EU Agencies Coordinate Response to Refrigeration-System Cyber Incidents

Summary

EU agencies say a new wave of refrigeration-system cyber incidents occurred on November 1–2. Member States are investigating, while EU bodies coordinate information-sharing and response; the article also outlines Cyber Resilience Act reporting requirements and dates.

Key points

• ENISA, the European Commission, Europol’s EC3, the EU CSIRTs Network and EU-CyCLONe are monitoring the incidents and coordinating information-sharing.
• A new wave of incidents reportedly occurred on November 1–2; affected Member States are investigating and providing guidance.
• Organisations are advised to take immediate action to mitigate exposure in affected systems; the statement does not detail specific mitigation steps.
• From September 11, 2026, manufacturers must report severe incidents and actively exploited vulnerabilities through the Cyber Resilience Act’s Single Reporting platform.
• The Cyber Resilience Act’s main cybersecurity requirements apply from December 11, 2027, including security-by-design and lifecycle security support for products with digital elements.
• Entities covered by NIS2 must manage cybersecurity risks and report significant incidents to their national CSIRT or authority.