In short
On 3 November 2026 the ACN issued an alert on attacks against cold-chain control and remote-support systems, with cases in Italy too.
Bulletin BL01/261013/CSIRT-ITA asks you to check Internet exposure immediately, separate plant networks and protect remote access with VPNs and MFA.
Configurations and real temperatures must be checked independently, accounts reviewed and unsupported devices dealt with.
Food businesses in wholesale distribution, industrial production or processing above small-enterprise size are important NIS2 entities: notification at 24 hours, 72 hours and one month.
Over the medium term you need assessment of suppliers with remote access, ISO/IEC 27001 extended to plants and a continuity plan for the goods.
On 3 November 2026 Italy's National Cybersecurity Agency (ACN) issued an alert on the food supply chain and the cold chain. According to the ACN, cyber attacks on the control and remote-support systems of refrigeration have hit operators in several European countries, and the first cases have now emerged in Italy too. The Agency is calling on large-scale retail, food logistics, industrial refrigeration and maintenance providers to apply the urgent measures set out in its technical bulletin.
In this article you will find what the ACN has said, in its own words, why these systems are sensitive, the operational checklist to start straight away, what changes if your company is a NIS2 entity and what to put in place over the medium term with ISO/IEC 27001 and business continuity. You will not find the names of affected companies or products: they are not needed to act, and caution is essential while an alert is ongoing.
What has the ACN said about the cold chain?
The ACN has published two linked documents: an alert announcement dated 3 November 2026 and a CSIRT Italia technical bulletin with verification and mitigation measures. The first explains the context, the second says what to do.
The 3 November alert
According to the announcement, attacks on cold-chain systems have affected operators in several European countries, including Belgium, Luxembourg, Ireland, the Netherlands, Latvia, Finland and Sweden. The Agency also refers to earlier incidents involving supermarket chains in France.
For Italy, the ACN reports that it has received a NIS incident notification from a contract catering company and has identified another attack, not yet notified, on a frozen-food business. The Agency has stepped up monitoring of the sector, announced a meeting with trade federations and the main large-scale retailers, and offered its resources to help businesses improve their resilience.
The technical bulletin for operators
The bulletin is titled "Urgent verification and mitigation measures for food distribution and cold-chain operators" (reference BL01/261013/CSIRT-ITA). It was first published on 13 October 2026 and reissued on 3 November as version 1.1, following events detected in Italy, with its severity rated as high.
According to the ACN, in the incidents in France the attackers exploited outdated equipment, administration interfaces exposed directly to the Internet and weak authentication. This allowed them to change the operating parameters of the plants remotely, breaking the cold chain and causing significant economic losses. The bulletin is aimed at large-scale retail, food logistics, industrial refrigeration and related maintenance services.
Why are refrigeration systems such a sensitive target?
The cold chain combines two risks: food safety and business continuity. An attack on a control system does not just stop a computer; it can compromise the goods in storage.
When the damage is physical, not just digital
In a classic cyber incident the damage concerns data and services. Here the effect is on the temperature of cold rooms, refrigerated display cases and warehouses. The ACN bulletin is clear: assessing the food safety of affected products is a matter for the responsible staff, and getting back to the right temperature does not, on its own, prove that storage conditions were maintained.
For a business in the supply chain, this means a cyber incident can turn into goods to be assessed or disposed of, missed deliveries and customers to be informed. That is why the ACN asks for quality and food-safety staff to be involved, not just IT.
Remote support and maintenance providers: the most used door
Many refrigeration plants are managed remotely by whoever installs or maintains them. It is operationally convenient, but every connection is an access point to be checked. The bulletin explicitly lists remote-support services, connections set up by maintenance providers and cellular routers among the items to be inventoried.
The typical problem is not bad faith on the supplier's part. It is the connection opened years ago for a job, never closed, with default credentials and nobody remembering it exists. A typical case is a supermarket whose control panel for the refrigerated cases is reachable from the Internet for the technician's convenience.
What to do now: the ACN's operational checklist
The ACN recommends starting a set of activities immediately. We have grouped them by area so you can assign each one to a named person today.
Inventory and Internet exposure
The first step is knowing what you have and what is reachable. The bulletin asks you to catalogue controllers, SCADA systems, operator panels (HMIs), IoT gateways and remote-access services, and to identify everything exposed to the Internet, including cellular routers and supplier connections.
Without this list every other measure remains partial. A shared spreadsheet with the plant, site, who manages it, how it is accessed and whether it is reachable from outside is already a good start.
