EU Agencies Warn of Fresh Attacks on Refrigeration Controls

Key points

• A coordinated EU alert covers intrusions into refrigeration and industrial controls.
• The campaign spans several member states and was first seen in October.
• An additional attack round was reported by November 1.
• No CVE was cited; exposure and food-supply effects are the main concern.

European Union cyber agencies, including ENISA and national authorities, have issued a joint warning about intrusions into cooling equipment used by retailers and food logistics operators. The actors remain unidentified. The campaign has touched multiple EU countries, with initial activity observed in October and a further round reported by November 1.

The affected environments include commercial refrigeration plants and the industrial control systems that manage them. Supermarkets, cold-storage sites, and food distribution chains depend on these systems to keep perishable goods within safe temperature ranges. Operational outages or manipulated settings could therefore disrupt store operations and create food-supply concerns.

The warning matters because refrigeration controls often sit in operational technology networks that are less visible to IT security teams. No specific CVE was named, which suggests the risk is not tied to a single patchable software flaw. Instead, exposed controllers, weak remote-access paths, and flat network designs are likely to be the practical exposure points that defenders should examine.

Authorities have coordinated the alert across states, but attribution and technical details remain limited. The reported second wave indicates that the activity is not a one-off scan or isolated incident. Organizations should treat the warning as a prompt to verify whether cooling and building-control assets are reachable from the public internet and whether vendor support links are tightly controlled.

What to watch: new intrusion reports, vendor advisories, unusual logins to controller interfaces, unexpected configuration changes, and temperature or alarm anomalies that coincide with network activity. Food retailers and logistics providers should also confirm that manual operating procedures and continuity plans are ready if automation is unavailable.

What to do now

1. Inventory all refrigeration and industrial control assets, then remove direct public exposure and require authenticated, logged remote access.
2. Segment operational technology from business networks and restrict outbound traffic to only approved destinations.
3. Review October-November logs for unauthorized sessions, configuration changes, and unusual vendor-support connections.
4. Replace default credentials, apply available firmware updates, and back up controller configurations before making changes.
5. Tighten third-party remote support with time-bound access, multifactor authentication, and session recording.
6. Monitor temperature, alarm, and food-safety systems for anomalies; test manual override and continuity procedures.
7. Report suspicious activity to ENISA or the relevant national authority and share indicators with sector peers.

Original source

Security Affairs