🔍 Read the full analysis: What Role Does AI Play In Attacks On Supermarket Refrigeration? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Refrigeration systems at more than 115 stores across at least six European countries were reportedly disrupted overnight on Nov. 1–2, with reports also emerging from Finland. Investigators have not identified the attacker, and no evidence has been made public that AI was used; the reported method involved remotely accessible refrigeration controllers.
More than 115 supermarkets and other businesses across at least six European countries reported disruptions to refrigeration systems overnight from Nov. 1 to 2, according to media and retailer accounts compiled by BleepingComputer. The reported attacks remotely changed refrigeration settings; no source has confirmed that artificial intelligence was used, and the attacker has not been identified.
Reports came from Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, with Finnish authorities and retailer Kesko also reporting anomalies at a few smaller stores. The total remains an estimate: outlets cite different store counts and affected locations, and some reports cover businesses beyond supermarkets. In Belgium, for example, Ahold Delhaize said an IT incident affected refrigeration in several dozen stores, while Carrefour Belgium said 15 of its 700 stores were affected. Coop in Sweden reported problems at seven stores.
Belgian refrigeration installer Sabcobel said evaporators were remotely switched into defrost mode, describing the mechanism as the same as in attacks reported in France in October. Its chief executive, Stephan Moelans, told Belgian media that technicians began disconnecting installations at about 1 a.m. He said roughly 20 of the several hundred installations his company manages in Belgium were affected, and that Sabcobel itself had not been hacked: the stores’ internet-reachable controllers were targeted directly.
The consequences varied by site. VRT NWS reported that a Delhaize Proxy store in Hoepertingen recorded freezer temperatures of 15 °C and estimated that at least €60,000 of food had to be discarded. A butcher in Antwerp detected interference in time to stop its systems, while a shop in Hove reportedly discarded hundreds of kilos of food. Swedish store manager Rickard Nilsson told TV4, as quoted by The Record, that staff could not adjust the temperatures and that heat was being blown into freezers. The reports do not establish a single loss total across affected businesses.
Risks to Food and Store Operations
Refrigeration is a form of operational technology: it controls physical equipment and can affect food safety, stock and business continuity. A remote change to controller settings can turn a cyber incident into a direct operational problem, even without evidence that attackers entered a store or disrupted its payment systems. The reported food losses show how quickly a settings change can become costly, though the scale of damage varies from store to store.
The incidents also draw attention to systems that may sit outside a retailer’s central IT protections. Several affected retailers said the stores involved were independently operated or used equipment outside their central networks. That does not establish why each system was vulnerable, but it points to a practical challenge: chains may have uneven visibility and security across franchisees, local businesses and older equipment.
For readers asking specifically about AI’s role, the evidence supplied so far supports no conclusion that AI carried out or enabled these attacks. AI can be relevant to cyber threats generally, but a warning about broader AI-assisted attacks is not proof that it was involved in this incident. The confirmed reporting describes remote access to refrigeration controllers, not an AI technique.
Products Worth Considering
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar French Incident in October
The Nov. 1–2 reports followed a refrigeration attack wave in France on the night of Oct. 11–12. France’s CERT-FR warned that remote management interfaces for refrigeration controllers were exposed online in ways that did not follow good security practice. The agency said attack campaigns were “probably still ongoing.” The Paris prosecutor’s office counted about 700 victims in the French incident, according to the source material.
Sabcobel said the mechanism in Belgium matched the French case. That comparison is an installer’s account, not a public forensic report establishing that every affected country had the same entry point or operator. The Finnish National Cyber Security Centre said attacks in Finland and elsewhere targeted specific Danfoss models, according to Finnish news agency STT. The available accounts do not provide a complete technical analysis across all affected locations.
AI entered the discussion because Belgium’s cyber centre has warned of a general rise in attacks partly involving AI. That broader warning is separate from evidence about this event: none of the cited retailers, investigators or technical authorities has said AI was used in the refrigeration incidents. No suspect or group has claimed responsibility, according to the source material.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Attribution and AI Evidence
Who carried out the attacks remains unknown. Belgium’s federal prosecutor has opened a criminal investigation, and the country’s cyber centre has warned that investigators may never identify the attacker. No group has claimed responsibility in the material provided.
The overall number of affected businesses is also unsettled. BleepingComputer reported more than 115 stores across six countries, while other outlets gave different counts for Belgium and reported additional Finnish cases. These figures may cover different business types and reporting periods. Temperatures and losses likewise differed by location, and no consolidated damage assessment has been published.
Most importantly for the question of AI, there is no confirmed evidence that AI was used to find exposed controllers, gain access or change settings. The source material does not establish whether the incidents were coordinated across countries, whether all used the same access route, or whether any customer or employee data was accessed.
Investigations and Security Reviews
Belgium’s criminal investigation is under way, while affected retailers and refrigeration specialists are responding to incidents and checking systems. Authorities and companies may release further findings about the controllers, exposure to the internet and the extent of food losses. The source material does not give a timetable for those updates.
France’s CERT-FR had already warned that exposed remote-management interfaces created a risk and said campaigns might still be ongoing. Further technical guidance or incident findings could clarify whether the latest cases share the French attack’s method. Until investigators publish more evidence, claims about the perpetrator, coordination or AI use should be treated as unconfirmed.
Key Questions
Was AI used in the supermarket refrigeration attacks?
That has not been confirmed. The cited retailers, investigators and technical authorities have not said AI was used in the Nov. 1–2 incidents. Belgium’s cyber centre has discussed AI in connection with broader cyberattack trends, which is not evidence of AI involvement here.
What did the attackers reportedly do?
Installer Sabcobel said refrigeration evaporators were remotely switched into defrost mode, matching the method it described in the French incidents. Authorities have warned that remote-management interfaces for refrigeration controllers were exposed online, but a complete technical account of every affected site is not available.
How many businesses were affected?
BleepingComputer reported more than 115 stores in at least six countries, with Finnish cases also reported by authorities and Kesko. Counts vary among outlets and include some non-supermarket businesses, so there is not yet one settled total.
Who is responsible?
No attacker has been identified publicly in the source material, and no one has claimed responsibility. Belgium’s federal prosecutor has opened a criminal investigation.
Did every affected store lose its food?
No. Reports describe different outcomes: some stores detected changes in time, while others reported spoiled stock or discarded food. No consolidated loss estimate for all affected businesses has been published.
Source: ThorstenMeyerAI.com
