EU authorities warn of attacks on Danfoss refrigeration systems in French supermarkets; US base hacks under investigation
European authorities are investigating ongoing attacks on commercial refrigeration systems. US military investigators are reportedly working with French agencies after hacks hit domestic bases (Cybersecurity Dive). On 4 November, ENISA, the European Commission (DG CNECT), Europol EC3, the EU CSIRTs Network and EU-CyCLONe issued a joint warning. The attacks began in October, with a new wave on 1-2 November (securityaffairs.com). In France, attackers remotely changed settings on refrigeration management systems and forced freezers into continuous defrost. Some units reportedly reached 50°C, and food stocks were destroyed. About 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets were reportedly affected (securityaffairs.com). Attribution and overall scope remain unconfirmed. The article does not link the refrigeration attacks to the US base hacks.
Detalhes técnicos
- BFMTV reported that the targets were Danfoss refrigeration controllers. They were older, end-of-support units without security updates, or ran outdated firmware (securityaffairs.com).
- Researchers had earlier found Danfoss flaws, including authentication bypass. Authorities have not confirmed that these were exploited (securityaffairs.com).
- The Paris prosecutor reportedly said fires also occurred (securityaffairs.com).
- No CVEs, IOCs or attacker identity have been published.
Remediação
- ENISA urges immediate action to reduce exposure of the affected systems. It has published a collection of national CSIRT technical advisories (securityaffairs.com).
- Generic advice from Tifon, not from the sources: avoid exposing controllers directly to the internet, restrict remote access, and watch for unexpected configuration changes.
- Regulatory background: since 11 September 2026, CRA reporting of severe incidents and exploited vulnerabilities applies to manufacturers. The main CRA requirements apply from 11 December 2027. NIS2 incident reporting applies to entities in scope (securityaffairs.com).
Linha do tempo
-
ENISA and EU bodies warn of attacks on Danfoss refrigeration controllers hitting French supermarkets
The joint ENISA, European Commission, Europol EC3, EU CSIRTs Network and EU-CyCLONe statement of 4 November reports attacks on commercial refrigeration systems in several Member States. The attacks began in October, with a new wave on 1-2 November. French victims are reportedly about 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets. BFMTV reported that the French incidents involved end-of-support or outdated Danfoss controllers. No attribution has been given.
ler a análise desta fonte ocultar
The joint ENISA, European Commission, Europol EC3, EU CSIRTs Network and EU-CyCLONe statement of 4 November reports attacks on commercial refrigeration systems in several Member States. The attacks began in October, with a new wave on 1-2 November. French victims are reportedly about 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets. BFMTV reported that the French incidents involved end-of-support or outdated Danfoss controllers. No attribution has been given.
ENISA, the European Commission (DG CNECT), Europol EC3, the EU CSIRTs Network and EU-CyCLONe issued a joint warning on 4 November. It follows attacks on commercial refrigeration systems in several EU Member States. The attacks began in October, and a new wave hit on 1-2 November. In France, attackers remotely changed settings on refrigeration management systems at hundreds of supermarkets and forced freezers into continuous defrost. Some units reportedly reached 50°C, and fresh and frozen stock was destroyed. About 300 Intermarché and Netto stores and fewer than 100 Coopérative U outlets were reportedly affected. Authorities have not attributed the campaign.
Technical Details
- BFMTV reported that the targets were Danfoss refrigeration controllers used in French stores (securityaffairs.com).
- The devices were older controllers that were end-of-support and no longer received security updates. Other systems ran outdated firmware (securityaffairs.com).
- Researchers had earlier found Danfoss controller flaws, including authentication bypass. Authorities have not confirmed that these flaws were exploited (securityaffairs.com).
- The Paris prosecutor reportedly said fires also occurred (securityaffairs.com).
- The article gives no CVEs, IOCs or attacker identity.
Remediation
- ENISA urges immediate action to reduce exposure of the affected systems. It has published a collection of national CSIRT technical advisories (securityaffairs.com).
- ENISA also stresses rapid information-sharing.
- The article recalls the regulatory background. Under the Cyber Resilience Act, manufacturers have had to report severe incidents and actively exploited vulnerabilities since 11 September 2026. The main CRA requirements apply from 11 December 2027. NIS2 entities must manage cyber risk and report significant incidents.
-
cybersecuritydive.com ↗ · pub. 03/11/2026 12:59 · coletado 03/11 14:01 primeiro registro só resumo do feed
European and US authorities investigate ongoing attacks on grocery refrigerators and hacks at US military bases
ler a análise desta fonte ocultar
European authorities are investigating ongoing attacks targeting grocery refrigerators, according to Cybersecurity Dive. US military investigators are working with French agencies after hacks hit domestic bases. The source provides only a headline and subhead. It gives no details on the attack method, vulnerabilities, affected products, victims, attribution or impact. Treat the story as an open investigation with unconfirmed scope.
Technical Details
The source states no technical details, CVEs, indicators or attacker identity.
Remediation
The source gives no remediation guidance. Generic advice for operators of building and refrigeration control systems is to avoid exposing them directly to the internet, restrict remote access, and watch for unexpected configuration changes.