Network separation and remote access
The ACN asks you to separate the plant network (OT) from the corporate network, the user network and the guest network. Firewall rules must deny everything not expressly allowed; according to the bulletin, VLANs alone are not enough. Outbound connections should also be restricted, and administration consoles placed on dedicated management networks.
For remote access, the bulletin calls for controlled VPNs with multi-factor authentication, jump hosts and per-user permissions. It also recommends disabling HTTP and other unencrypted protocols.
Privileged accounts and credentials
The bulletin asks you to review all accounts used for administration, technical work and maintenance. Unused ones should be disabled, default or weak credentials changed and, if credential theft is suspected, active sessions and tokens revoked.
A shared "maintenance" account used by several technicians, perhaps from different companies, is exactly the kind of situation to close first.
Configuration integrity and real temperatures
Here the ACN asks for a check specific to refrigeration: compare current configurations with the authorised ones. The bulletin mentions set points, defrost schedules, alarm thresholds and notification recipients.
It also asks you to check real temperatures independently of the supervision platform, because if the system has been tampered with, what it displays may not be reliable either. Finally, it says to review logs, going back over the last 90 days where they are retained, without delaying the immediate checks.
Devices that are no longer supported
Equipment the manufacturer no longer updates should be identified and dealt with one by one. The bulletin says to apply patches where compatible, decommission what is not needed and isolate what must stay in service while planning its replacement.
For longer-term actions the ACN asks for a formal plan with owners and deadlines. This is the point at which the emergency becomes management.
How do you prepare to recover if plants are tampered with?
The bulletin does not stop at prevention: it asks you to be ready to respond. The resilience measures cover backups, manual procedures and exercises.
Configuration backups and restore testing
The ACN asks you to check backups of configurations and PLC programs and to test restoration. A backup that has never been tested does not tell you whether the plant will come back as before, or how long it will take.
Manual emergency procedures
The bulletin says to prepare manual emergency procedures to keep goods cold even if the control systems cannot be trusted. Who does what, with which independent measuring instruments, who decides to move the goods: these are decisions to make beforehand, not during the incident.
An exercise with every function involved
The ACN recommends an incident response exercise involving IT, plant, maintenance, logistics and food-safety staff. It is the quickest way to discover that the on-call maintenance number for nights is missing, or that nobody knows who can authorise disconnecting a plant.
Lastly, the bulletin asks for anomalies to be reported promptly to the ACN through CSIRT Italia channels. It specifies that the time windows it gives are recommended operational targets and do not replace applicable notification obligations.
What changes if your company is a NIS2 entity?
If you fall within NIS2, the bulletin's measures link to obligations already in force: security measures and incident notification. First, though, you need to check whether you are in scope.
Who falls within the food sector
Legislative Decree 138/2024, which transposes the NIS2 Directive in Italy, lists production, processing and distribution of food among the other critical sectors (Annex II). According to the ACN FAQs, this covers food businesses carrying out wholesale distribution, industrial production or industrial processing, established in Italy and above the small-enterprise thresholds; they are treated as important entities.
If your company plays a different role in the supply chain, such as transport, services or maintenance, check your position in the ACN FAQs on sectors and entity types. In any case, the alert concerns all cold-chain operators, whether or not they are NIS2 entities.
Incident notification: the deadlines
For NIS2 entities, significant incidents must be notified to CSIRT Italia under Article 25 of Legislative Decree 138/2024. An incident is significant if it has caused or can cause severe operational disruption or financial loss, or considerable impact on other people.
Stage | Deadline | Key content |
|---|---|---|
Early warning | Within 24 hours of becoming aware | Where possible, whether the incident may stem from unlawful or malicious acts or have a cross-border impact |
Notification | Within 72 hours of becoming aware | Update, initial assessment of severity and impact, indicators of compromise where available |
Final report | Within one month of notification | Description, likely cause, mitigation measures, any cross-border impact |
Tampering with temperatures that compromises goods may qualify as a significant incident: it has to be assessed case by case, against the criteria in the decree. That is why it pays to have criteria and owners already defined, as we explain in our guide to the first 72 hours after a data breach.
The security measures required
Article 24 of the decree lists the minimum elements of the measures. Several match what the ACN asks for the cold chain: business continuity with backups, recovery and crisis management (letter c), supply-chain security (letter d), access control and asset management (letter i), multi-factor authentication (letter l).
Article 23 gives management bodies the task of approving the measures and overseeing their implementation. In practice, checking refrigeration systems is not just a technical matter: it is a decision for senior management. For the full picture of obligations, read our guide to ISO 27001 and NIS2.
How should you manage suppliers with remote access?
