🔍 Read the full analysis: Understanding AI Amid Attacks On Europe’s Supermarket Cooling Systems on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Retailers and authorities reported cyberattacks affecting supermarket refrigeration systems in several European countries overnight on November 1–2. The attacks reportedly involved internet-accessible controllers switched into defrost or heating modes; the exact store count, perpetrator and any use of AI remain unconfirmed.
Cyberattacks on supermarket refrigeration systems disrupted stores in at least six European countries overnight on November 1–2, with a reported total of more than 115 affected locations. Retailers and installers said attackers remotely changed settings on some cooling controllers, threatening or spoiling food; authorities have not identified who was responsible or confirmed that artificial intelligence was used.
Reports from Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia describe refrigeration units switched into defrost or heating modes. Finnish authorities and retailer Kesko also reported temperature problems at a few smaller stores. The accounts were compiled by outlets including BleepingComputer, The Record and national broadcasters; the reported totals and store lists differ, so the precise scale is not settled.
Retailers described impacts ranging from partially functioning units to freezers that stopped cooling or began generating heat. Carrefour Belgium said 15 of its 700 stores were affected, while Coop Sweden reported problems at seven of its more than 800 stores. Ahold Delhaize reported an IT incident affecting several dozen stores; BleepingComputer put the number at about 40 in Belgium and Luxembourg. Other reports included 13 SuperValu stores in Ireland and at least 17 businesses in the Netherlands, mostly butchers and neighbourhood shops, according to a Danfoss spokesperson cited by NOS.
Some businesses reported losses, but the amount is not known across the affected countries. A Proxy Delhaize store in Hoepertingen estimated that food worth at least €60,000 had to be discarded after its freezers reached 15°C, according to Het Belang van Limburg as cited by VRT NWS. A butcher in Hove reported throwing away hundreds of kilos of food. In Antwerp, De Laet & Van Haver said it detected the tampering early enough to stop its systems, VRT reported.
Belgian installer Sabcobel said technicians began disconnecting installations from about 1 a.m. Its chief executive, Stephan Moelans, told Belgian media that the company itself had not been hacked: the internet-reachable controllers at stores were attacked directly. He said about 20 of the several hundred installations Sabcobel manages in Belgium were affected. The Belgian federal prosecutor has opened a criminal investigation.
Europe • Retail infrastructure • Incident brief
Understanding AI Amid Attacks on Europe’s Supermarket Cooling Systems
A reported wave of remote tampering disrupted refrigeration across several countries. AI involvement remains unconfirmed; the clearest concern is exposed controllers that can affect real-world operations.
01 / Reported footprint
One night, multiple local reports
Retailers and installers described refrigerators or freezers placed into defrost or heating modes. Reports identify a broad footprint, but counts are not independently reconciled.
15 Carrefour stores
Carrefour Belgium reported affected locations; Sabcobel said about 20 of its managed installations were hit.
7 Coop stores
Coop reported refrigeration problems at seven of more than 800 stores.
Several dozen
Ahold Delhaize reported an IT incident; one account estimated about 40 stores.
13 SuperValu stores
Reported refrigeration disruptions affected locations in the chain.
At least 17 businesses
Mostly butchers and neighbourhood shops, according to a Danfoss spokesperson cited by NOS.
Finland • Estonia
Finnish authorities and Kesko described temperature issues at a few smaller stores; Estonia also appeared in country reports.
One shop-level estimate: a Proxy Delhaize store in Hoepertingen said food worth at least this amount had to be discarded after freezers reached 15°C. This is not a regional loss total.
02 / How the disruption can happen
A control setting can become a physical problem
The reported method centers on internet-reachable refrigeration controllers. A separate controller can affect store equipment even when a corporate network compromise has not been reported.
Reachable interface
Some controllers or remote management interfaces were reportedly exposed online.
Settings changed
Accounts describe units switched into defrost or heating modes.
Temperature rises
Freezers may stop cooling or generate heat, putting perishable stock at risk.
Store response
Teams isolate equipment, restore safe settings and assess food for disposal.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— AHOLD DELHAIZE
03 / What is known—and what is not
Separate the evidence from the open questions
The reporting points to an operational technology incident. It does not establish a confirmed AI role, a responsible group, or a final count.
Reported evidence
Multiple retailers and installers described refrigeration disruptions. Some controllers were reportedly changed remotely, and a Belgian criminal investigation has opened.
Cooling systems were affected; some businesses reported food losses or interruption.
Not established
No perpetrator has been identified in the supplied reporting. No cited retailer, investigator or authority attributes these attacks to AI.
AI use, the final site count, total financial loss and any customer data access.
| Question | What reports say | Status |
|---|---|---|
| What was targeted? | Refrigeration controllers and store cooling equipment | ● Reported |
| Was AI used? | No incident-specific attribution in cited accounts | ? Unknown |
| Who was responsible? | No perpetrator named; investigation underway | ? Unknown |
| Were payment systems or data breached? | Not established by available accounts | ? Unknown |
04 / Operational context
Exposure can vary from store to store
Reports point to differences in equipment connection and management. These examples add context, but do not prove that any single ownership model caused the incidents.
Central safeguards differ
Colruyt said its stores were not affected. Reports described some impacted locations as outside central networks or safeguards, including independent operators with their own refrigeration equipment.
Small businesses faced direct costs
A butcher in Hove reported discarding hundreds of kilos of food. In Antwerp, De Laet & Van Haver said early detection let it stop its systems.
