Since early October, cyber criminals have been compromising supermarket refrigeration units across the EU, prompting a joint response from ENISA, the European Commission and national CSIRTs.
From 11 October 2026 onward, a series of cybersecurity incidents have hit commercial refrigeration and related control devices in a number of European Union Member States. A second surge on 1–2 November deepened concerns, as the attacks appeared to target the same class of devices that keep perishable goods cold in supermarkets, convenience stores and distribution centres.
The incidents have been reported by national incident-response teams in France, the Netherlands, Sweden and the United Kingdom, among others, and have prompted an unprecedented level of cross-border cooperation.
Extent and timeline of the attacks
The first alerts emerged on 11 October when French CERT-FR noted suspicious activity on Danfoss AK-SM and AK-SC controllers, as well as on Copeland and Dixell units.
The French alert (CERTFR-2026-ALE-012) warned that attackers could exploit outdated firmware and default credentials to gain remote access. Within days, the Dutch NCSC disclosed that similar intrusions were being observed on refrigeration installations throughout the Netherlands, describing a method that leverages weak passwords to alter temperature set-points or defrost cycles.
By early November, a coordinated wave struck multiple Member States, leading the European Commission’s Directorate-General for Communications Networks, Content and Technology (DG CNECT) to issue an urgent advisory.
EU coordination and legal framework
In response, the European Commission, ENISA (the EU Agency for Cybersecurity), Europol’s European Cybercrime Centre (EC3), the EU CSIRTs Network and the European cyber crisis liaison organisation EU-CyCLONe convened a joint task-force. Their joint statement, released on 4 November 2026, called for immediate mitigation steps, rapid information-sharing and a coordinated European-level response. The agencies reminded operators that, under the Cyber Resilience Act (CRA) (Regulation EU 2024/2847), manufacturers of hardware and software with digital elements must report severe incidents and actively exploited vulnerabilities via a single reporting platform. The CRA’s full security-by-design obligations will become enforceable on 11 December 2027, mandating that manufacturers embed security throughout the product lifecycle.
Simultaneously, organisations that fall under the NIS2 Directive (Directive (EU) 2022/2555) are required to adopt risk-management measures for operational technology and to notify significant incidents to national CSIRTs. ENISA is reinforcing this mandate through its “Secure by Design and Default Playbook” and regular technical advisories, which emphasise the need for secure configurations, timely patching and restricted remote access for industrial control systems.
Manufacturers, vulnerabilities and national alerts
Technical analysis published by ENISA on 3 November 2026 (advisory CNW-2026-05) identified three vulnerability references affecting Danfoss AK-SM controllers: CVE-2025-41450 (authentication bypass), CVE-2025-41451 (command injection) and CVE-2025-41452 (configuration manipulation leading to denial-of-service). Danfoss itself confirmed that firmware versions prior to 4.2 for AK-SM 8xxA are vulnerable and urged customers to upgrade to the newly released 5.3.x series, which introduces hardened account-management and cryptographic checks.
National authorities echoed the same mitigation priorities. France’s CERT-FR urged immediate removal of public-internet exposure for the affected controllers, strict validation of defrost schedules and the deployment of protected VPN gateways for remote maintenance. The Dutch NCSC highlighted the danger of default passwords and recommended multi-factor authentication for any remote-access portal. Sweden’s CERT-SE and the UK’s NCSC also released notices, stressing that the core issue lies not in the refrigeration hardware itself but in the operational technology (OT) network that connects these devices to the internet.
EuroCommerce, representing retail and wholesale businesses across 28 European countries, welcomed the coordinated effort and called for a “stable and proportionate regulatory framework” that enables firms to invest in secure, modern cooling systems. Its Director-General stressed that food safety is non-negotiable; when the cold chain is broken, retailers must withdraw affected products to protect consumers, reinforcing the sector’s commitment to maintain trust.
Practical steps for operators
Based on the combined advisories, operators are advised to perform a rapid inventory of all internet-exposed refrigeration controllers, isolate them on dedicated OT sub-networks, enforce strong, unique passwords, enable multi-factor authentication, and apply the latest firmware releases from manufacturers. Where devices are no longer supported, replacement with up-to-date hardware is strongly recommended. Continuous monitoring of network traffic for anomalous commands to temperature-set points or defrost cycles can help detect attempted intrusions before they cause spoilage or financial loss.
The EU-wide response underscores that modern supply-chain resilience depends on robust cyber hygiene for even the most mundane pieces of equipment. As investigations continue, the joint task-force will keep publishing updates through official CSIRT channels and ENISA’s advisory repository, ensuring that the retail sector can keep the cold chain intact while safeguarding consumer confidence.
