- ENISA says the EU Cyber Resilience Act requires makers to report attacks on end-of-life products, but not to fix them once support has ended.
- Intruders took over internet-exposed refrigeration controllers at French supermarkets. The Paris prosecutor's office estimates about 700 victims.
- Leaders should list connected equipment, find which items are past support, and take them off the internet or replace them.
A smoke alarm that calls the fire brigade does not put out the fire. The EU's new cyber law works a little like that for old devices. ENISA, the EU's cybersecurity agency, described the gap this week after an incident at French supermarkets. The maker must tell the authorities. The maker need not repair the product. In practice, the owner is left carrying the risk.
What happened in French supermarkets
The Record, citing reports from the time, says intruders took over remote controllers for supermarket cooling systems in France earlier this month. The controllers were reachable from the internet. Some units were reportedly forced into a nonstop defrost cycle at 50°C.
Retailers hit included Carrefour, Intermarché, Leclerc, Monoprix and Coopérative U. Reported losses run to tens of millions of euros. The reports link them to spoiled food that had to be thrown away.
The Paris prosecutor's office spoke to Recorded Future News. It said it holds about ten complaints and estimates around 700 victims. It added that no one has claimed responsibility. Its investigation continues.
The devices were past their support date
France's cybersecurity agency ANSSI named the products involved. They are Danfoss's AK-SM and AK-SC series, Copeland's xweb and Dixell's xweb. ANSSI's response team, CERT-FR, issued an alert. ANSSI told operators to cut off or filter internet access to any exposed controller.
Copeland described the weakness as sitting in "a discontinued, end-of-life generation of controllers." It said it was working with affected customers. It gave no customer count. Danfoss did not answer the reporter's request. It has said its affected units are also end-of-life.
End-of-life means the maker has stopped supporting the product. No new security updates are expected.
The report does not explain the flaw itself. It does show a familiar setup: a control system in daily use that anyone on the internet can reach.
What the EU law covers and what it leaves out
Parts of the Cyber Resilience Act took effect last month. Makers of connected products sold in the EU must report flaws that attackers are actively using. They must also report severe incidents. ENISA told Recorded Future News this covers products "no longer sold in the EU, but which remain in use."
Fixing is a separate duty. It includes repairing flaws and issuing free security updates. ENISA said it applies only while a product is in its support period. Manufacturers set that period.
The Record reports ENISA's view on the French case. Support for these controllers has ended. On that basis, ENISA said, the makers owe no duty to handle vulnerabilities in them. The same relief applies, it added, to products first placed on the market before December 11, 2027.
ENISA would not say whether any maker had reported these incidents. It said the EU CSIRTs Network, a group of national response teams, is exchanging information and monitoring the situation.
The lesson: the support date decides who pays
On ENISA's account, the law splits two duties. Telling regulators lasts as long as the product is in use. Repairing it ends when support ends.
A report helps authorities spot a pattern. It does not patch a controller inside a store. The maker sets the support date, and buyers may not learn its consequences until something goes wrong.
This is one incident. The sources do not show it is typical. It does show where the cost landed here: on grocers who discarded stock.
Questions to put to your team
Ask for a list of connected equipment that keeps the business running. Include cooling, building controls and industrial systems. Ask which items are past their support date, and who tracks that date. Ask which can be reached from the internet, and why.
ANSSI's advice is a sound first step: disconnect exposed controllers or filter access to them. Then ask what it would cost to replace each unsupported device. Write the support period into purchase contracts. Ask what the supplier will do when it ends.
A report records the damage. A supported product, or a replacement, is what prevents it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
