ENISA warns of attacks disrupting Europe’s refrigeration systems

ENISA and European authorities have issued a coordinated warning after a wave of cyberattacks targeting commercial refrigeration systems across several EU member states began in October, with a renewed spike on 1–2 November. The advisory, published on 4 November, urges organisations to take immediate action to mitigate exposure to vulnerable systems that are increasingly connected to corporate networks and remotely accessible.

The joint statement comes from ENISA, the European Commission (DG CNECT), Europol’s European Cybercrime Centre (EC3), the EU CSIRTs Network and EU-CyCLONe, emphasising rapid information-sharing and coordinated investigations to understand the campaign’s scale.

In France, hackers reportedly compromised refrigeration management systems used by hundreds of supermarkets, remotely altering temperatures and driving freezers into defrost mode. Some sites reached up to 50°C, destroying substantial quantities of fresh and frozen stock. Authorities cited around 300 Intermarché and Netto stores and under 100 Coopérative U outlets affected, with other retailers reporting cooling equipment disruptions as well.

The attackers are understood to have targeted older Danfoss refrigeration controllers that had reached end-of-life and were no longer receiving security updates; other systems were running outdated firmware. Researchers had previously identified vulnerabilities in certain Danfoss controllers, including weaknesses that could allow bypassing authentication, though officials have not confirmed that those exact flaws were exploited in these incidents.

The European response highlights that these are not isolated IT problems but issues affecting operational technology and food distribution. ENISA notes that national CSIRTs and EU crisis authorities are sharing information and coordinating investigations, and that the agency has published technical advisories to help organisations identify risks and apply protective measures.

The advisory also references the Cyber Resilience Act and the NIS2 Directive, outlining forthcoming security-by-design requirements and reporting obligations for significant incidents.