Supplier management is where many companies are most exposed. The ACN bulletin asks you to review every remote-support connection and to limit supplier access to authorised resources and time windows only, logging activity and revoking permissions.
What to ask your maintenance provider
For each supplier with access to the plants you need clear answers: how they connect, with which credentials, who is authorised, whether access is always open or enabled on request, and where the logs are kept. If the contract says nothing, now is the time to put the rules in writing.
For NIS2 entities, Article 24(3) requires you to consider each supplier's specific vulnerabilities and the quality of its security practices. Even without an obligation, it is common sense.
Assessing suppliers in a structured way
A lasting approach relies on a periodic assessment of critical suppliers, with criteria, evidence and a review whenever something changes. ISO standards already require this: you will find the method in our guide to supplier evaluation under ISO. The refrigeration maintenance provider should be treated as a supplier holding part of your business continuity in its hands.
What to do over the medium term: ISO 27001 and business continuity
The urgent checks close the most obvious gaps. To stop them reopening you need a system that keeps them in place: an up-to-date inventory, reviewed access rights, assessed suppliers, tested plans.
ISO/IEC 27001 as a framework
An ISO/IEC 27001 information security management system covers exactly these areas: risk assessment, asset management, access control, supplier relationships, incident management and continuity. Bringing plants and OT networks into scope, not just office IT, is the choice that makes the difference for businesses working with refrigeration.
If you are starting from scratch, the minimum cybersecurity measures for SMEs are the foundation: multi-factor authentication, named accounts, tested backups, updates.
Business continuity for the goods, not just the servers
A business continuity plan for a cold-chain business must answer a practical question: what do we do with the goods if for a few hours we cannot trust the systems? The manual procedures, emergency contacts and product assessment criteria the ACN asks for belong there.
Our guide to the business continuity plan for SMEs explains how to set it up; ISO 22301 is the reference if you want to build it into a certifiable system.
How Complaion helps with NIS2 and information security
Complaion supports companies with NIS2 compliance and with the certifications that underpin it. A dedicated Lead Auditor starts from where you are: whether you fall within NIS2, what you already have and what is missing, and proposes the route that suits you best among NIS2 compliance, ISO 27001 certification and ISO 22301 for business continuity.
The platform gathers the evidence, manages policies and procedures, keeps the schedule of reviews and obligations and gets you ready for the audit. The Lead Auditor also conducts the internal audit, so you know whether the measures work before any external check. On the technical side you can add a penetration test and, for personal data, an outsourced DPO.
More than 1,000 clients have already chosen Complaion. If you want to work out where to start, get in touch.
Frequently asked questions about the ACN cold-chain alert
What has the ACN asked cold-chain businesses to do?
The ACN has asked them to check urgently whether refrigeration control and remote-support systems are exposed to the Internet and, where necessary, to isolate them from corporate networks. It recommends remote access through VPNs with multi-factor authentication, a review of privileged accounts and the updating or replacement of devices that are no longer supported. The technical bulletin adds configuration checks, backups, emergency procedures and exercises.
Who is the alert aimed at?
The bulletin is aimed at large-scale retail, food logistics, industrial refrigeration and related maintenance services. It does not concern only NIS2 entities: it is addressed to all operators that run or maintain cold-chain plants.
Is my food business subject to NIS2?
It depends on activity and size. According to the ACN FAQs, the scope covers food businesses carrying out wholesale distribution, industrial production or industrial processing that exceed the small-enterprise thresholds; they are important entities. If you play another role in the supply chain, check your position in the ACN FAQs or with qualified support.
If a plant is tampered with, do I have to notify it?
If you are a NIS2 entity and the incident is significant, you must notify CSIRT Italia: an early warning within 24 hours, notification within 72 hours and a final report within one month. The ACN bulletin in any case invites everyone to report anomalies promptly through CSIRT Italia channels. The bulletin's guidance does not replace applicable notification obligations.
If the temperature returns to normal, are the goods safe?
Not necessarily. According to the ACN, restoring the temperature does not on its own prove that storage conditions were maintained. Assessing the food safety of the products involved is a matter for the responsible staff.
What should I ask the plants' maintenance providers?
Ask how they connect, with which credentials, who is authorised and where the logs are kept. The ACN recommends limiting supplier access to authorised resources and time windows, logging activity and revoking permissions that are no longer needed. Put these rules in writing in the contract.
Is ISO 27001 enough to comply with NIS2?
In Italy, ISO/IEC 27001 certification does not create a presumption of conformity with NIS2. It is, however, a very useful framework: risk assessment and the management of assets, access, suppliers and incidents cover much of what is required. It makes sense to use it as a foundation and check coverage against the ACN specifications.
