Joint statement on cyber incidents in refrigeration systems across the EU | ENISA
Since 11 October 2026, several commercial refrigeration systems and similar devices have been impacted by cybersecurity incidents in a number of EU Member States.
Since 11 October 2026, several commercial refrigeration systems and similar devices have been impacted by cybersecurity incidents in a number of EU Member States.
The European Commission, together with ENISA, the European Union Agency for Cybersecurity, and all relevant EU services, is closely monitoring the situation.
Given the large-scale nature of these incidents, cooperation, rapid information-sharing and coordinated response at European level is essential.
Following a new wave of incidents having occurred on 1-2 November, ENISA, the European Commission (DG CNECT), Europol’s European Cybercrime Centre (EC3), the Network of the EU national computer security incident response teams (EU CSIRTs Network) and the European cyber crisis liaison organisation Network (EU- CyCLONe), advise organisations to take immediate action to mitigate exposure in the affected systems.
The EU CSIRTs Network (EU Member States-appointed CSIRTs and CERT-EU) and EU-CyCLONe (EU national authorities in charge of cyber crisis) are actively exchanging information and monitoring the situation.
Affected EU Member States are aware of the situation and are currently investigating the incidents, while providing guidance.
ENISA maintains an advisory collection under: CNW/advisories/2026/CNW-2026-05_retail-incidents.md at main · enisaeu/CNW · GitHub Organisations should be aware that as of 11 September 2026, manufacturers of hardware and software products must report severe incidents and actively exploited vulnerabilities through the Cyber Resilience Act’s Single Reporting platform, in accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act).
The latest advisories published by CSIRTs Network members can be found on their relevant official communication channels.
In addition, entities to which the NIS2 Directive (Directive (EU) 2022/2555) applies must implement measures to manage the cybersecurity risks to their operations, and report significant incidents to their national CSIRT or authority.
Manufacturers of hardware and software products (‘products with digital elements’) will be required to implement security-by-design and ensure security support during the lifecycle of such products, including the remediation of vulnerabilities without delay.
ENISA and all relevant EU stakeholders will continue to monitor the incidents and contribute to the overall situational awareness at Union level.
The main cybersecurity requirements laid down in the Cyber Resilience Act (CRA) will apply as of 11 December 2027.
What happened
Since 11 October 2026, several commercial refrigeration systems and similar devices have been impacted by cybersecurity incidents in a number of EU Member States.
The European Commission, together with ENISA, the European Union Agency for Cybersecurity, and all relevant EU services, is closely monitoring the situation.
Given the large-scale nature of these incidents, cooperation, rapid information-sharing and coordinated response at European level is essential.
What changed
Following a new wave of incidents having occurred on 1-2 November, ENISA, the European Commission (DG CNECT), Europol’s European Cybercrime Centre (EC3), the Network of the EU national computer security incident response teams (EU CSIRTs Network) and the European cyber crisis liaison organisation Network (EU- CyCLONe), advise organisations to take immediate action to mitigate exposure in the affected systems.
The EU CSIRTs Network (EU Member States-appointed CSIRTs and CERT-EU) and EU-CyCLONe (EU national authorities in charge of cyber crisis) are actively exchanging information and monitoring the situation.
Who is affected
Affected EU Member States are aware of the situation and are currently investigating the incidents, while providing guidance.
ENISA maintains an advisory collection under: CNW/advisories/2026/CNW-2026-05_retail-incidents.md at main · enisaeu/CNW · GitHub Organisations should be aware that as of 11 September 2026, manufacturers of hardware and software products must report severe incidents and actively exploited vulnerabilities through the Cyber Resilience Act’s Single Reporting platform, in accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act).
Why it matters
The latest advisories published by CSIRTs Network members can be found on their relevant official communication channels.
In addition, entities to which the NIS2 Directive (Directive (EU) 2022/2555) applies must implement measures to manage the cybersecurity risks to their operations, and report significant incidents to their national CSIRT or authority.
Technical details
Manufacturers of hardware and software products (‘products with digital elements’) will be required to implement security-by-design and ensure security support during the lifecycle of such products, including the remediation of vulnerabilities without delay.
What security teams should do
ENISA and all relevant EU stakeholders will continue to monitor the incidents and contribute to the overall situational awareness at Union level.
The main cybersecurity requirements laid down in the Cyber Resilience Act (CRA) will apply as of 11 December 2027.
Attribution
ENISA: Since 11 October 2026, several commercial refrigeration systems and similar devices have been impacted by cybersecurity incidents in a number of EU Member States.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.