Security News

Hackers Hit Hundreds of French Supermarket Fridges, and EU Law Won't Force Fixes

The Record · 21 Oct 2026

Key Takeaway Check whether any older connected equipment, such as refrigeration or building controllers, is reachable from the internet, and disconnect it or restrict access, since the maker may no longer provide fixes.

Earlier this month, hackers compromised internet-exposed remote controllers for refrigeration systems at numerous French supermarkets. Some units were forced into a continuous defrost cycle at 50°C. Chains including Intermarché, Carrefour, Monoprix, Leclerc and Coopérative U were affected, with losses estimated in the tens of millions of euros as spoiled stock was thrown away. The Paris prosecutor's office estimates around 700 victims, and no one has claimed responsibility.

France's cybersecurity agency ANSSI named Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb products. It urged operators to disconnect or filter any controllers exposed to the internet. Copeland said the vulnerability affects a discontinued, end-of-life generation of controllers and that it is working with impacted customers. Danfoss has said its affected units were also end-of-life.

The EU's cybersecurity agency said its new Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents affecting their products, including end-of-life ones. However, it does not force them to fix the issues. That leaves businesses relying on older connected equipment with a gap: a maker may have to report an attack, but may not have to supply a patch.

IoT security critical infrastructure end-of-life devices EU Cyber Resilience Act retail

Summarised by CISO AI from The Record, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.