The European Union's Cyber Resilience Act will not compel manufacturers to fix flaws in the refrigeration controllers attacked across French supermarkets, the EU agency ENISA said on Monday 20 October. ENISA confirmed that the Act's reporting duties, which took effect last month, do cover products no longer sold in the bloc or no longer supported — makers must report actively exploited vulnerabilities and severe incidents — but that the separate duty to handle vulnerabilities and issue free security updates applies only during a manufacturer-defined support period. Where a product was placed on the market before 11 December 2027, or its support has ended, "the manufacturer is not required to comply with the vulnerability handling obligations". The intrusion on the night of 11–12 October hijacked internet-exposed controllers and drove continuous defrost cycles reported at up to 50°C at chains including Intermarché, Carrefour, Monoprix, Leclerc and Coopérative U, spoiling stock at a cost estimated in the tens of millions of euros. ANSSI named Danfoss AK-SM and AK-SC series, Copeland xweb and Dixell xweb units — all end-of-life; Copeland and Danfoss each say the affected generation is discontinued, and CERT-FR urged operators to disconnect or filter any controller exposed to the internet. The Paris prosecutor's office told Recorded Future News it has received about ten complaints and estimates roughly 700 victims. Why it matters: the installed base of unsupported industrial kit keeps creating incidents that the new EU regime has explicitly decided not to reach.

• Source article