EU cyber law won’t force fixes for fridge controllers hit in French attack

What happened

In early October 2026, remote controllers for refrigeration systems at several French grocery chains were compromised, forcing units into a 50 °C defrost cycle and resulting in massive food loss. The EU Cyber Resilience Act, which entered into force last month, obliges manufacturers to report actively exploited vulnerabilities even for products that are no longer sold or supported. ENISA clarified that the separate obligation to fix vulnerabilities applies only while a product is under the manufacturer’s support period, which ended for the affected Danfoss and Copeland controllers. No perpetrator has been identified and investigations continue.

Why it matters

Manufacturers of discontinued IoT hardware must have processes to log and report exploited flaws, even if they cannot issue patches, while retailers should audit exposed devices and isolate them from the internet.

Business impact

Retail operators may need to redesign network segmentation for legacy equipment, and manufacturers must update incident‑reporting procedures to cover end‑of‑life products.

Checklist

• Audit inventoryHigh priority

  Identify all connected devices that are end‑of‑life or no longer supported and document their network exposure.

• Implement reporting processHigh priority

  Establish a workflow to report any actively exploited vulnerabilities of those devices to national CSIRTs under the Cyber Resilience Act.

• Isolate legacy controllersMedium priority

  Disconnect or apply strict firewall rules to internet‑exposed refrigeration controllers until a mitigation strategy is in place.

Who reported it

Discussion