🔍 Read the full analysis: The AI Question Behind Europe’s Supermarket Refrigeration Threat on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Reports say more than 115 supermarkets and other businesses across at least six European countries suffered refrigeration problems overnight on Nov. 1–2 after controllers were remotely switched into defrost or heating modes. The method appears to match attacks in France in October, but the perpetrator and any role for AI remain unknown.
Refrigeration systems at more than 115 stores in at least six European countries were reportedly disrupted overnight on Nov. 1–2 after internet-reachable controllers were switched into defrost or heating modes. The incidents, reported in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, resemble a wave of attacks in France last month; who carried them out and whether AI was involved are unknown.
Store operators and media reports described units heating instead of keeping food cold. In Belgium, Ahold Delhaize said it had identified an IT incident affecting refrigeration systems in several dozen stores. BleepingComputer put the number at about 40 across Belgium and Luxembourg. Carrefour Belgium said 15 of its 700 stores were affected, involving a few refrigeration units, mainly freezers; it said none of its hypermarkets were involved.
Other reported cases included at least four ICA stores and seven Coop stores in Sweden, 13 SuperValu stores in Ireland, one Selver store in Estonia and around 15 Intermarché outlets in Belgium. A Danfoss spokesperson told Dutch broadcaster NOS that systems at at least 17 businesses in the Netherlands, mostly butchers and neighbourhood shops, were affected. Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller stores. These counts come from different reports and do not form a single verified total.
In Belgium, refrigeration installer Sabcobel chief executive Stephan Moelans told RTL and Belga that technicians began disconnecting installations from 1 a.m. He said about 20 of the several hundred installations his firm manages in the country were affected and that Sabcobel itself was not hacked. The butcher De Laet & Van Haver in Antwerp reportedly detected the problem early enough to stop its systems. A Proxy Delhaize in Hoepertingen reported freezers at 15 °C and estimated food losses of at least €60,000, according to local reporting cited by VRT NWS.
Cybersecurity · Food systems · Europe
The AI Question Behind Europe’s Supermarket Refrigeration Threat
Remote controllers reportedly pushed refrigeration units into defrost or heating modes across multiple countries. The disruption is clear; who was behind it—and whether AI played any role—remains unknown.
Reported window
Nov. 1–2
Overnight disruption
Countries cited
6+
Across Europe; Finland also reported anomalies
Belgium example
€60k+
Estimated food loss at one store
Investigation
Open
Belgian federal prosecutor involved
01 / What happened
A remote change with physical consequences
Reports say internet-reachable refrigeration controllers were switched into defrost or heating modes. Units heated instead of keeping food cold, forcing some businesses to respond quickly, inspect stock and call technicians.
Control systems
Refrigeration disrupted
Reportedly affected equipment included evaporators and controllers used to manage cooling in stores and small businesses.
Immediate response
Technicians disconnected units
Belgian installer Sabcobel said technicians began disconnecting installations from 1 a.m.; about 20 systems it managed were affected.
Business impact
Stock and safe operation at risk
Stores may need to discard food, close units or restore safe temperatures. Total losses across affected locations are not established.
Belgium & Luxembourg
Retailers and operators reported impacts
Ireland
SuperValu stores cited
Sweden
ICA and Coop stores cited
Netherlands
Mostly butchers and neighborhood shops
Estonia
One Selver store cited
Finland
Authorities and Kesko reported anomalies
02 / How the impact unfolds
From exposed controls to food loss
A cyber incident affecting building equipment can create immediate physical and financial consequences even when checkout and customer-facing systems remain available.
Remote access
A controller reachable over the internet is accessed or manipulated.
Mode changed
Cooling equipment is reportedly switched to defrost or heating.
Temperature rises
Freezers and refrigeration units can no longer keep stock cold.
Operators respond
Teams isolate equipment, assess food and restore safe conditions.
Reported example
Hoepertingen, Belgium
A Proxy Delhaize reportedly found freezers at 15 °C and estimated food losses of at least €60,000, according to local reporting cited by VRT NWS.
Exposure pattern
Locally managed equipment
Some reported cases involved outlets outside central safeguards or networks. That suggests a monitoring challenge, but does not prove every independent system is vulnerable.
03 / Similarity is not attribution
A French wave offers a technical clue
The incidents resemble a reported French campaign on the night of Oct. 11–12. Similar methods can help investigators compare events, but they do not establish that the same operator was responsible.
France · Oct. 11–12
About 700 victims counted
France’s Paris prosecutor’s office counted about 700 victims, according to the source material.
CERT-FR warning
Remote interfaces exposed
France’s national cyber response team warned that online remote-management interfaces for refrigeration controllers were exposed contrary to good practice.
Reported mechanism
Evaporators in defrost mode
Sabcobel described the latest mechanism as “exactly the same” as in France. Finland’s cyber centre also cited attacks targeting specific Danfoss models.
Reports support a similarity in the method. They do not confirm a shared person or group, and no one has publicly claimed responsibility.
04 / The AI question
“The confirmed concern is remote access to refrigeration controls. The available reporting does not confirm that AI was used in this campaign.
Belgium’s cyber centre has warned more broadly about attacks that partly involve AI. That warning is not evidence that AI played a role in these incidents.
05 / What remains unknown
Investigators are tracing access
Belgium’s federal prosecutor has opened a criminal investigation. Authorities and operators are examining how controllers were reachable and whether access credentials, software flaws or cross-border activity were involved.
