🔍 Read the full analysis: Can AI Help Explain The Second Wave Of Refrigeration Attacks? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Refrigeration systems at more than 115 stores in at least six countries were reportedly disrupted overnight from November 1 to 2, 2026. The reported method resembles an October attack in France, but no perpetrator has been identified and there is no evidence that AI was used.
More than 115 stores in at least six European countries reported overnight disruptions to refrigeration systems on November 1–2, after attackers apparently changed the settings of internet-connected controllers. The incident resembles a wave that affected French supermarkets in October, but authorities have not identified who was responsible or established whether AI played any role.
Reports compiled by BleepingComputer described incidents in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish authorities and retailer Kesko also reported temperature anomalies at a few smaller stores, making the full country and store totals uncertain. The reported impacts varied: systems were switched off, stopped cooling properly or began producing heat.
In Belgium, refrigeration installer Sabcobel chief executive Stephan Moelans said technicians began disconnecting installations at about 1 a.m. He told Belgian media that the affected store controllers were reachable over the internet and that Sabcobel itself had not been hacked. About 20 of the several hundred Belgian installations his company manages were affected, he told The Record.
Retailers reported damage and disruption at individual sites. A Proxy Delhaize store in Hoepertingen reported freezers at 15 °C rather than about minus 22 °C and estimated that at least €60,000 of food had to be discarded, according to Het Belang van Limburg as cited by VRT NWS. Other stores reported less severe effects or shut systems down before food was lost.
Cyber incident · Europe · Nov 1–2, 2026
Can AI Help Explain the Second Wave of Refrigeration Attacks?
More than 115 stores in at least six countries reportedly experienced disrupted refrigeration overnight. The method resembles an October attack in France, but investigators have not identified a perpetrator or found evidence that AI was involved.
01 / Incident snapshot
When cooling controls become a cyber risk
Reports describe operational disruption at individual locations, even where checkout systems or a retailer’s central network were not affected.
Reported mechanism
Controller settings changed
Attackers apparently altered internet-connected refrigeration controls. Some units stopped cooling, entered defrost mode or began producing heat.
Store impact
Stock and service at risk
Failed cooling can spoil perishables, require disposal or force a store to shut equipment down while technicians respond.
Unsettled picture
Totals may change
Reports differ, especially for Belgium. Finnish authorities and Kesko also noted anomalies at a few smaller stores.
02 / What was reported
Disruption varied from site to site
Examples illustrate the range of reported effects; they do not establish a complete loss tally.
Belgium · Sabcobel
Installations affected
Chief executive Stephan Moelans said technicians began disconnecting installations around 1 a.m. and that about 20 of the several hundred Belgian installations his company manages were affected.
Hoepertingen · freezer report
Food loss estimate
A Proxy Delhaize store reportedly found freezers at 15 °C instead of about −22 °C and estimated at least €60,000 of food had to be discarded.
Carrefour Belgium
Stores reported affected
The retailer said 15 stores in Flanders and Wallonia were affected. Other locations reported milder effects or shut systems down before food was lost.
“The reported mechanism was ‘exactly the same’ as in France.”
Stephan Moelans · Sabcobel chief executive
03 / France to November
A repeated technique, an unproven connection
Technical resemblance can guide investigators. It cannot by itself identify the people behind an attack or prove two events share a cause.
Reported store counts
Illustrative report totals, not a like-for-like measure. France’s figure is attributed to the Paris prosecutor’s office; November estimates vary and may change.
What links the reports?
On October 11–12, refrigeration systems at hundreds of French supermarkets were reportedly switched into defrost mode. CERT-FR warned that remote management interfaces were exposed online contrary to good practice.
Sabcobel described the November mechanism as the same. Reports say some manufacturers had issued updates months earlier, but the available material does not show which updates applied or whether affected stores installed them.
Some locations may have used equipment outside chain-wide safeguards.
ICA said affected stores operated outside its central network; Colruyt said its stores were unaffected while some independent Spar sites were affected.
The same reported behavior does not establish the same attacker or a link between campaigns.
04 / Traceability
What investigators still need to establish
Belgium’s federal prosecutor has opened a criminal investigation. Retailers and technicians are assessing equipment and restoring refrigeration.
How was each controller reached, and which interfaces were exposed?
Did affected sites share equipment, vulnerabilities or security gaps?
Were the November events linked to the October French campaign?
Who was responsible, and was AI used at any stage?
05 / Key questions
What we know—and what remains open
Was AI used?
That has not been established. The supplied reports contain no evidence that AI helped select targets, gain access or change settings. A general warning about AI-related cyberattacks does not confirm its use here.
How many stores and countries?
BleepingComputer reported more than 115 stores in at least six countries: Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish incidents were also reported, so totals remain unsettled.
Was France part of the same campaign?
