Overnight, between the 11th and 12th of October 2026, a refrigeration controller somewhere in France accepted an instruction it should never have received.

Across several of France’s largest supermarket chains, refrigeration systems that should have been keeping meat, dairy and frozen goods at safe temperatures were instead operating at dangerously high temperatures.

On the 12th of October 2026, the Paris Prosecutor’s Office confirmed that it had opened an investigation into a large-scale cyberattack targeting connected refrigeration systems at food retailers across the country. Reports indicated that attackers had manipulated refrigeration controls, causing temperatures to rise and disrupting normal cooling operations.

The consequences were significant. Retailers were forced to dispose of spoiled food, with substantial financial losses reported across affected stores.

This was not a conventional attack targeting payment systems or customer databases. Instead, the attackers targeted the operational technology responsible for keeping food safe.

The incident demonstrates an important point: a cyberattack does not need to involve stolen data or ransomware to cause serious financial and operational damage.

Understanding the Cybersecurity Risk

What makes this incident particularly concerning is the pattern of disruption. Multiple competing retailers were affected within a relatively short period, suggesting a potential common weakness within the connected refrigeration supply chain rather than a series of unrelated equipment failures.

According to published reports, the attack has been linked to vulnerabilities affecting refrigeration control systems supplied by Danish manufacturer Danfoss. The attackers reportedly exploited older versions of the control software to manipulate refrigeration settings and defrost functions, causing temperatures to rise and disrupting normal operations. The incident highlights the risks associated with outdated software and insufficient security oversight of connected operational technology.

For those working in operational technology (OT) security, the risks associated with connected refrigeration systems are not new.

In September 2025, security researchers at Armis disclosed ten vulnerabilities, collectively known as Frostbyte10, affecting Copeland E2 and E3 controllers. These devices are used to manage critical building systems, including refrigeration compressors, condensers, walk-in refrigeration units, heating, ventilation and air conditioning (HVAC), and lighting.

Although the Copeland vulnerabilities have not been linked to the French incident, the research highlighted similar risks within connected operational technology.

The vulnerabilities identified by Armis could potentially allow attackers to:

• Manipulate refrigeration settings and operational parameters.
• Disable or disrupt critical equipment.
• Gain unauthorised access to connected systems.
• Execute malicious code remotely.
• Access sensitive operational information.

Following the disclosure, firmware updates and mitigation guidance were made available. However, the availability of security updates does not necessarily mean they have been implemented across all affected environments.

This reflects a broader challenge within operational technology environments.

Connected refrigeration controllers and similar devices are frequently installed and maintained by third-party service providers. Once commissioned, they may remain operational for many years, sometimes with limited security oversight.

Common weaknesses include default or weak credentials, unnecessary network services, outdated firmware, insufficient network segmentation and limited visibility of vulnerabilities.

For organisations purchasing and operating these systems, managing cybersecurity risks can be particularly challenging. Security updates may depend on manufacturers or specialist maintenance providers, while applying changes to operational equipment may require careful planning to avoid disrupting essential services.

These challenges can leave vulnerabilities unaddressed for extended periods, potentially exposing critical business operations to cyberattacks.

This is precisely the type of systemic weakness that the European Union has sought to address through the Cyber Resilience Act.

The Cyber Resilience Act Is No Longer Just a 2027 Requirement

The European Union’s Cyber Resilience Act (CRA), formally Regulation (EU) 2024/2847, introduces cybersecurity requirements for products with digital elements made available on the EU market.

Its objective is to improve the cybersecurity of connected hardware and software throughout their lifecycle, placing greater responsibility on manufacturers and other relevant economic operators to ensure that security is considered from product design through to ongoing support.

Many organisations associate the CRA with the 11th of December 2027, when its principal cybersecurity requirements become applicable.

However, an important milestone has already passed.

From the 11th of September 2026, manufacturers became subject to mandatory reporting obligations for actively exploited vulnerabilities and severe incidents affecting the security of products with digital elements.

There are several important considerations.

Reporting Obligations Apply to Existing Products

The CRA reporting requirements are not limited to products placed on the EU market after December 2027.