Attribution
No identified perpetrator
No group or individual has claimed responsibility, and authorities have not publicly attributed the incidents.
Scope
Final counts and losses unsettled
Reports vary. Total food losses, the full list of affected controller models and any access to other systems have not been established.
Next steps
Further findings awaited
Stores are assessing losses and restoring safe operation. Businesses using remote refrigeration management may review internet exposure and access controls.
06 / Key questions
What we know—and what we don’t
What happened to the systems?
Reports say remote controllers were switched into defrost or heating modes, disrupting refrigeration at businesses across Europe.
How many locations were affected?
BleepingComputer reported more than 115 stores in at least six countries. Counts differ by outlet, and Finland also reported anomalies.
Is the attacker known?
No. There is no public attribution or claim of responsibility. Belgium’s federal prosecutor is investigating.
Was AI used?
That has not been established. The supplied reporting contains no evidence that AI was used in the campaign.
Food Losses and Exposed Controls
The incidents show how a cyberattack on building equipment can cause immediate physical and financial damage without disrupting a retailer’s checkout or customer-facing systems. When refrigeration fails, stores may have to discard stock, close units or bring in technicians. In Hoepertingen, the reported estimate of at least €60,000 in discarded food illustrates the potential cost for an individual business; the total losses across all affected locations have not been established.
Reports indicate that smaller or independently operated outlets were especially exposed. Colruyt said its own stores were not affected, while some Spar outlets operated by independent entrepreneurs had separate refrigeration systems. ICA and Coop also described affected Swedish stores as outside central safeguards or networks. The pattern points to a practical security challenge: equipment managed locally or outside a chain’s central systems may not receive the same monitoring and protection. That is a reported pattern, not proof that every independent system is vulnerable.
The word “AI” in the story’s framing should not be mistaken for evidence about the attacks. Belgium’s cyber centre has warned of a broader rise in attacks that partly involve AI, but the source material contains no evidence that AI was used in this campaign. The confirmed concern is remote access to refrigeration controls, not a demonstrated AI-enabled operation.
Products Worth Considering
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
Samsung 32-inch Odyssey OLED G8 (G80SH) 4K QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Wave in October
The reported incidents follow a French wave on the night of Oct. 11–12 that affected hundreds of supermarkets. France’s Paris prosecutor’s office counted about 700 victims, according to the source material. On Oct. 12, France’s national cyber incident response team, CERT-FR, warned that remote management interfaces for refrigeration controllers had been exposed online contrary to good practice. It said attack campaigns were “probably still ongoing.”
Belgian installer Sabcobel said the mechanism in the latest incidents was “exactly the same” as in France: evaporators were reportedly switched remotely into defrost mode. Finland’s National Cyber Security Centre said attacks in Finland and elsewhere targeted specific Danfoss models, according to Finnish news agency STT. Those reports support a technical similarity, but do not establish that the same person or group was behind both waves.
Numbers vary by outlet and by the time each report was published. BleepingComputer reported more than 115 stores across six countries, while The Record reported more than 50 in Belgium alone. Euronews, citing Belgian newspaper Le Soir, listed about 75 affected Belgian sites across several retailers. Reported temperatures also varied, from 15 °C in one Belgian store to 50 °C in locations in Belgium, Sweden and Estonia.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Who Accessed the Controllers?
No group or individual has claimed responsibility, and authorities have not publicly attributed the incidents. Belgium’s federal prosecutor has opened a criminal investigation. The Belgian cyber centre has warned that the attacker may never be identified. It is also not yet clear whether the French and latest waves share an operator, even though Sabcobel described the mechanism as the same.
The exact number of affected locations remains unsettled because reports use different counts, countries and reporting times. Losses, the full list of affected controller models and whether any data or other systems were accessed have not been established in the supplied reporting. There is no reported confirmation that AI played a role; a general warning about AI-related cyber activity does not establish its use in these incidents.
Investigators Trace Remote Access
Belgium’s federal prosecutor is investigating, while retailers and refrigeration specialists are responding to affected equipment and checking store systems. Authorities and operators will need to determine how the controllers were reachable, whether access credentials or software flaws were involved, and whether the activity crossed national borders. The source material does not give a timetable for findings or identify a planned public report.
Stores affected by the incidents will have to assess food losses and restore safe operating conditions. Businesses that use remote refrigeration management may also review internet exposure and access controls, in light of the earlier CERT-FR warning. For now, the next clear milestone is further information from investigators and affected companies; attribution, final counts and any AI connection remain unconfirmed.
Key Questions
What happened to the supermarket refrigeration systems?
Reports say remote controllers were switched into defrost or heating modes, causing refrigeration problems at stores across several European countries overnight on Nov. 1–2.
How many stores were affected?
BleepingComputer reported more than 115 stores in at least six countries. Counts vary between sources, and Finnish authorities and Kesko also reported problems at a few smaller stores in Finland.
Is the attacker known?
No. The source material reports no claim of responsibility or public attribution. Belgium’s federal prosecutor has opened an investigation.
Was AI used in the attacks?
That has not been established. Belgium’s cyber centre has warned about a wider rise in attacks partly involving AI, but no source in the material says AI was used in these incidents.
Were these attacks linked to the French incidents in October?
The refrigeration installer Sabcobel said the technical mechanism was the same as in France. That does not confirm that the same attacker was responsible for both waves.
Source: ThorstenMeyerAI.com
