French supermarkets are still counting the cost of a cyberattack that forced refrigeration controllers into a defrost cycle, ruining stock and causing losses estimated in the tens of millions of euros. The compromised devices, made by Danfoss, Copeland and Dixell, were internet-exposed and in many cases end-of-life models. France’s ANSSI and CERT-FR have urged operators to disconnect or filter such controllers while investigations continue.
Under the EU’s Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities and severe incidents even for end-of-life products that remain in use. But ENISA, the EU’s cybersecurity agency, clarified that the law’s vulnerability-handling duties—including fixes and free security updates—apply only during a manufacturer-defined support period. For products placed on the market before December 11, 2027, or whose support has ended, the manufacturer is not required to fix the issue.
Copeland acknowledged the vulnerability in a discontinued generation of controllers and said it is working with affected customers, without saying how many. Danfoss did not respond to a request for comment, though it has described its affected units as end-of-life. The Paris prosecutor’s office has received about ten complaints and estimates around 700 victims; no perpetrator has claimed responsibility.