Europe
ENISA and the Commission: cyberattacks on refrigeration systems in EU states and a new wave on November 1-2
ENISA, the European Commission, Europol’s EC3 and the national cyber networks say refrigeration systems in food retail have been hit by cyberattacks since October 11, with a new wave on November 1-2, and urge organisations to cut exposure at once.
The systems that keep food cold in Europe’s supermarkets and food retail have become the target of cyberattacks, and the EU cybersecurity agency ENISA is now urging organisations to act immediately. The joint statement was published on Wednesday, November 4, 2026 and concerns incidents recorded since October 11 in several EU member states.
Commercial refrigeration systems and similar devices were affected. A new wave of incidents occurred on Sunday, November 1 and Monday, November 2, after which ENISA, the European Commission (Directorate-General CNECT), Europol’s European Cybercrime Centre (EC3), the EU CSIRTs Network of national computer security incident response teams and the EU-CyCLONe network of national cyber-crisis authorities advise organisations to immediately limit the exposure of the affected systems.
The EU CSIRTs Network includes the teams designated by each member state and CERT-EU, the response team of the EU institutions. This network and EU-CyCLONe actively exchange information, while the affected member states investigate the incidents and issue guidance.
ENISA keeps a collection of alerts from the network’s teams in the CNW repository on GitHub. Entry CNW-2026-05 of November 3 describes attacks that since mid-October have breached remote control systems of retail refrigeration installations across Europe and cites CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, the international identifiers of known software vulnerabilities.
The Greek angle
The issue directly concerns Greece too. The National Cybersecurity Authority announced on Tuesday, November 3 that, following the attacks on refrigeration systems at food stores and supermarkets across the country, it had already warned on October 14 of vulnerabilities in commercial refrigeration controllers from Danfoss, Copeland/Dixell and Carel. It had then identified more than 300 exposed systems and called for their immediate disconnection from the public internet, access only through a VPN with multi-factor authentication, changing of default passwords and replacement of unsupported equipment. The Authority’s head, Michalis Bletsas, said: “Whatever we detect, the attacker detects too. A known but unpatched gap can become physical damage within a single night.” Entities covered by Law 5160/2024 (NIS2) must report any significant incident within 24 hours.
The regulatory framework
The statement also recalls the regulatory framework. From September 11, 2026 manufacturers of hardware and software products must report serious incidents and actively exploited vulnerabilities through the single reporting platform of the Cyber Resilience Act (Regulation (EU) 2024/2847). Its core requirements, security by design and prompt patching of vulnerabilities throughout a product’s life, will apply from December 11, 2027. Entities covered by the NIS2 Directive (Directive (EU) 2022/2555) must report significant incidents to their national response team (CSIRT) or competent national authority.
