ENISA Joint Statement Urges Action After New Refrigeration Incident Wave in the EU

ENISA, the European Commission and four EU cyber bodies issued a joint statement on 4 November advising organisations to “take immediate action to mitigate exposure in the affected systems” after a new wave of refrigeration incidents.

The statement says that since 11 October 2026 several commercial refrigeration systems and similar devices have been affected by cybersecurity incidents in a number of EU Member States, and that a new wave occurred on 1 and 2 November. The signatories are ENISA, the Commission’s DG CNECT, Europol’s European Cybercrime Centre, the EU CSIRTs Network and the EU-CyCLONe network. It adds that “Given the large-scale nature of these incidents, cooperation, rapid information-sharing and coordinated response at European level is essential.”

The statement does not name affected companies, devices or an attacker, and it does not publish technical indicators. It points readers to the advisories of national CSIRTs and to a collection ENISA maintains on GitHub under the title CNW-2026-05 retail incidents.

The statement also reminds organisations of two legal duties. Since 11 September 2026, manufacturers of hardware and software products must report severe incidents and actively exploited vulnerabilities through the Cyber Resilience Act’s Single Reporting platform. Entities covered by the NIS2 Directive must manage cybersecurity risks and report significant incidents to their national CSIRT or authority.

For retailers and food and pharmacy operators, the practical step is to find every refrigeration controller and monitoring gateway, confirm which are reachable from the internet and ask the manufacturer for current guidance. In our reading, the CRA reporting line matters to refrigeration vendors now, because it puts exploited vulnerabilities in their products on a reporting clock. We covered the first national alert when CERT-FR warned of compromised refrigeration controllers, and the exposure advice in our opinion on management interfaces on a restricted network applies to these controllers.

Source: ENISA, Joint statement on cyber incidents in refrigeration systems across the EU