EU Cyber Resilience Act Does Not Mandate Fixes for Affected Refrigeration Controllers

The European Union’s Cyber Resilience Act, which took effect last month, mandates manufacturers to report cyberattacks on their end-of-life products but does not require them to address the vulnerabilities, according to the EU’s cybersecurity agency.

This announcement follows a cyberattack earlier this month that compromised internet-exposed remote controllers for refrigeration systems at several French supermarkets, causing some units to enter a continuous defrost cycle at 50°C.

Major grocery chains, including Intermarché, Carrefour, Monoprix, Leclerc, and Coopérative U, were impacted, leading to estimated monetary losses in the tens of millions of euros due to spoiled food stock.

France’s cybersecurity agency, ANSSI, confirmed awareness of the compromised refrigeration system controllers, specifically naming Danfoss’s AK-SM and AK-SC series, Copeland’s xweb, and Dixell’s xweb products.

In response to the attack, ANSSI’s emergency response team, CERT-FR, issued an alert last Monday, advising operators to disconnect or filter any controllers exposed to the internet to prevent further incidents.

“Investigations are ongoing,” ANSSI stated, noting it is coordinating preventive and remediation measures across potentially affected sectors, particularly focusing on mass retailers.

Copeland acknowledged the vulnerability in its discontinued generation of controllers and stated it is working with affected customers to mitigate risks. The company emphasized its commitment to supporting customers in enhancing cybersecurity through current products and recommended practices, though it did not disclose the number of affected customers.

Danfoss has not responded to requests for comment but previously indicated that its affected units were also end-of-life.

The Paris prosecutor’s office reported receiving approximately ten complaints and estimated around 700 victims, with an ongoing investigation and no claims of responsibility for the attack thus far.

EU Cyber Resilience Act Provisions

The EU’s Cyber Resilience Act requires manufacturers of connected hardware and software devices sold within the bloc to report actively exploited vulnerabilities and significant incidents affecting their products.

ENISA, the European Union Agency for Cybersecurity, clarified that this obligation extends to end-of-life products that are no longer sold in the EU but remain in use. Reporting obligations persist even after a product with digital elements is no longer supported.

However, the law’s requirements for addressing vulnerabilities, including fixing them and issuing free security updates, only apply during a product’s defined support period. For products placed on the market before December 11, 2027, or those whose support has ended, manufacturers are not obligated to comply with these vulnerability handling requirements.

ENISA declined to provide details on specific notifications received from manufacturers regarding the recent attacks and did not confirm whether any had reported the incidents. The EU CSIRTs Network, which consists of national cyber emergency response teams, is actively exchanging information and monitoring the situation.

ANSSI also stated it is engaged at the European level and maintains regular communication with its counterparts.

Source: The Record