05 / Related reporting
A French wave was reported in October
Belgian installer Sabcobel described the method as similar to the French incidents. This is a reported technical resemblance, not proof that every event shared an operator or exact access route.
France
Refrigeration systems at hundreds of supermarkets were reported affected overnight.
Warning issued
CERT-FR warned that remote management interfaces were exposed online contrary to recommended practice.
New reports
Retailers across Europe reported refrigeration issues; investigators have not published findings here.
06 / What comes next
Investigation, recovery, and equipment review
Authorities and companies will need to establish how controllers were accessed, whether incidents are connected, and which systems require remediation.
Trace access
Determine which interfaces and devices were reached and whether national incidents share an operator.
Verify safe temperatures
Check affected equipment, restore operating settings and assess food condition.
Reduce exposure
Review internet-facing remote management and equipment safeguards. Public reporting gives no Europe-wide remediation plan yet.
Food Losses and Exposed Store Systems
The incidents show how a cyberattack on building equipment can cause immediate physical and commercial damage without disrupting checkout systems or stealing customer data. Refrigeration failures can put perishable food at risk, force stores to discard stock and interrupt operations. The reported €60,000 loss at one Belgian shop illustrates the potential cost, but it is a store-level estimate, not a regional total.
Reports suggest that smaller and independently operated locations were particularly exposed. Colruyt said its own stores were not affected, while about five Spar outlets operated by independent entrepreneurs, with their own refrigeration equipment, were reportedly hit. ICA and Kesko also described affected locations outside their central networks or safeguards. Those examples do not establish that every independent store is vulnerable, but they point to differences in how equipment is connected and managed.
For retailers, food businesses and facilities operators, the episode is a warning about internet-connected controllers that manage essential services. The immediate concern is operational: keeping equipment secure and maintaining safe temperatures. The broader concern is that an exposed control interface may let an intruder change settings remotely, even when the business’s main corporate network has not been reported compromised.
Products Worth Considering
Samsung 49-inch Odyssey OLED G9 (G91SD) Dual QHD Curved Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
Dell UltraSharp 27 Thunderbolt Hub Monitor (U2726DER)
As an affiliate, we earn on qualifying purchases.
A Similar French Attack in October
The November incidents resemble a wave reported in France on the night of October 11–12, when refrigeration systems at hundreds of supermarkets were affected. The Paris prosecutor’s office counted about 700 victims, according to the source material. French cybersecurity authority CERT-FR warned on October 12 that remote management interfaces for refrigeration controllers were exposed online contrary to recommended practice, and said attack campaigns were probably still ongoing.
Belgian installer Sabcobel described the method in the latest incidents as the same as in France: evaporators were remotely switched into defrost mode. Finnish reporting said attacks targeted specific Danfoss models. These details support a reported technical resemblance, but public accounts do not provide a full forensic analysis establishing that every country’s incident had the same operator or exact method.
The two waves also highlight a difference between centrally managed chain stores and locations running separate or older equipment. Several retailers said affected shops sat outside central systems or safeguards. That is relevant context, not proof that a particular ownership model caused the attacks.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize
Who Attacked the Controllers?
No perpetrator has been identified, and no group has publicly claimed responsibility in the supplied reporting. Belgium’s cyber centre has warned that the attacker may never be identified. The Belgian federal prosecutor’s investigation is under way, but no findings have been reported here.
AI involvement is unconfirmed. The source material says Belgium’s cyber centre has warned more generally about a rise in attacks partly involving AI. That does not show that AI was used to carry out, plan or support these refrigeration attacks. No cited retailer, investigator or authority has attributed this incident to AI.
The number of affected sites also remains uncertain. Reports use different counts and country lists, while temperatures and damage varied by location. The available accounts do not establish a final total, the full financial cost, whether every incident used the same access route, or whether any customer or employee data was accessed. The reported evidence points to refrigeration controllers, not a confirmed compromise of retail payment systems.
Investigations and Store Recovery
Belgium’s criminal investigation and technical reviews by retailers, installers and cybersecurity authorities are the next major steps. Investigators will need to establish how the controllers were accessed, whether the separate national incidents share an operator, and which devices or internet-facing interfaces were affected. No public timetable for findings is included in the source material.
Retailers will also need to check affected equipment, restore safe operating settings and determine what food must be discarded. The reports do not specify a Europe-wide remediation plan or confirm that all affected systems have been secured. Until authorities or companies publish more detail, the scope, cause and attribution remain developing.
Key Questions
What happened to the supermarket refrigeration systems?
Retailers and installers reported that attackers remotely changed settings on some refrigeration controllers, switching units into defrost or heating modes. The result ranged from reduced cooling to freezers generating heat.
How many stores were affected?
BleepingComputer reported more than 115 stores across at least six countries. Finland also reported problems at a few smaller stores, and published store counts differ, so the final total is not confirmed.
Is there evidence that AI was used?
No AI role has been confirmed in these attacks. A general warning about AI-related cyber threats is not evidence that AI was used in this specific incident.
Who was responsible for the attacks?
No attacker has been identified publicly, and no group has claimed responsibility in the reporting provided. Belgian authorities have opened a criminal investigation.
Were customer payment systems affected?
The reports describe attacks on refrigeration controllers and do not confirm that payment systems or customer data were affected. The full technical scope is still under investigation.
Source: ThorstenMeyerAI.com
