The EU’s Cyber Resilience Act requires manufacturers to report serious incidents affecting connected products, but does not compel them to patch end-of-life equipment after support expires.
The European Union’s new cyber rules require manufacturers to report serious incidents and exploited vulnerabilities affecting connected products, including devices that are no longer sold but remain in service. They do not, however, oblige companies to issue fixes for end-of-life equipment once support has expired, according to the bloc’s cybersecurity agency.
That distinction has come into focus after a cyberattack hit hundreds of supermarket refrigeration systems across France, causing display cabinets and cold rooms to surge to about 50°C in some cases and forcing retailers to throw away spoiled stock. French authorities have linked the incident to internet-exposed remote controllers used in refrigeration equipment, naming Danfoss’s AK-SM and AK-SC series, as well as Copeland’s and Dixell’s xweb products. Grocery chains including Intermarché, Carrefour, Monoprix, Leclerc and Coopérative U were reported to have been affected, with losses estimated in the tens of millions of euros.
France’s national cybersecurity agency, ANSSI, said it was aware of the compromise and urged operators to disconnect or filter controllers exposed to the internet to reduce the risk of further attacks. Its emergency response arm, CERT-FR, issued an alert last week, and ANSSI told Recorded Future News that investigations were continuing while preventive and remedial steps were being coordinated across potentially affected sectors, with a particular focus on large retailers.
Copeland said in a statement that it had identified a vulnerability in a discontinued generation of controllers and was working with impacted customers to reduce the risk. The company added that it would continue supporting customers through maintained products, current software and recommended security practices. Danfoss did not respond to a request for comment, although it has previously said the affected units were also end-of-life. France’s Paris prosecutor’s office said it had received about ten complaints, estimated around 700 victims, and said no suspect had yet claimed responsibility.
According to ENISA, the reporting duty under the Cyber Resilience Act still applies to products whose support has ended, even if they are no longer sold in the EU. The agency said the separate obligations to address vulnerabilities, including patching them and providing free security updates, apply only during the manufacturer’s declared support period. For products placed on the market before 11 December 2027, or where support has already ended, ENISA said the manufacturer is not required to meet those vulnerability-handling obligations. The EU CSIRTs Network is now exchanging information and monitoring the situation, while ANSSI said it remains in close contact with its European counterparts.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
