EU Cyber Rules Won't Force Fixes For End-of-Life Controllers Hit in French Supermarket Attacks
New EU legislation only mandates security updates during a product's defined support period, leaving exploited legacy devices without mandatory patches.
Key points
- Hackers compromised remote controllers for refrigeration systems at hundreds of French supermarkets, causing significant spoilage losses.
- The European Union’s Cyber Resilience Act requires reporting of exploited vulnerabilities but does not mandate fixes for end-of-life products.
- Affected devices include discontinued models from Danfoss, Copeland, and Dixell, which manufacturers classify as outside their support window.
The European Union’s new cybersecurity regulations do not compel manufacturers to issue security patches for end-of-life products that are actively being exploited, the bloc’s cybersecurity agency stated on Monday. This clarification follows a recent cyberattack that targeted refrigeration controllers at numerous French grocery stores, forcing systems into destructive high-temperature defrost cycles and resulting in substantial financial losses for the affected retailers.
According to reports, hackers targeted internet-exposed remote controllers for refrigeration units, driving temperatures up to 50°C. This action forced continuous defrost cycles that ruined food inventory across multiple major supermarket chains. The incident highlights a significant gap in regulatory protection for legacy hardware, as the new rules focus on products currently within their manufacturer-defined support periods rather than abandoned or discontinued equipment.
Regulatory Scope and Limitations
The EU’s Cyber Resilience Act, which took effect last month, mandates that manufacturers report severe incidents and actively exploited vulnerabilities affecting connected hardware and software sold within the bloc. However, the agency clarified that the law only requires companies to provide free security updates and fixes during the product’s official support period. Since manufacturers define the length of this support window, devices that have reached end-of-life status are exempt from mandatory patching requirements under the new legislation.
This distinction means that while vendors must disclose when their old products are being attacked, they are not legally forced to remediate the underlying security flaws. The agency’s statement on Monday served to manage expectations regarding the reach of the new rules, confirming that the regulatory framework prioritizes current products over legacy systems that are no longer officially maintained or supported by their original creators.
Industry Impact and Response
France’s cybersecurity agency, ANSSI, confirmed awareness of the compromise involving specific remote controller models. The agency named Danfoss’s AK-SM and AK-SC series, Copeland’s xweb products, and Dixell’s xweb units as the affected devices. ANSSI’s emergency response team, CERT-FR, issued an alert last Monday urging operators to immediately disconnect any internet-exposed controllers or implement strict filtering to prevent further unauthorized access and damage to their refrigeration infrastructure.
Copeland
What to do and how to stay safe
- Data brokers aggregate public records and sell profiles without your direct consent.
- Manual opt-out is the only reliable method because automated tools often fail.
- Deletion is temporary; you must repeat the process to maintain privacy.
Data brokers will continue to collect and sell your information unless you manually opt out of each service. Schedule regular checks to remove your data and maintain your privacy over time.
Step-by-step guide: How to Remove Data from Data Brokers: The Manual Cleanup Process
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
