As reported by SecurityAffairs, ENISA and a coalition of EU cybersecurity bodies issued a joint advisory on November 4, 2026, warning of continued attacks against commercial refrigeration systems across multiple Member States. The campaign — active since October with a renewed wave on November 1-2 — has already caused significant physical damage in France, where attackers compromised refrigeration management systems at hundreds of supermarket locations, forcing freezers into continuous defrost mode and destroying inventory.
Physical Destruction as the Objective
This campaign represents a textbook example of OT attacks where the goal isn't data theft or ransomware — it's physical disruption. Attackers remotely altered controller configurations to push freezer temperatures to approximately 50°C, spoiling fresh and frozen stock across roughly 400 retail locations. The Paris prosecutor confirmed fires were also ignited as a result of the manipulated systems. When cyberattacks cause food spoilage and fire, the boundary between digital and physical risk collapses entirely.
The Vulnerability: End-of-Life Danfoss Controllers
The French incidents centered on Danfoss refrigeration controllers — specifically older models that had reached end-of-support and no longer receive security patches. Some affected systems were also running outdated firmware with known vulnerabilities that researchers had previously identified.
| Attribute | Details |
|---|---|
| Affected Vendor | Danfoss (refrigeration controllers) |
| Affected Products | Older-generation refrigeration controllers (end-of-life models) |
| Root Cause | Unsupported hardware + outdated firmware + known vulnerabilities + remote accessibility |
| Exploitation Status | Active in the wild — ongoing campaign since October 2026 |
| Patch Availability | No patch available for end-of-life models; vendor migration required |
| Severity | High — physical damage, food supply disruption, fire risk |
The core failure here isn't a zero-day. It's the continued operation of unsupported ICS equipment exposed to remote access — a problem that pervades virtually every industrial sector. When vendors stop patching and organizations keep deploying, the attack surface only grows.
Who Is at Risk
Broader Implications
The fact that Europol's EC3 and EU-CyCLONe are involved signals this isn't being treated as a routine incident — it's a coordinated cross-border critical infrastructure threat.
This campaign demonstrates that attackers are increasingly weaponizing overlooked OT assets. Refrigeration systems sit at the intersection of food safety, supply chain integrity, and physical safety. They're rarely monitored with the same rigor as IT infrastructure, yet their failure modes include spoilage, contamination, and fire. The involvement of Europol's European Cybercrime Centre (EC3) and EU-CyCLONe signals that European authorities view this as a coordinated cross-border threat to critical infrastructure, not an isolated nuisance.
Shield53 Recommendations
Immediate Actions
- Inventory all ICS/OT assets immediately. Identify every refrigeration controller, its model, firmware version, support status, and network exposure. You cannot defend what you haven't enumerated.
- Disconnect end-of-life controllers from external access. If a Danfoss controller (or any ICS device) is past vendor support, remove it from any network reachable from the internet or corporate LAN. Implement strict network segmentation with deny-by-default firewall rules.
- Lock down remote management interfaces. Disable unnecessary remote access. Where remote access is unavoidable, enforce VPN + MFA, restrict to allowlisted IP ranges, and log all session activity.
- Verify current firmware. For supported Danfoss models, check vendor advisories and apply all available patches. Document any devices where no patch exists and initiate procurement of replacements.
- Deploy OT-specific monitoring. Install network traffic analysis on OT segments to detect anomalous configuration changes, unusual login patterns, or unexpected protocol commands.
- Establish physical monitoring as a failsafe. Temperature alarms and manual override procedures should catch manipulated settings before stock is lost. Train store staff to recognize and respond to abnormal refrigeration behavior.
Strategic Actions
- Adopt a lifecycle management policy for all ICS assets with mandatory replacement timelines tied to vendor end-of-support dates — not convenience or budget cycles.
- Conduct OT-specific risk assessments that evaluate physical safety consequences, not just data confidentiality.
- Engage with your national CSIRT and subscribe to ENISA and CISA ICS advisories for timely threat intelligence on industrial control systems.
- Pressure suppliers to provide long-term security support commitments for critical infrastructure equipment, or select vendors who do.
The lesson is straightforward: the cold chain is now a cyberattack surface. Organizations that continue running unsupported, internet-exposed ICS controllers are gambling with food safety, regulatory compliance, and physical safety. The cost of replacement is trivial compared to the cost of a continent-wide spoilage event — or a fire.
