🔍 Read the full analysis: What The Freezer Attacks Reveal About AI Security Concerns on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Refrigeration controls at more than 115 stores and other businesses across at least six European countries were reportedly switched into defrost or heating mode overnight on November 1–2. Reports point to internet-accessible controllers, but the attacker’s identity and any use of AI remain unknown.
Refrigeration systems at more than 115 stores and other businesses across at least six European countries were reportedly disrupted overnight on November 1–2, with some controllers switched into defrost or heating mode. Retailers and media reports describe food losses and equipment outages; officials have not identified who was responsible, and there is no confirmed evidence that AI was used.
The reported incidents affected businesses in Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, with Finnish authorities and retailer Kesko also reporting anomalies at a few smaller stores. The exact total is unsettled: BleepingComputer reported more than 115 affected locations, while other accounts give different figures, particularly for Belgium. These counts draw on company statements and media reporting and may not use the same definitions or reporting cutoff.
Retailers described disruptions to refrigeration units, rather than a confirmed compromise of their broader corporate networks. Ahold Delhaize said it had identified an “IT incident affecting the refrigeration systems in several dozen stores.” Carrefour Belgium said 15 of its 700 stores were affected, while ICA in Sweden reported at least four stores and Coop said seven locations had experienced problems. Coop described the situation as “currently contained and under control.”
Belgian refrigeration installer Sabcobel said the reported method matched the earlier French incidents: evaporators were remotely switched into defrost mode. Its chief executive told Belgian media that technicians began disconnecting installations around 1 a.m. and that Sabcobel itself had not been hacked. Local reports described freezers reaching temperatures well above normal; one Belgian shop estimated it would discard at least €60,000 in food. The scale of damage across all affected businesses has not been established.
Connected systems · Europe · November 2026
What The Freezer Attacks Reveal About AI Security Concerns
Refrigeration controls at more than 115 businesses were reportedly switched into defrost or heating mode overnight. The disruption is reported; the attacker’s identity and any use of AI remain unknown.
01 / What was reported
A targeted system with real-world consequences
Retailer statements and media accounts describe refrigeration disruption. Reported counts vary by source, cutoff, and definition.
Across Europe
More than 115 locations were reported across Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Finland also reported anomalies at a few smaller stores.
Cold chain disrupted
Some controllers were reportedly switched to defrost or heating mode. Businesses described outages and food losses; the total damage has not been established.
Not a confirmed network breach
Reports focus on refrigeration units. They do not establish compromise of retailers’ broader corporate networks or identical equipment at every site.
02 / Why the controls matter
Small settings changes can scale into business disruption
Specialised building systems can affect operations even when central IT is not reported to be involved.
Internet exposure
Remote-management interfaces may be reachable beyond the intended operators.
Unauthorised change
Reported controllers were switched from normal cooling into defrost or heating.
Operational impact
Freezers can warm, risking inventory, store operations, and equipment continuity.
Local security gap
Third-party, locally managed, or older equipment can sit outside central safeguards.
03 / Context and comparison
A similar wave had been reported in France
Similarity offers context, but it does not prove a shared operator, access route, or vulnerability across all affected sites.
France · October 11–12
The Paris prosecutor’s office counted about 700 victims, according to the source material. CERT-FR warned that exposed remote-management interfaces for refrigeration controllers were contrary to good practice.
CERT-FR said campaigns were probably still ongoing. Belgian installer Sabcobel later described the method as “exactly the same”—an attributed assessment, not public proof of common responsibility.
What remains unverified
The source report says manufacturers had issued updates months earlier. Public information does not show which affected sites installed them, whether they would have prevented these incidents, or whether all controllers shared a weakness.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
Ahold Delhaize · retailer statement04 / Attribution and AI
Two important questions remain open
No attacker has been identified, and the source material reports no claim of responsibility. Belgium’s federal prosecutor has opened an investigation; the Belgian cyber centre has cautioned that attribution may prove difficult. No authority or company cited in the reporting has confirmed AI involvement.
05 / What to watch next
Evidence that could clarify the picture
Investigations and site checks are ongoing. Authorities and companies have not announced a final tally or completion date.
Verified technical findings
Whether investigators establish a common cause, access path, or connection between the reported waves.
Confirmed site and loss counts
Comparable figures for affected locations, food spoilage, equipment outages, and financial damage.
Equipment and updates
Which controller models and software versions were involved, and whether recommended protections were applied.
