🔍 Read the full analysis: Could AI Raise New Questions About Refrigeration Security? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Refrigeration systems at more than 115 stores across at least six European countries were reportedly disrupted overnight on Nov. 1–2. The method appears to match an October attack in France, but no suspect has been identified and there is no evidence that AI was used.
More than 115 stores in at least six European countries reported refrigeration problems overnight on Nov. 1–2 after attackers apparently accessed internet-connected refrigeration controllers and switched some equipment into defrost or heating modes. The incidents resemble a wave that hit French supermarkets in October, but authorities have not identified those responsible, and there is no confirmed evidence that AI was involved.
Retailers and media reported incidents in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia; Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller stores. The exact total remains unsettled. BleepingComputer counted more than 115 stores across six countries, while other reports gave different figures, including more than 50 affected stores in Belgium alone.
In Belgium, refrigeration installer Sabcobel chief executive Stephan Moelans told local media that technicians began disconnecting installations around 1 a.m. He said the controllers were reached directly through the internet and that the method was “exactly the same” as in France. Sabcobel itself was not hacked, he said. About 20 of the several hundred installations his company manages in Belgium were affected.
Reported impacts varied. A Proxy Delhaize in Hoepertingen said its freezers reached 15 °C rather than about minus 22 °C and estimated that at least €60,000 worth of food had to be discarded, according to local reporting cited by VRT NWS. A butcher in Hove reported throwing away hundreds of kilos of food. Some businesses noticed the changes in time to stop their systems; others reported spoiled stock. Store counts and temperatures differ among accounts, and the full damage total has not been established.
Could AI Raise New Questions About Refrigeration Security?
Reported intrusions disrupted refrigeration at more than 115 stores across at least six European countries. The incidents point to internet-connected controllers; investigators have not identified a culprit, and there is no confirmed evidence AI was used.
A control change with real-world consequences
Reports describe refrigeration equipment switched into defrost or heating modes overnight on Nov. 1–2.
Spread across stores
Reports named Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish authorities and Kesko also noted anomalies at a few smaller stores.
Some stock was lost
A Proxy Delhaize in Hoepertingen reportedly found freezers at 15°C instead of about −22°C, with at least €60,000 of food discarded. A butcher in Hove reported hundreds of kilos lost.
No final tally
Some businesses caught changes in time; others reported spoiled stock. Store counts, temperatures and total losses differ across accounts.
From reachable controller to store disruption
Refrigeration controls are operational equipment: changing settings can affect goods and business continuity.
Remote access
Reports point to controllers reachable through the internet.
Settings changed
Some systems were reportedly set to defrost or heat.
Temperature rises
Specific locations reported readings from 15°C to 50°C.
Loss or response
Stores isolated equipment, called technicians or discarded food.
Equipment outside central networks may be harder to oversee
Several retailers said affected shops had separate equipment or operated outside their central systems.
Separate systems
The company said affected Spar shops had their own refrigeration equipment.
Outside central network
ICA identified at least four Swedish stores operating outside its central network.
A visibility gap to review
Separately managed equipment can complicate monitoring. These reports do not show that all independent stores are exposed or that central networks were breached.
October reports offer context, not proof of a shared actor
The November method was described as matching the French incidents, but attribution remains open.
“The method was exactly the same”
Stephan Moelans · Sabcobel, as reported by local mediaHundreds of supermarkets affected
The Paris prosecutor’s office put the number of victims at about 700. CERT-FR warned that remote-management interfaces for refrigeration controllers had been exposed online contrary to good practice, and said campaigns were probably still ongoing.
What reports establish—and what they do not
Separate confirmed reporting from unanswered questions as investigations continue.
Bars show how firmly the source material supports each point; they are qualitative, not measured probabilities. Belgian investigators have opened a criminal investigation. No perpetrator has been publicly identified or claimed responsibility.
Investigations and repairs continue
No common final count or full technical report has been announced.
The key unknowns
Investigators may clarify which controller models were targeted, how access was obtained, how many locations suffered damage and whether affected systems have been secured. The fixes needed at each site have not been confirmed publicly.
Keep the claims connected to the evidence
Reported facts point to equipment security and business impact; attribution and AI claims remain unresolved.
Risks to Stores Outside Central Networks
The reported incidents show how a cyber intrusion into building equipment can cause physical disruption and direct financial losses, even without an attack on a retailer’s checkout or customer database. When refrigeration fails, perishable food can become unsafe or unsellable, and stores may need to shut equipment down while technicians investigate.
