NEWS

EU Cyber Law Won't Force Fixes for Fridge Controllers Hit in French Attack

The Cyber Resilience Act requires reporting on attacked products but patching only during a manufacturer-defined support period, leaving hacked fridge controllers unfixed.

Dylan H.

Security Team

October 20, 2026
2 min read
EU Cyber Law Won't Force Fixes for Fridge Controllers Hit in French Attack

Overview

After attackers reached refrigeration controllers across French food retail, a question has surfaced: will the EU's Cyber Resilience Act (CRA), which took effect last month, force manufacturers to fix the exposed devices? According to ENISA's reading, reported by The Record, largely no.

The Attack

  • Attackers reached remote controllers that manage refrigeration plant on the night of Sunday, October 11, 2026.
  • France's finance minister told parliament that around 700 of roughly 10,000 supermarkets were affected.
  • CERT-FR's advisory names four product families: Danfoss AK-SC, Danfoss AK-SM, Copeland xweb and Dixell xweb.
  • The legacy Danfoss AK-SM 800 was declared end of life in May 2021, and the AK-SC 355 was phased out in 2016. Neither receives security updates.
  • The current-generation AK-SM 800A units that were hit had not been updated.

What the CRA Requires

ENISA's position, as described in the reporting:

  • Reporting duties still apply to products whose support has ended, even if they are no longer sold in the EU.
  • Patching and free security updates are required only during the manufacturer's declared support period.
  • For products placed on the market before December 11, 2027, or whose support has already ended, the manufacturer does not have to meet those vulnerability-handling obligations.

The support period must be at least five years, unless the product is expected to be used for less. Manufacturers set it to reflect expected use, so a long-lived industrial device can carry a short declared window. One consultant argued that refrigeration systems expected to last 20 years should be supported that long, but the rules do not force that for devices already sold.

Why It Matters

  • Industrial controllers often outlive their support window by a decade or more.
  • Internet-exposed OT with no patch path is a standing target, and the law currently ensures warnings, not fixes.
  • Operators cannot count on regulation to close the gap for installed equipment.

Recommendations for Operators

  1. Inventory connected OT and building-control devices, including refrigeration and HVAC controllers.
  2. Remove direct internet exposure; put remote access behind a VPN with MFA.
  3. Check vendor end-of-life status and the declared support period before buying.
  4. Apply available firmware updates, including on current-generation units.
  5. Plan replacement for end-of-life hardware that cannot be patched.

Sources