🔍 Read the full analysis: The Second Wave Of Attacks On Supermarket Refrigeration—and AI on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Reports say more than 115 supermarkets and smaller food businesses across at least six countries experienced refrigeration-system disruptions overnight on November 1–2, 2026. Belgian installer Sabcobel said the systems were remotely switched into defrost mode, matching the method reported in France in October; no attacker has been identified, and there is no evidence that AI was used.
Refrigeration systems at more than 115 food stores across at least six countries were reportedly disrupted overnight on November 1–2, with some freezers switched into heating or defrost mode, according to reports cited by BleepingComputer. The incidents echo a cyberattack wave in France three weeks earlier, but no attacker has been identified and there is no confirmation that artificial intelligence was involved.
Reports described affected businesses in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller Finnish stores. The count varies across reports, and the available figures are not a verified, consolidated total. Belgium’s federal prosecutor has opened a criminal investigation.
Belgian refrigeration installer Sabcobel’s chief executive, Stephan Moelans, told Belgian media that technicians began disconnecting installations at about 1 a.m. He said internet-reachable controllers at stores were attacked directly, rather than Sabcobel being hacked. About 20 of the several hundred installations his company manages in Belgium were affected, he told The Record.
Retailers reported disruption at stores using refrigeration equipment outside their central networks. Ahold Delhaize said it had identified an IT incident affecting refrigeration systems in several dozen stores. Carrefour Belgium reported 15 affected locations out of 700, while Coop Sweden said seven of its more than 800 stores were affected. Some businesses reported losses: Proxy Delhaize in Hoepertingen estimated at least €60,000 in discarded food, according to a local newspaper cited by VRT NWS. Other stores reported damage or shut-down equipment, but the overall financial cost is not established.
Risks to Food Retail Operations
The incidents show how a disruption to internet-accessible building equipment can affect ordinary store operations, not just checkout systems or customer data. When refrigeration controllers are altered, businesses may face spoiled stock, closed equipment and interruption to food sales. The reported losses at individual stores illustrate a direct cost, though there is no confirmed total for the wave.
The pattern reported by retailers points to a security challenge for operators whose stores or independently run outlets use equipment outside a company’s central network. That does not establish that older or independently managed systems were the entry point in every case. It does indicate why organizations need to know which refrigeration controls are remotely reachable and how those systems are maintained.
The headline’s reference to AI needs careful treatment. Belgium’s cyber centre has warned of a general rise in attacks that partly involve AI, according to the source material. No source cited here says AI was used to carry out these refrigeration attacks. The connection is a question raised by the wider security climate, not a confirmed element of this incident.
Products Worth Considering
Samsung 49-Inch Odyssey G93SC QD-OLED Curved Gaming Monitor
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Samsung 27-inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Attack in October
The latest reports follow an incident in France during the night of October 11–12, 2026, when refrigeration systems at hundreds of supermarkets were reportedly affected. The Paris prosecutor’s office counted about 700 victims, according to the supplied source material. France’s national cybersecurity agency, CERT-FR, warned on October 12 that remote-management interfaces for refrigeration controllers had been exposed online and said attack campaigns were probably still ongoing.
Sabcobel said the mechanism in the Belgian incidents was “exactly the same” as in France: evaporators were remotely switched into defrost mode. Finnish reporting also said attacks targeted specific Danfoss models. Those accounts suggest a possible technical link, but the reports do not establish who carried out either wave or whether the same person or group was responsible.
““Exactly the same” mechanism as in France.”
— Stephan Moelans, chief executive of Sabcobel, as reported by Belgian media
Attribution and AI Remain Unconfirmed
Who carried out the attacks is unknown. No group or individual has claimed responsibility, and Belgian authorities have not publicly named a suspect. Belgium’s cyber centre has warned that identifying the attacker may not be possible.
The total number of affected businesses also remains unsettled. BleepingComputer reported more than 115 stores in six countries, while other outlets gave different country and retailer counts. These figures may cover different businesses or reporting periods, so they should not be treated as a final tally. Reported temperatures also vary by site, from 15°C to 50°C in some accounts.
It is also unclear whether all the incidents had the same cause, whether the October attacks in France and the November reports were conducted by the same actor, and whether every affected system was accessed through an exposed remote-management interface. AI use has not been established; the available source material contains no evidence that AI played a role in these specific attacks.
Investigations and Store Recovery
Belgium’s federal prosecutor is investigating, while affected retailers and refrigeration specialists are working to contain incidents and assess equipment and food losses. Authorities and companies may provide more precise counts as they review individual sites. The cited reports do not give a public timetable for the investigations or a confirmed date for a complete accounting of damage.
Businesses and security teams will be watching for official technical findings, including whether investigators confirm a shared method across countries and what changes are made to exposed controllers. Until authorities release those findings, the reported resemblance to the French wave is a meaningful lead, not proof of common responsibility.
Key Questions
How many stores were affected?
Reports cited by BleepingComputer put the figure at more than 115 stores across at least six countries. Counts differ among outlets, and Finnish authorities and Kesko also reported problems, so there is not yet a single confirmed total.
What happened to the refrigeration systems?
Sabcobel said evaporators were remotely switched into defrost mode, causing some refrigeration equipment to stop cooling or produce heat. Reported temperatures varied between stores.
Has anyone been identified as responsible?
No. The source material reports no public claim of responsibility or attribution. Belgium’s federal prosecutor has opened an investigation.
Was AI used in the attacks?
That has not been established. Although Belgium’s cyber centre has warned generally that some attacks involve AI, no cited source says AI was used in this refrigeration incident.
Are the incidents linked to the French attacks in October?
Sabcobel described the reported method as the same as the one used in France, where refrigeration systems were affected in October. That is a reported similarity; investigators have not confirmed a shared attacker.
Source: ThorstenMeyerAI.com
