BRUSSELS, Belgium / EuroWire.IO / – The EU’s cybersecurity agency ENISA and other European bodies have called on organisations to act immediately to limit their exposure to cyber threats. The joint warning, published on November 4, followed a new wave of cyberattacks on refrigeration systems on November 1 and 2. Supermarkets in several EU countries saw fridges and freezers disrupted by the attacks. Incidents of this kind have been recorded since October 11, the statement said.
Alongside ENISA, the statement was signed by the European Commission, Europol’s European Cybercrime Centre, the EU CSIRTs Network and the EU-CyCLONe network of cyber crisis liaison organisations. The agencies said affected member states were investigating and providing guidance. National cybersecurity response teams and crisis management authorities are sharing information and tracking developments. ENISA and other EU bodies are monitoring the situation to support a coordinated response. The statement did not attribute the attacks to any group.
Organisations were advised to check the latest security advisories from national response teams, which are available through official channels and ENISA’s advisory collection. A CSIRTs Network advisory dated November 3 addresses compromised refrigeration controllers in retail facilities. These controllers manage temperatures in fridges and freezers. US agencies including CISA and the FBI have also warned that attackers are targeting electronic temperature controls at grocery stores and cold storage sites.
Cyber Resilience Act duties in force
The agencies reminded manufacturers of hardware and software that the EU Cyber Resilience Act has required them since September 11, 2026 to report severe incidents and actively exploited vulnerabilities. Reports must be filed through the Act’s Single Reporting Platform. The law’s main requirements apply from December 11, 2027, when manufacturers must build security into product design. They will also have to support products with security updates throughout their lifecycle and fix vulnerabilities without delay.
Entities covered by the NIS2 directive must also put cybersecurity risk management measures in place. They must report significant incidents to national authorities or computer security incident response teams. ENISA said it continues to promote secure-by-design and secure-by-default principles through technical advisories, guidance and information sharing. EU countries have been bringing NIS2 into national law, including Austria, whose new cybersecurity law took effect in October.
Hackers switched freezers to defrost
In the November attacks, hackers switched supermarket fridges and freezers to defrost mode, the head of Belgian refrigeration firm Sabcobel said. Stores in Belgium, Sweden, the Netherlands, Ireland, Luxembourg and Estonia reported sudden temperature rises, with some freezers set to 50°C. Affected retailers included Delhaize, Carrefour Belgium, ICA, Coop and SuperValu. Some products were withdrawn from sale. In Ireland, 13 of 223 SuperValu stores were hit. No group has claimed responsibility.
The wave followed an attack on hundreds of French supermarkets in October that caused fires and food losses. A French cybersecurity alert said those attacks targeted Danfoss and Copeland/Dixell refrigeration controllers, according to BleepingComputer. EuroCommerce, which represents European retailers, has urged stronger cybersecurity in the sector. EU Commissioner Christophe Hansen called the attacks a deliberate attempt to disrupt food supply. Investigations are continuing in several countries.