Summary
- The European Commission, ENISA, Europol, and national cyber authorities are coordinating the response.
- Commercial refrigeration systems have been affected across several EU countries since 11 October.
- The incidents raise questions about industrial remote access, supplier responsibilities, and operational resilience.
European cybersecurity authorities have established a coordinated response to attacks affecting commercial refrigeration systems, following a further wave of incidents that disrupted connected cooling equipment across several EU member states.
The European Commission confirmed on 4 November that commercial refrigeration equipment and similar devices had been affected by cybersecurity incidents since 11 October, with additional attacks occurring on 1 and 2 November.
The response brings together the Commission’s Directorate-General for Communications Networks, Content and Technology, the EU Agency for Cybersecurity (ENISA), Europol’s European Cybercrime Centre, national computer security incident response teams, and EU-CyCLONe, the network responsible for coordinating responses to large-scale cyber crises.
National authorities are investigating the incidents and exchanging information through established European cooperation mechanisms. Organisations operating potentially affected equipment have been advised to take immediate steps to reduce their exposure.
The intervention follows attacks affecting supermarket refrigeration systems across Europe, where interference with connected controls forced retailers to assess the safety of refrigerated stock and interrupted normal operations.
Authorities have not publicly established whether every incident involved the same technical route or identified a common perpetrator.
Remote maintenance creates shared exposure
Commercial refrigeration systems increasingly incorporate supervisory controls that allow equipment to be monitored, configured, and maintained remotely. Retailers and food businesses can use these functions to manage distributed facilities, identify faults, and reduce the need for engineers to attend individual premises.
The same connectivity can create a route for unauthorised interference when management interfaces are exposed or supplier access is inadequately protected. Unlike an intrusion confined to administrative software, manipulation of a refrigeration controller can affect equipment responsible for maintaining safe storage conditions.
Temperature settings and defrost cycles influence whether perishable goods remain suitable for sale or distribution. Once acceptable storage conditions have been exceeded, restoring the equipment does not necessarily restore the commercial value or safety of the products affected.
That distinction creates responsibilities across cybersecurity, facilities management, food safety, and procurement. An operator may own the premises while a manufacturer supplies the controller, a contractor maintains the refrigeration equipment, and another provider operates the remote monitoring service.
Each relationship introduces decisions about access permissions, account management, software maintenance, and the information available when an incident occurs. Where several organisations depend on a common technology supplier, knowledge of a weakness in one deployment may be relevant to others.
Incident coordination extends across borders
The Commission’s response reflects the geographical spread of the incidents and the potential for comparable equipment configurations to be used by organisations operating in different countries.
Through the EU CSIRTs Network and EU-CyCLONe, national authorities can exchange technical findings and assess whether developments require wider coordination. Europol’s involvement provides a separate route for cooperation on potential criminal activity.
The statement also draws attention to reporting obligations introduced under the EU Cyber Resilience Act. Since 11 September 2026, manufacturers of products containing digital elements have been subject to reporting requirements concerning actively exploited vulnerabilities and severe incidents, where the statutory conditions are met.
The Commission also points to NIS2 duties for qualifying entities, including managing cybersecurity risks and reporting significant incidents to national authorities. Whether an individual retailer, equipment manufacturer, or service provider is subject to those requirements depends on its activities and applicable national legislation.
Those requirements do not mean every refrigeration incident automatically triggers a manufacturer’s reporting obligation. Applicability depends on the product, circumstances, and relevant legal definitions.
Equipment operators face a separate operational question over whether abnormal settings can be detected independently of the supervisory system through which an attacker gained access. Monitoring and alarms can limit physical consequences even where the original administrative controls have been compromised.
The Commission has not disclosed a complete list of affected organisations, established common attribution, or confirmed a single technical explanation for the incidents. National investigations and European information sharing are continuing.