They also apply to relevant products already made available on the EU market, including equipment installed and operating for several years.

This distinction is important for manufacturers supporting older connected products that may still be widely deployed across customer environments.

Although the principal product cybersecurity requirements generally apply from December 2027, manufacturers cannot assume that existing products fall outside the current reporting obligations.

The Reporting Deadlines Are Short

Manufacturers must report actively exploited vulnerabilities and severe incidents affecting the security of their products within defined timescales.

The reporting process includes:

• Within 24 hours: An early warning notification following awareness of the relevant vulnerability or incident.
• Within 72 hours: A more detailed notification containing the information available about the vulnerability or incident.
• Final reporting: For actively exploited vulnerabilities, a final report is required no later than 14 days after a corrective or mitigating measure becomes available. For severe incidents, the final report is due within one month of the 72-hour notification.

Notifications are submitted through the CRA Single Reporting Platform, operated by the European Union Agency for Cybersecurity (ENISA), and routed to the relevant Computer Security Incident Response Team (CSIRT).

These requirements mean that manufacturers need established processes for identifying, assessing, escalating and reporting cybersecurity issues.

Discovering a serious vulnerability is only the beginning. Organisations must also understand whether it meets the reporting criteria, who is responsible for making that decision and how the notification will be submitted within the required timeframe.

Non-Compliance Can Have Significant Consequences

The CRA introduces substantial potential penalties for non-compliance.

Under Article 64, breaches of the essential cybersecurity requirements and certain manufacturer obligations, including those relating to vulnerability and incident reporting, may result in administrative fines of up to €15 million or 2.5% of total worldwide annual turnover for the preceding financial year, whichever is higher.

The regulation also provides for different penalty levels and specific exceptions, including certain provisions affecting microenterprises and small enterprises.

Although the application of penalties is subject to the regulation’s implementation and enforcement arrangements, the potential financial consequences reinforce the importance of establishing appropriate compliance processes.

Responsibilities Extend Beyond Original Manufacturers

The CRA’s scope is not necessarily limited to the organisation that originally developed or manufactured a product.

Importers and distributors may assume manufacturer responsibilities in certain circumstances, including where they place a product on the market under their own name or trademark or make substantial modifications to it.

This is particularly relevant to organisations that rebrand connected devices or incorporate third-party technology into products supplied to customers.

The important question is not simply who manufactured the original equipment, but which organisation has responsibility for the product under the regulation.

For businesses operating within complex technology supply chains, understanding these responsibilities is an essential part of determining CRA applicability.

What Should Organisations Be Doing Now?

The French supermarket incident provides a timely reminder that weaknesses in connected products can have consequences far beyond the technology itself.

For manufacturers, importers, distributors and organisations operating connected equipment, the immediate priority should be understanding their exposure and establishing appropriate security controls.

For Manufacturers and Suppliers of Connected Products

Organisations that develop, manufacture, rebrand or substantially modify connected products intended for the EU market should consider the following activities:

• Establish CRA applicability: Identify which products fall within scope and determine the organisation’s regulatory responsibilities.
• Review existing products: Assess the security and support arrangements for products already available on the EU market, particularly in relation to the reporting obligations.
• Establish vulnerability management processes: Ensure vulnerabilities can be identified, assessed, prioritised and addressed throughout the relevant product support period.
• Develop incident reporting procedures: Define responsibilities, escalation arrangements and decision-making processes to support the 24-hour and 72-hour reporting requirements.
• Review product security controls: Assess secure configuration, authentication, access controls, software updates and protection against known exploitable vulnerabilities.
• Plan for the 2027 requirements: Conduct a gap assessment against the CRA’s essential cybersecurity requirements, including technical documentation, conformity assessment and applicable CE marking obligations.

These activities should form part of an established product security programme rather than being treated solely as a documentation exercise.

For Organisations Operating Connected Equipment

Businesses that purchase and operate connected products may not automatically be subject to the CRA’s manufacturer obligations. However, they remain exposed to the operational and financial consequences of weaknesses in those products.

Organisations should therefore review how connected equipment is managed within their existing cybersecurity and supplier assurance arrangements.

