BRUSSELS, Belgium / EuroWire.IO / – European Union cybersecurity authorities have urged organisations to take immediate action to reduce their exposure to cyber threats after a new wave of attacks on refrigeration systems on November 1 and 2. The warning came in a joint statement published on November 4. It follows incidents that disrupted fridges and freezers at supermarkets in several EU countries. The first incidents date back to October 11, the statement said.
The statement was issued by the European Union Agency for Cybersecurity (ENISA), the European Commission, Europol’s European Cybercrime Centre (EC3), the EU Computer Security Incident Response Teams Network and the European Cyber Crisis Liaison Organisation Network (EU-CyCLONe). Affected member states are investigating the incidents and providing guidance. National response teams and crisis management authorities continue to exchange information and monitor developments. The statement did not identify who was behind the attacks.
ENISA and other EU bodies are monitoring the situation to support a coordinated response across the bloc. The agencies advised organisations to consult the latest security advisories issued by national response teams, available through official channels and ENISA’s advisory collection. The CSIRTs Network issued an advisory on November 3 covering compromised refrigeration controllers at retail facilities. In the United States, CISA and the FBI have issued similar guidance on attacks against electronic temperature controls.
Manufacturers must report exploited flaws
The agencies reminded hardware and software manufacturers of their obligations under the EU Cyber Resilience Act. Since September 11, 2026, manufacturers have been required to report severe incidents and actively exploited vulnerabilities through the Act’s Single Reporting Platform. The Act’s main cybersecurity requirements take effect on December 11, 2027. Manufacturers will then have to build security into product design. They must also provide security support throughout product lifecycles and address vulnerabilities without delay.
Organisations covered by the EU’s Network and Information Security Directive, known as NIS2, must implement cybersecurity risk management measures. They are also required to report significant incidents to the relevant national authorities or computer security incident response teams. Member states have been transposing the directive into national law, with Austria’s new cybersecurity law taking effect in October. ENISA said it continues to promote secure-by-design and secure-by-default principles through technical advisories and guidance.
Supermarket fridges set to 50°C
The latest incidents hit supermarkets in Sweden, the Netherlands, Belgium, Ireland, Luxembourg and Estonia on November 2. Attackers switched evaporators to defrost mode, according to Belgian refrigeration company Sabcobel, and some freezers were set to 50°C. Chains including Ahold Delhaize, Carrefour Belgium, ICA, Coop and SuperValu reported affected stores. Retailers removed chilled and frozen products from sale at some locations. Ireland’s Musgrave said 13 of its 223 SuperValu stores were affected.
In France, hackers took control of cooling units at hundreds of supermarkets in October, causing fires and food losses. A French cybersecurity alert linked those attacks to Danfoss and Copeland/Dixell refrigeration controllers, BleepingComputer reported. Retail association EuroCommerce has called for stronger cybersecurity in the sector. No group has claimed responsibility for the attacks. European Commissioner Christophe Hansen called them a deliberate attempt to disrupt the EU’s food supply.