EU agencies urge action as attacks hit refrigeration controllers

EU agencies urge action as attacks hit refrigeration controllers

4 November 2026: ENISA, the European Commission's DG CNECT, Europol's EC3, the EU CSIRTs Network and EU-CyCLONe have jointly told operators of commercial refrigeration systems to take "immediate action to mitigate exposure". Several such systems and similar devices in a number of Member States have been hit since 11 October, with a new wave on 1 and 2 November. Czech agency NUKIB has now named the products concerned, and they carry known flaws with published firmware guidance.

Not yet independently verified. We have not read Danfoss's or Copeland's own pages: the products, CVEs and firmware versions come from NUKIB, and NUKIB gives no fixed firmware version for Copeland. ENISA's statement names no vendor and gives no count of affected sites. We will update this when it can be confirmed, and remove this note.

This follows the Dutch NCSC warning on the same attacks, and it takes the warning to EU level.

The controllers in the firing line

NUKIB says the activity mainly concerns Danfoss AK-SM and AK-SC controllers and Copeland/Dixell XWEB. It also names CAREL pCOWeb as carrying a similar risk when exposed to the internet. It has seen no case in Czechia so far.

The causes it lists are ordinary ones: management interfaces reachable from the internet, known authentication bypass flaws, and default or weak passwords.

• Danfoss AK-SM 8xxA: CVE-2025-41450 (authentication bypass), CVE-2025-41451 (remote command execution after access) and CVE-2025-41452 (configuration and denial of service). Danfoss says the last two affect firmware before 4.3.1 and recommends the current firmware, according to NUKIB.
• Copeland XWEB 300D PRO, 500D PRO and 500B PRO, firmware 1.12.1 and older: CVE-2026-21718 (authentication bypass leading to unauthenticated code execution) and CVE-2026-25085.

ENISA is keeping its collected advisories on GitHub, in the enisaeu/CNW repository under CNW-2026-05.

Steps NUKIB sets out for operators

Retailers, food logistics firms and anyone else with cold storage should find out first who actually looks after these controllers, since they are often installed and run by a refrigeration contractor rather than the IT team. NUKIB's list then follows:

• take the interface off the internet or put it behind a VPN;
• change default and weak passwords;
• update the firmware;
• review access history and configurations for changes;
• make sure the controller can be isolated if it is attacked.

A controller that has been reachable from the internet with a weak password should be treated as possibly already accessed, because attackers have had since at least 11 October, so the access review is not optional.

The reporting duties the statement points to

The joint statement also reminds both sides of the law. Since 11 September 2026 manufacturers must report severe incidents and actively exploited vulnerabilities through the Cyber Resilience Act's Single Reporting Platform, under Regulation (EU) 2024/2847, while the Act's main requirements apply from 11 December 2027. Entities covered by NIS2 must report significant incidents to their national CSIRT, and a retailer or food business in scope may have to do so if its cold chain is hit.

We list nine IoT software products, but building and refrigeration controllers of this kind generally sit outside the tools IT teams use to inventory their estate, so they need checking by hand.

Sources

• ENISA: Joint statement on cyber incidents in refrigeration systems across the EU, 4 November 2026, 4 November 2026
• NUKIB (Czech cyber agency): information on the current wave of attacks on cooling equipment, 5 November 2026, 5 November 2026
• CERT-SE: EU warns of cyber incidents in refrigeration and freezer systems, 6 November 2026, 6 November 2026