What happened

On 4 November 2026, ENISA, the European Commission (DG CNECT), Europol’s European Cybercrime Centre (EC3), the EU CSIRTs Network, and EU-CyCLONe issued a joint statement on cyber incidents affecting commercial refrigeration systems and similar connected devices across several EU Member States since 11 October 2026, including a renewed wave on 1 and 2 November. [1]

National advisories compiled by the CSIRTs Network under reference CNW-2026-05, including CERT-FR’s alert CERTFR-2026-ALE-012, describe compromises of remote refrigeration controllers exposed directly to the internet. CERT-FR advises operators to remove public internet exposure, verify operational settings such as defrost schedules, apply vendor firmware updates and strict security modes, and note that factory resets alone cannot prevent re-compromise on end-of-life (EOL) units lacking security fixes. [2] [3]

In the policy section of the joint statement, ENISA explicitly reminds hardware and software manufacturers that since 11 September 2026 they must report actively exploited vulnerabilities and severe incidents through the Cyber Resilience Act’s Single Reporting Platform under Regulation (EU) 2024/2847. [1]

Why it matters for manufacturers

Field controllers, gateways, and building or retail supervision units routinely stay in service for a decade, often managed remotely by third-party technicians who place management interfaces on reachable networks. When an active campaign hits that class of equipment, manufacturers face simultaneous pressure from operators, national CSIRTs, and statutory reporting timelines.

The advisories also highlight the operational boundary between supported and end-of-life hardware. Where a product line remains within its support window, operators need a tested firmware update that hardens remote management without disturbing control loops or saved schedules. Where older hardware has reached end of support, clear version records help customers distinguish patchable units from hardware that must be isolated or replaced.

What to review across connected controller lines

  • Verify which firmware branches remain under active security support and whether remote management, default credentials, or authentication modes expose deployed units.
  • Validate candidate firmware updates against saved operational parameters (such as control schedules, telemetry links, and VPN access) before field rollout.
  • Confirm internal escalation paths so engineering findings feed directly into CRA Article 14 reportability checks when national CSIRTs report active exploitation.

The engineering takeaway

Connected industrial and commercial controllers face real-world exploitation alongside EU reporting scrutiny. Keeping supported branches patchable, regression-tested, and tied to a clear CRA Article 14 notification workflow avoids improvising during an active campaign.

Primary sources

  1. ENISA: Joint statement on cyber incidents in refrigeration systems across the EU4 November 2026. Joint statement with the European Commission, Europol EC3, the EU CSIRTs Network, and EU-CyCLONe, including CRA reporting reminders.
  2. CSIRTs Network: Cyberattacks targeting Retail Sector Refrigeration Facilities (CNW-2026-05)3 November 2026. Index of national CSIRT alerts across EU Member States.
  3. CERT-FR: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération (CERTFR-2026-ALE-012)12 October 2026, updated 16 October 2026. Covers affected controller families, firmware update guidance, and end-of-life exposure risks.

Sources reviewed . The manufacturer guidance and engineering takeaway reflect Firmdura’s analysis.