French Fridge Hack Exposes Cybersecurity Gap

The damage from a cyberattack can arrive in the chilled aisle. Across hundreds of French supermarkets, compromised refrigeration controllers left retailers throwing away spoiled food, exposing the consequences of connecting essential equipment to the internet. Now the incident has highlighted a limit in Europe’s new cybersecurity legislation: manufacturers must report attacks affecting unsupported products, but the rules do not necessarily require them to repair the weaknesses exploited.

The Paris prosecutor’s office estimates around 700 victims and has received approximately ten complaints, according to The Record. Investigators have not identified anyone claiming responsibility. France’s cybersecurity agency confirmed compromises involving Danfoss AK-SM and AK-SC controllers, alongside Copeland and Dixell xweb products. Copeland said the vulnerability concerned a discontinued generation of controllers and that it was helping affected customers mitigate risks. Danfoss has also described its affected units as having reached the end of their supported lives.

The distinction between reporting and repair is central. The Cyber Resilience Act’s reporting obligations began on 11 September 2026, while its main product requirements apply from 11 December 2027. ENISA told The Record that reporting duties continue after support ends, but vulnerability handling obligations do not. European Commission guidance also explains that products placed on the market before December 2027 generally escape the broader requirements unless subsequently substantially modified. The legislation therefore improves authorities’ visibility of attacks without automatically providing a route to patches for older equipment still serving businesses.

For supermarket operators, the immediate response rests on securing access. CERT-FR recommends removing public internet exposure, checking controller settings, including defrost schedules, and restoring remote access through a secure VPN or protected network. Temporary filtering is an emergency measure, not a lasting solution. The incident brings a purchasing question into sharper focus: how long will digital protection last for equipment expected to remain operational for years?