The reported method resembles the October French attack, and Sabcobel called the mechanism the same. Investigators have not publicly established a shared attacker or connection.
What caused the access?
CERT-FR previously warned that remote management interfaces for refrigeration controllers were exposed online. The available reports do not establish how each November controller was accessed.
Risks to Food and Store Operations
The incident shows how a cyberattack on building equipment can cause direct operational damage without disrupting a retailer’s checkout systems or central network. When cooling fails, perishable stock can be lost, stores may need to close or discard products, and technicians must respond quickly to restore safe temperatures.
Retailers’ reports suggest that some affected locations were independently operated or used equipment outside a chain’s central safeguards. ICA said its affected stores operated outside its central network; Colruyt said its own stores were not affected while some independently operated Spar sites were. These accounts point to a possible security gap at smaller or separately managed locations, though they do not establish why any particular system was vulnerable.
The event also matters because it followed a similar reported attack in France less than three weeks earlier. Repetition raises questions about whether exposed equipment was secured after the earlier incident, but the available reports do not establish which systems were shared between the cases or whether the same people carried them out.
Popular right now
Shark HydroVac MessMaster Cordless Wet Dry Vacuum and Mop Combo, AW261
Ninja Crispi Glass Air Fryer (Stone) – 4‑in‑1
Dyson Car+Boat Cordless Handheld Vacuum
As an affiliate, we earn on qualifying purchases.
From France to a Second Wave
On the night of October 11–12, refrigeration systems at hundreds of French supermarkets were reportedly switched into defrost mode. France’s CERT-FR warned on October 12 that remote management interfaces for refrigeration controllers were exposed online contrary to good practice, and said attack campaigns were probably still ongoing. The Paris prosecutor’s office counts about 700 victims, according to the supplied reporting.
The Belgian installer Sabcobel said the latest incidents used the same mechanism as the French wave: remotely changing refrigeration equipment into defrost mode. That comparison describes the reported technical behavior; it does not prove that the attacks had the same source or operators. BleepingComputer’s tally puts the latest wave at more than 115 stores across six countries, while other outlets give different counts, particularly for Belgium.
Some manufacturers had issued updates months before the new incidents, according to the source report. However, the supplied material does not specify which updates applied to each affected controller, whether stores installed them, or whether an update alone would have prevented the access.
“The reported mechanism was “exactly the same” as in France.”
— Stephan Moelans, Sabcobel chief executive, as quoted by Belgian media
The Attacker and AI Link
No group or individual has been identified, and the supplied reports describe no claim of responsibility. Belgium’s federal prosecutor has opened a criminal investigation. Belgium’s cyber centre has warned that the attacker may never be identified.
There is also no reported evidence that AI was used in either refrigeration wave. Belgium’s cyber centre has warned more generally about a rise in attacks partly involving AI, but that broad warning is not evidence about this incident. AI could be a question for investigators, but the known reports do not show that it helped select targets, gain access or change controller settings.
The totals remain unsettled. Reports differ over the number of affected Belgian stores and how to count incidents in Finland and other countries. Temperatures also varied by site, from reports of 50 °C in some locations to 15 °C in Hoepertingen. It is not clear how many stores lost food, how long systems were affected, or whether all reported incidents stemmed from one campaign.
Investigations and Store Repairs
Belgium’s criminal investigation is underway, while retailers and technicians continue to assess affected equipment and restore refrigeration. The supplied reports do not give a timetable for identifying the attacker or a confirmed public total of financial losses.
For a clearer account of the incident, investigators will need to establish how each controller was accessed, whether the affected systems shared a vulnerability or exposure, and whether the November events were connected to the French attack. Retailers may also need to clarify which sites installed available software updates and what safeguards applied to independently operated stores. Until those findings are published, the scale, common cause and any role for AI remain unresolved.
Key Questions
What happened to the supermarket refrigeration systems?
Reports say attackers remotely changed refrigeration controller settings at stores overnight from November 1–2, 2026. Some units stopped cooling or began producing heat; effects varied by location.
How many stores and countries were affected?
BleepingComputer reported more than 115 stores in at least six countries. Reports also describe a few affected Finnish stores, and published totals differ, so the final count is not settled.
Was AI used in the attacks?
That has not been established. The supplied reports contain no evidence that AI was involved. A general warning about AI-related cyberattacks does not confirm its use in this case.
Are the November incidents linked to the attack in France?
The reported method resembles the October attack in France, and Sabcobel described the mechanism as the same. That similarity does not prove a shared attacker; investigators have not publicly established a connection.
Who is investigating, and what is known about the cause?
Belgium’s federal prosecutor has opened a criminal investigation. France’s CERT-FR previously warned that remote management interfaces for refrigeration controllers were exposed online, but the supplied reports do not establish the access route for every affected store in the latest wave.
Source: ThorstenMeyerAI.com
