ENISA Flags Active Exploitation of Outdated Refrigeration Controllers Across Europe, Disrupting Supermarket Supply Chains
What Happened — ENISA, the European Commission, Europol and national CSIRTs issued a joint advisory after a series of cyber‑attacks on commercial refrigeration systems in several EU Member States. The first wave began in October 2026 and a second wave hit on 1‑2 November 2026. Attackers compromised Danfoss‑manufactured refrigeration controllers that were no longer receiving security updates or were running obsolete firmware. By remotely changing temperature set‑points, they forced freezers into continuous defrost mode, causing internal temperatures to climb to ≈ 50 °C. In France the incident affected roughly 300 Intermarché and Netto stores and under 100 Coopérative U outlets, destroying large volumes of fresh and frozen food and even triggering fires in some locations. The incidents illustrate how industrial control systems (ICS) that manage physical processes are increasingly exposed when they are connected to corporate networks without adequate security controls.
Why It Matters for Trust & Control Assurance — The attacks expose a gap in secure configuration and vulnerability‑management controls for OT assets, a single control objective that maps to many frameworks (e.g., NIST CSF Identify and Protect, ISO 27001 A.12.6).
Who Is Affected — Retail grocery chains, food‑distribution operators, OT equipment manufacturers, and any organisation that relies on network‑connected refrigeration or climate‑control hardware.
Recommended Actions
- Inventory all refrigeration and other OT controllers; tag those that are end‑of‑life or running unsupported firmware.
- Apply a formal patch‑management / firmware‑update process for OT, including compensating controls (network segmentation, strict remote‑access policies) when patches are unavailable.
- Enforce least‑privilege remote access and multi‑factor authentication for any management interfaces.
- Conduct continuous monitoring of OT network traffic for anomalous commands.
- Document the above controls as evidence for audit readiness.
Source: Security Affairs
Technical Notes
- Attack vector: exploitation of known vulnerabilities in legacy Danfoss refrigeration controllers (no public CVE cited, but researchers have previously reported firmware flaws).
- Data types: not a data breach; impact was operational – temperature manipulation, product loss, and physical damage.
- Systems affected: industrial control systems for commercial refrigeration, often integrated with corporate IT networks.