Why Refrigeration Controls Matter
The incidents show how disruption to a specialised building system can have consequences beyond an organisation’s ordinary IT services. When refrigeration controllers are reachable over the internet, unauthorised changes to their settings can put food stocks, business operations and equipment at risk, even if a retailer’s main network is not reported to be affected.
The reported concentration of incidents in smaller or independently operated locations also points to a potential security gap between central corporate safeguards and equipment managed locally. ICA said affected stores operated outside its central network; Colruyt said its own stores were unaffected while some independently run Spar stores had problems. Those statements do not establish a single cause, but they illustrate why companies need to account for third-party, locally managed and older equipment when reviewing connected systems.
AI is part of the broader debate about cyber risks, but it is not a confirmed feature of this case. Belgium’s cyber centre has warned of a general rise in attacks partly involving AI, according to the source report. That warning is separate from evidence about these refrigeration incidents: no authority or company cited in the reporting has said AI was used to find exposed controllers, gain access or change settings.
Products Worth Considering
Samsung 32-inch Odyssey OLED G8 (G80SH) 4K QD-OLED Gaming Monitor
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
Samsung 27-inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Similar Wave in France
The November incidents follow a reported wave in France during the night of October 11–12, 2026. The Paris prosecutor’s office counted about 700 victims, according to the source material. France’s national cybersecurity agency, CERT-FR, warned on October 12 that remote-management interfaces for refrigeration controllers had been exposed online contrary to good practice, and said campaigns were probably still ongoing.
Belgian installer Sabcobel described the mechanism in the later incidents as “exactly the same” as in France. That is an attributed assessment, not public proof that every incident shared an operator or access route. The source report says manufacturers had issued updates months earlier, but it does not establish which affected sites installed them, whether the updates would have prevented these incidents, or whether every affected controller was vulnerable in the same way.
In Belgium, the federal prosecutor has opened a criminal investigation. The Belgian cyber centre has warned that identifying the attacker may prove difficult. The reports so far describe remote access to refrigeration controllers; they do not establish a breach of every retailer’s central IT systems or show that all affected sites had identical equipment or security settings.
““We have identified an IT incident affecting the refrigeration systems in several dozen stores.””
— Ahold Delhaize
Attribution and AI Remain Unclear
No attacker has been identified, and the source material reports no claim of responsibility. Belgium’s criminal investigation is ongoing, while the Belgian cyber centre has cautioned that attribution may not be possible. The reported similarity to the French wave does not by itself establish that the same people carried out both sets of incidents.
It is also unknown whether AI played any role. The reported incidents do not establish what tools, if any, were used by the person or people responsible. The number of affected sites, total financial losses, and extent of food spoilage remain uncertain because company figures differ and reporting covers multiple countries and business types. Public information also does not show which specific controller models or software versions were involved at every site, or whether recommended updates had been installed.
Investigations and Site Checks Continue
Belgium’s federal prosecutor is investigating, while retailers and technical providers are assessing affected systems and the impact on stores. Authorities and companies have not announced a final tally or a timetable for completing those checks. Further public findings may clarify whether the reported incidents share a common technical cause and how many businesses were affected.
For now, the confirmed public picture is limited: businesses reported refrigeration disruptions, some said systems were altered remotely, and France had previously warned about exposed controller interfaces. The next useful updates will be official investigative findings, verified figures on losses and affected locations, and clear information on whether the identified equipment weaknesses were addressed at the sites involved.
Key Questions
What happened to the refrigeration systems?
Retailers and media reports say some refrigeration controllers were changed into defrost or heating modes overnight on November 1–2, 2026, leaving freezers unable to maintain normal temperatures.
How many businesses were affected?
BleepingComputer reported more than 115 locations across at least six countries, with reports also describing anomalies in Finland. Counts differ between sources, and a final verified total has not been published.
Do investigators know who was responsible?
No. The source material reports no attribution or claim of responsibility. Belgium’s federal prosecutor has opened an investigation, and the Belgian cyber centre has said the attacker may never be identified.
Was AI used in the attacks?
That has not been established. Officials’ broader warnings about cyberattacks involving AI are not evidence that AI was used in these particular incidents.
What security issue has been reported?
France’s CERT-FR warned that remote-management interfaces for refrigeration controllers had been exposed online. Reporting does not confirm that every affected site had the same exposure, controller or software configuration.
Source: ThorstenMeyerAI.com
