators remotely switched into defrost mode. It reported about 20 affected among several hundred installations it manages in Belgium.
No confirmed role
No cited source says AI selected targets, accessed controllers or changed settings. A broader warning about AI in cyberattacks does not establish AI use in this incident.
05 / Attribution & response
Investigation is ongoing
Belgium’s federal prosecutor opened a criminal investigation. Retailers and refrigeration specialists are assessing damage, restoring equipment and checking how each controller could be reached.
Still unknown
No one has claimed responsibility, and the source material reports no public identification of a suspect. Motive and route into each system remain unresolved.
Totals may change
More than 115 outlets is a reported count, not a confirmed combined total. Full food losses and the status of every system are also not established.
Check access and isolation
Operators need to establish controller exposure, whether incidents share a technical cause and whether other stores remain at risk.
Key questions
What we know—and what remains open
What happened?
Reports say refrigeration controllers were remotely switched into defrost or heating modes. Effects varied by store.
How many stores were affected?
Coverage counted more than 115 outlets across at least six countries, but retailer and media totals differ.
Was AI used?
That is unconfirmed. No cited evidence establishes AI involvement in selecting targets, gaining access or changing settings.
Who was responsible?
Attribution remains unknown. The investigation has not publicly identified a suspect or confirmed a shared vulnerability.
Food Loss and Exposed Store Systems
The incidents show how online access to building equipment can create operational and financial harm even when a retailer’s main business network is not reported to be compromised. Refrigeration is essential to keeping perishable food at safe temperatures; a remote change to a controller can force businesses to discard stock, interrupt trading and bring technicians out overnight.
Reports suggest smaller or independently operated stores were often affected. Swedish chains said impacted outlets operated outside their central networks, while Colruyt said the affected Spar shops had their own refrigeration systems. That pattern is a reported feature of these incidents, not proof that independent stores are uniformly less secure. It does point to the challenge of managing older or separately administered equipment alongside centrally controlled systems.
The repeated timing also matters. France’s October incidents and the Nov. 1–2 reports appear to involve a similar method, according to Belgian installer Sabcobel and French cybersecurity authorities. If the connection is confirmed, the wave could indicate that exposed refrigeration controls remain a practical target. For consumers, the immediate concern is possible disruption and food availability at affected shops; for retailers, it is the cost of lost stock and the need to review remote access to operational equipment.
Products Worth Considering
Samsung 27-inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
Samsung 32-inch Odyssey OLED G8 (G80SH) 4K QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Incident in October
On Oct. 12, France’s national cybersecurity agency, CERT-FR, warned that remote management interfaces for refrigeration controllers were exposed online contrary to good practice. It said attack campaigns were probably still ongoing. The Paris prosecutor’s office later counted about 700 victims in the French wave, according to the source material.
Belgian installer Sabcobel said the later incidents used the same mechanism as the French ones: evaporators were remotely switched into defrost mode. Sabcobel chief executive Stephan Moelans told Belgian media that the company itself had not been hacked and that technicians were disconnecting affected installations from 1 a.m. He told The Record that about 20 of the several hundred installations his company manages in Belgium were affected.
The central point in the question of AI is that no source cited here says AI was used to select targets, access controllers or change settings. Belgium’s cyber centre has warned more broadly of a rise in attacks partly involving AI, but that general warning does not establish a role for AI in these refrigeration incidents. The confirmed reporting instead describes internet-reachable controllers and remote changes to their operating mode.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize
Who Attacked the Controllers?
Attribution remains unknown. No one has claimed responsibility, and the source material reports no public identification of a suspect. Belgium’s federal prosecutor has opened a criminal investigation; the Belgian cyber centre has warned that the attacker may never be identified.
The scale is also unsettled. BleepingComputer’s total of more than 115 stores and other outlet-by-outlet estimates do not align exactly, and some counts include businesses rather than supermarkets alone. The reports describe different temperatures and levels of damage at different sites. A confirmed combined total of affected outlets, the full value of discarded food and the status of every system were not available in the cited material.
Most importantly for the question of AI, AI involvement is unconfirmed. A general warning that attackers may use AI is not evidence that it was used in this event. The available reporting does not establish the attacker’s identity, motive, or whether the affected controllers were reached through one shared vulnerability or through separate exposures.
Investigations and Retailer Checks
Belgium’s federal prosecutor is investigating, while affected retailers and refrigeration specialists are assessing damage and restoring equipment. Store-by-store reports may change as businesses check their systems and confirm whether food can be kept or must be discarded.
Retailers and operators will need to establish how each controller was reachable, whether the incidents share a technical cause, and whether any additional stores remain exposed. The October warning from CERT-FR called attention to internet-accessible management interfaces; the later reports make the security and isolation of those systems a central issue for operators. No public timeline for the Belgian investigation or a final cross-country incident count was given in the source material.
Until investigators or companies provide technical evidence, claims about the attacker, any AI role and the precise route into each system should be treated as unresolved. Further updates are likely to focus on confirmed victim counts, recovery and whether the reported method is the same as in France.
Key Questions
What happened to the supermarket refrigeration systems?
Reports say controllers at affected businesses were remotely switched into defrost or heating modes, causing some refrigeration units to warm or stop working. The impact varied by store.
How many stores were affected?
BleepingComputer counted more than 115 stores in at least six countries, with Finnish reports adding a few smaller stores. Totals differ among reports and have not been confirmed as a single final count.
Is there evidence that AI was used?
No evidence cited in the reports establishes that AI played a role. Belgium’s broader warning about attacks partly involving AI does not confirm AI use in this incident.
Who was responsible?
The attacker has not been identified, and no group has claimed responsibility. Belgium’s federal prosecutor has opened an investigation.
Why were smaller or independent stores affected?
Some retailers said affected outlets operated outside central networks or had independently managed refrigeration systems. That is a reported pattern, but the precise cause of each store’s exposure has not been established.
Source: ThorstenMeyerAI.com