Key considerations include:

• Maintaining an inventory of connected equipment and identifying critical operational dependencies.
• Confirming whether manufacturers continue to provide security updates and vulnerability support.
• Reviewing remote access arrangements, privileged accounts and network segmentation.
• Establishing how suppliers communicate vulnerabilities, incidents and available security updates.
• Ensuring cybersecurity responsibilities are clearly documented within supplier contracts and service agreements.
• Including connected operational technology within relevant risk assessments, incident response planning and business continuity arrangements.

The objective is to ensure that connected equipment receives an appropriate level of cybersecurity oversight throughout its operational lifecycle.

How Locked Stack Can Help

Preparing for the Cyber Resilience Act requires more than understanding the regulation. Organisations need to demonstrate that appropriate cybersecurity controls, processes and supporting evidence are in place.

At Locked Stack, our experience in cybersecurity assessments, penetration testing and regulatory compliance provides a foundation for supporting organisations as they evaluate their CRA readiness.

Our Qualified Security Assessor (QSA) experience under the Payment Card Industry Data Security Standard (PCI DSS) reinforces an evidence-based approach to cybersecurity, including clearly defined scope, documented responsibilities, technical testing and verification of implemented controls.

We can support organisations through:

• CRA Scope and Applicability Assessments: Identifying relevant products, determining potential obligations and establishing the boundaries of compliance responsibilities.
• Cybersecurity Gap Assessments: Reviewing existing product security arrangements against the CRA’s applicable requirements and identifying areas requiring improvement.
• Penetration Testing: Assessing connected products, supporting applications, management platforms and associated infrastructure for security weaknesses.
• Vulnerability Management: Reviewing vulnerability identification, remediation, patch management and supporting processes, including Approved Scanning Vendor (ASV) services where relevant.
• Vulnerability Disclosure and Incident Reporting: Supporting the development of coordinated vulnerability disclosure arrangements and incident reporting procedures aligned with the CRA’s reporting requirements.
• Supplier Assurance: Reviewing third-party security responsibilities, contractual arrangements and vulnerability notification processes.
• Regulatory Alignment: Helping organisations align relevant cybersecurity controls with existing frameworks and obligations, including ISO/IEC 27001, the NIST Cybersecurity Framework, the General Data Protection Regulation (GDPR), the Digital Operational Resilience Act (DORA) and the NIS2 Directive, where applicable.

With operations in Europe and the United States, Locked Stack supports organisations in understanding cybersecurity risks and developing practical, proportionate approaches to compliance.

The Important Question

The French supermarket incident demonstrates how vulnerabilities in connected equipment can quickly become significant business risks.

As organisations continue to connect operational systems to wider networks and remote management platforms, the distinction between traditional IT security and operational resilience becomes increasingly important.

The Cyber Resilience Act represents a significant development in addressing these risks by introducing clearer cybersecurity responsibilities for products with digital elements.

Although the principal requirements will apply from December 2027, the reporting obligations are already in effect.

For organisations manufacturing, supplying or operating connected products, the important question is no longer simply whether the CRA will apply, but what responsibilities exist today and what needs to be in place before the remaining requirements take effect.

Understanding that scope is the logical starting point for developing an effective and proportionate compliance programme.

Sources and References

1. Le Monde (12th of October 2026). French supermarket cyberattack and refrigeration system disruption.
2. Reuters (12th of October 2026). Hackers Heat French Supermarket Fridges, Sparking Fires and Food Losses.
3. BleepingComputer (12th of October 2026). Cyberattack Shuts Down Refrigerators at French Supermarkets.
4. Armis Security Research (2025). Frostbyte10: Ten Vulnerabilities Affecting Copeland Refrigeration Controllers.
5. European Union (2024). Regulation (EU) 2024/2847: Cyber Resilience Act.
6. European Commission. Cyber Resilience Act: Legislative Summary.
7. European Commission. Cyber Resilience Act: Reporting Obligations.
8. European Union Agency for Cybersecurity (ENISA) (2026). The CRA Single Reporting Platform Is Launched.