Several retailers said affected locations were independently operated or outside their central systems. Colruyt said the affected Spar shops had their own refrigeration equipment, while ICA identified at least four affected Swedish stores operating outside its central network. Those accounts point to a possible security gap around older or separately managed equipment; they do not establish that every independent store is exposed or that central networks were breached.
The episode also renews questions about the security of internet-connected industrial controls. A controller used to regulate cold rooms is not an ordinary office computer: changing its settings can affect goods and business operations. The immediate concern is the reported disruption and food loss, while the wider lesson depends on what investigators confirm about access, affected models and any safeguards that failed.
Products Worth Considering
LG 24G414B-B 24-Inch UltraGear Full HD IPS Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Attack in October
The reported November incidents follow a disruption in France during the night of Oct. 11–12, when authorities and media reported attacks on refrigeration systems at hundreds of supermarkets. The Paris prosecutor’s office put the number of victims at about 700. France’s national cyber response team, CERT-FR, warned on Oct. 12 that remote-management interfaces for refrigeration controllers had been exposed online in ways that did not follow good practice. It said attack campaigns were “probably still ongoing.”
Belgian installer Sabcobel has described the November method as matching the French incidents, but that does not by itself prove that the same person or group carried out both waves. CERT-FR’s earlier warning concerned exposed interfaces; public reporting on the newer incidents likewise points to internet-reachable controllers. The source material does not establish the precise entry path for every affected store or whether all incidents involved the same controller model.
Reports also differ on how many locations were affected and how high temperatures rose. Accounts include readings of 50 °C in some locations and 15 °C or 17 °C in others. These are reports tied to particular stores or equipment, not a single temperature reached across the affected countries. The available figures should be treated as developing counts rather than a final tally.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Who Was Behind the Intrusions?
No perpetrator has been publicly identified, and there has been no claim of responsibility. Belgium’s federal prosecutor has opened a criminal investigation. The Belgian cyber centre has said the attacker may never be identified. It is also not clear whether the French and November incidents were carried out by the same party, whether all affected stores were accessed in the same way, or how many locations ultimately suffered damage.
AI’s role is also unconfirmed. Belgium’s cyber centre has warned more generally about a rise in attacks partly involving AI, but no cited authority, retailer or investigator has said AI was used in these incidents. The source material provides no evidence that AI generated the attack, selected targets or operated the controllers. Treating AI as a cause would go beyond what has been reported.
The final store count, total food losses, duration of any outages and the security status of affected equipment remain unclear. Reports identify exposed remote-management interfaces and particular equipment models as concerns, but they do not provide a complete technical account of the intrusions or establish which individual security controls were missing or bypassed at each site.
Investigations and Repairs Continue
Belgian investigators are examining the incidents, while retailers and refrigeration technicians have been working to isolate affected equipment and restore safe operation. Authorities and companies have not announced a common final tally or a timetable for a full technical report. Further statements may clarify which controller models were targeted, how access was obtained and whether the affected systems have been secured.
France’s earlier warning said campaigns were probably still underway, and the November reports indicate that the risk had not clearly ended by then. Operators of refrigeration and other building systems may review whether remote interfaces are exposed and whether equipment outside central company networks receives security updates and monitoring. The specific fixes needed at each site have not been confirmed publicly.
For now, the confirmed picture is a cross-border disruption with reported food losses and ongoing investigations—not an attributed campaign or a proven AI-enabled attack. The next meaningful developments are likely to be official findings on responsibility and access, updated retailer counts, and information on whether further incidents or technical mitigations are reported.
Key Questions
What happened to the supermarket refrigeration systems?
Reports say attackers accessed some refrigeration controllers and switched equipment into defrost or heating modes, causing temperature problems in stores overnight on Nov. 1–2.How many stores were affected?
BleepingComputer reported more than 115 stores across at least six countries. Counts differ among reports, and Finland also reported problems at a few smaller stores, so the final total is not yet clear.Has anyone said who was responsible?
No. Belgium’s federal prosecutor has opened an investigation, but no perpetrator or group has been publicly identified and no one has claimed responsibility.Was AI used in the attacks?
That has not been established. Although Belgium’s cyber centre has warned generally about attacks partly involving AI, no source cited in the reporting says AI played a role in these incidents.Were customers or payment systems affected?
The reports describe refrigeration disruptions and possible food losses. They do not confirm that customer data or payment systems were affected.Source: ThorstenMeyerAI.com
