ENISA Warns of Attacks on Refrigeration Systems Across Europe

The joint statement, published on 4 November 2026, follows attacks that began in October and continued with a new wave on 1 and 2 November. The advisory urges organizations to take immediate action to mitigate exposure in affected systems. Security Affairs reports that in France, hackers remotely changed the settings of refrigeration management systems used by hundreds of supermarkets, forcing freezers into continuous defrost mode. Some systems reportedly reached temperatures of up to 50 degrees Celsius, destroying large quantities of food. According to reports, around 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets were affected.

BFMTV reported that the attackers targeted Danfoss refrigeration controllers used by many French stores to regulate cold storage. The Paris prosecutor said there were also fires. Security Affairs notes that the targeted devices were older controllers that no longer received security updates, and that authorities have not confirmed whether previously identified Danfoss vulnerabilities were exploited.

ENISA says national cybersecurity teams and EU crisis management authorities are sharing information and coordinating their investigations. The advisory also points to the Cyber Resilience Act, under which manufacturers must report severe incidents and actively exploited vulnerabilities from 11 September 2026, and to the NIS2 Directive, which requires in-scope organizations to report significant incidents to their national CSIRT or competent authority.

Why it matters The incidents show that operational technology, such as refrigeration controllers, can cause physical damage and business disruption, not only data loss. For investigators, the reported use of end-of-life Danfoss controllers and outdated firmware points to asset inventory and patch status as first checks. Organizations operating cold chains or other industrial control systems should review remote access to these devices and whether unsupported equipment is still in service. Organizations within the scope of NIS2 should also confirm their reporting obligations to their national CSIRT or competent authority.