Executive Summary
Refrigeration system cyberattacks that began in France on 11 October 2026 have drawn a joint warning from ENISA, the European Commission and Europol’s EC3. It was issued on 4 November after a second wave hit on 1 and 2 November. In Sweden, that wave pushed temperatures above 50 degrees in some Ica and Coop stores and at an Axfood e-commerce warehouse. Large amounts of food were thrown away. CERT-SE published the EU warning on 6 November and told organisations to check connected cooling and control systems and patch them. US agencies led by CISA and the FBI followed on 5 November. No authority has named who is behind the attacks.
Second Wave of Refrigeration System Attacks Prompts EU Statement
The joint statement from ENISA, the European Union Agency for Cybersecurity, says commercial refrigeration systems and similar devices in a number of member states have been hit since 11 October. Its co-signers, including the EU CSIRTs Network and the crisis network EU-CyCLONe, advise organisations to act immediately.
ENISA links to an index of national alerts, advisory CNW-2026-05, dated 3 November. On 10 November it listed published alerts from 12 national CSIRTs including CERT-SE and Finland’s NCSC-FI. Denmark’s CFCS had none listed. The index gives no CVE for the refrigeration system cyberattacks.
Since 11 September 2026, the statement notes, manufacturers must report severe incidents and actively exploited vulnerabilities under the Cyber Resilience Act (CRA).
Ica and Axfood Say the Entry Point Sat Outside Their Networks
Ica press officer Gustaf Nilsson said a small number of stores “which have their connection outside ICA’s central network” were affected (translated). Coop’s head of press Carlos Cancino said six stores in central Sweden had problems with their refrigeration and freezer plants.
The Axfood site hit was a picking warehouse for home deliveries in Västra Frölunda, Gothenburg. The intrusion came “via an external supplier responsible for the refrigeration plant” and has no connection to Axfood’s own systems, head of press Magnus Törnblom said.
None of the three has said which controller brand its sites use.
Which Controllers the Advisories Name
France’s CERT-FR said in alert CERTFR-2026-ALE-012, first published on 12 October, that it knew of numerous compromises of Danfoss AK-SM and AK-SC series controllers as well as Copeland xweb and Dixell xweb. Ireland’s NCSC lists the same two Danfoss series in its advisory and tells organisations to review all remotely accessible refrigeration equipment regardless of manufacturer. CERT-SE’s notices of 2 November and 6 November name no product. None says which firmware versions are out of scope.
US Agencies Warn of Forced Defrost Cycles
The fact sheet from CISA, the FBI, HHS, USDA and the Department of Transportation says actors are targeting electronic temperature and commercial refrigeration controllers in retail grocery and cold storage. Unpatched or internet-accessible controllers can be pushed into continuous heating and defrost cycles through authentication bypass, code injection or weak configurations. One listed effect is a fire hazard. Removing public internet exposure tops its mitigations. “Every organization that depends on refrigeration and monitoring systems should assume it could be a target,” said Chris Butera, CISA’s acting executive assistant director for cybersecurity.
Claims, Losses and Reporting Still Unconfirmed
Two pro-Russian groups, Noname057(16) and Z-Pentest, posted a joint video claiming the attacks. The claim hasn’t been verified. Neither the EU statement nor the US fact sheet names an actor. Ica, Coop and Axfood have given no figure for discarded stock. A Commission review of grocery retailers’ preparedness was announced, CERT-SE’s week 45 newsletter reported. Cybersäkerhetslagen, the Swedish NIS2 law in force since 15 January 2026, requires an early warning within 24 hours of a significant incident. No Swedish operator has said whether it filed one.
Store Links and a Contractor as the Way In
Ica and Axfood both put the entry point outside their own networks. The Irish advisory treats remote monitoring and maintenance as the access that needs securing. For Swedish operators that puts the cooling contractor’s remote connection in the same risk register as any IT supplier. As of 10 November the Swedish notices name no product. The CERT-FR and Irish lists are the nearest thing to a checklist.
References
- Joint statement on cyber incidents in refrigeration systems across the EU
- CNW-2026-05 Cyberattacks targeting Retail Sector Refrigeration Facilities
- EU varnar för cyberincidenter i kyl- och fryssystem
- Cyberangrepp mot uppkopplade kyl- och fryssystem
- Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération
- Security Incidents Targeting Remote Refrigeration Controllers
- US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems
- NCSC – CERT-SE veckobrev v.45
This post is also available in:
Svenska
