This article was collected and archived by Digital Sovereignty Watch from an institutional or public source relevant to digital sovereignty, technology policy, cybersecurity, cloud services, artificial intelligence or European regulation.
Cybersecurity
Joint statement on cyber incidents in refrigeration systems across the EU
Since 11 October 2026, several commercial refrigeration systems and similar devices have been impacted by cybersecurity incidents in a number of EU Member States.
The European Commission, together with ENISA, the European Union Agency for Cybersecurity, and all relevant EU services, is closely monitoring the situation. Given the large-scale nature of these incidents, cooperation, rapid information-sharing and coordinated response at European level is essential.
Following a new wave of incidents having occurred on 1-2 November, ENISA, the European Commission (DG CNECT), Europol’s European Cybercrime Centre (EC3), the Network of the EU national computer security incident response teams (EU CSIRTs Network) and the European cyber crisis liaison organisation Network (EU- CyCLONe), advise organisations to take immediate action to mitigate exposure in the affected systems.
Affected EU Member States are aware of the situation and are currently investigating the incidents, while providing guidance. The EU CSIRTs Network (EU Member States-appointed CSIRTs and CERT-EU) and EU-CyCLONe (EU national authorities in charge of cyber crisis) are actively exchanging information and monitoring the situation. ENISA and all relevant EU stakeholders will continue to monitor the incidents and contribute to the overall situational awareness at Union level.
The latest advisories published by CSIRTs Network members can be found on their relevant official communication channels. ENISA maintains an advisory collection under: CNW/advisories/2026/CNW-2026-05_retail-incidents.md at main · enisaeu/CNW · GitHub
Organisations should be aware that as of 11 September 2026, manufacturers of hardware and software products must report severe incidents and actively exploited vulnerabilities through the Cyber Resilience Act’s Single Reporting platform, in accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act). More information is available at: https://digital-strategy.ec.europa.eu/en/policies/cra-reporting and www.enisa.europa.eu/cra-srp.
The main cybersecurity requirements laid down in the Cyber Resilience Act (CRA) will apply as of 11 December 2027. Manufacturers of hardware and software products (‘products with digital elements’) will be required to implement security-by-design and ensure security support during the lifecycle of such products, including the remediation of vulnerabilities without delay.
In addition, entities to which the NIS2 Directive (Directive (EU) 2022/2555) applies must implement measures to manage the cybersecurity risks to their operations, and report significant incidents to their national CSIRT or authority. Furthermore, ENISA is actively contributing to strengthening cybersecurity across the EU by promoting secure-by-design and secure-by-default principles in the EU market. Among its key initiatives are the publication of the Secure by Design and Default Playbook and regular Technical Advisories on product security. ENISA also supports information sharing and cooperation as mandated by the NIS2 Directive.
For press questions and interviews, please contact: press@enisa.europa.eu.
The European Commission, together with ENISA, the European Union Agency for Cybersecurity, and all relevant EU services, is closely monitoring the situation. Given the large-scale nature of these incidents, cooperation, rapid information-sharing and coordinated response at European level is essential.
Following a new wave of incidents having occurred on 1-2 November, ENISA, the European Commission (DG CNECT), Europol’s European Cybercrime Centre (EC3), the Network of the EU national computer security incident response teams (EU CSIRTs Network) and the European cyber crisis liaison organisation Network (EU- CyCLONe), advise organisations to take immediate action to mitigate exposure in the affected systems.
Affected EU Member States are aware of the situation and are currently investigating the incidents, while providing guidance. The EU CSIRTs Network (EU Member States-appointed CSIRTs and CERT-EU) and EU-CyCLONe (EU national authorities in charge of cyber crisis) are actively exchanging information and monitoring the situation. ENISA and all relevant EU stakeholders will continue to monitor the incidents and contribute to the overall situational awareness at Union level.
The latest advisories published by CSIRTs Network members can be found on their relevant official communication channels. ENISA maintains an advisory collection under: CNW/advisories/2026/CNW-2026-05_retail-incidents.md at main · enisaeu/CNW · GitHub
Organisations should be aware that as of 11 September 2026, manufacturers of hardware and software products must report severe incidents and actively exploited vulnerabilities through the Cyber Resilience Act’s Single Reporting platform, in accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act). More information is available at: https://digital-strategy.ec.europa.eu/en/policies/cra-reporting and www.enisa.europa.eu/cra-srp.
The main cybersecurity requirements laid down in the Cyber Resilience Act (CRA) will apply as of 11 December 2027. Manufacturers of hardware and software products (‘products with digital elements’) will be required to implement security-by-design and ensure security support during the lifecycle of such products, including the remediation of vulnerabilities without delay.
In addition, entities to which the NIS2 Directive (Directive (EU) 2022/2555) applies must implement measures to manage the cybersecurity risks to their operations, and report significant incidents to their national CSIRT or authority. Furthermore, ENISA is actively contributing to strengthening cybersecurity across the EU by promoting secure-by-design and secure-by-default principles in the EU market. Among its key initiatives are the publication of the Secure by Design and Default Playbook and regular Technical Advisories on product security. ENISA also supports information sharing and cooperation as mandated by the NIS2 Directive.
For press questions and interviews, please contact: press@enisa.europa.eu.