# Legacy Systems Under Attack: French Supermarkets Face Costly Cyber Incident A recent cyberattack has plunged hundreds of French supermarkets into disarray, compromising internet-exposed remote controllers for refrigeration systems. The incident, which forced some units into a continuous defrost cycle at a scorching 50°C, resulted in tens of millions of euros in spoiled food and significant financial losses for major grocery chains including **Intermarché**, **Carrefour**, **Monoprix**, **Leclerc**, and **Coopérative U**. France's cybersecurity agency, **ANSSI**, confirmed its awareness of the compromise, specifically naming **Danfoss**'s AK-SM and AK-SC series, along with **Copeland**'s xweb and **Dixell**'s xweb products. These affected units are notably all end-of-life, highlighting the persistent risks associated with unsupported legacy technology. ## ANSSI and Law Enforcement Respond **CERT-FR**, ANSSI's emergency response team, promptly issued an alert, urging operators to disconnect or filter any internet-exposed controllers to prevent further attacks. ANSSI is actively coordinating preventive and remediation measures across potentially affected sectors, with a particular focus on mass retailers. The Paris prosecutor’s office has received approximately ten complaints, estimating the number of victims at around 700. Investigations are ongoing, and to date, no perpetrator has claimed responsibility for the attack. ## The End-of-Life Dilemma: EU Cyber Resilience Act's Limitations This incident casts a critical light on the **EU's Cyber Resilience Act** (CRA), which took effect last month. The CRA mandates that manufacturers of connected hardware and software devices sold in the bloc — from consumer gadgets to industrial controllers — report actively exploited vulnerabilities and severe incidents affecting their products. **ENISA**, the European Union Agency for Cybersecurity, clarified that this reporting obligation extends to end-of-life products that are no longer sold but remain in use. However, a significant loophole exists: the law's separate obligations to handle vulnerabilities, including fixing them and issuing free security updates, only apply during a product's defined support period. Therefore, for products placed on the market before December 11, 2027, or those whose support has ended, manufacturers are not required to comply with vulnerability handling obligations. This means that while manufacturers must report attacks on their unsupported products, they are not legally compelled to provide fixes, leaving users of legacy systems exposed. ENISA declined to comment on specific notices received from manufacturers regarding this incident but confirmed that the **EU CSIRTs Network** of national cyber emergency response teams is actively exchanging information and monitoring the situation. ANSSI also confirmed its mobilization at the European level, maintaining regular dialogue with its counterparts. ## Industry Acknowledges Vulnerabilities **Copeland** acknowledged the vulnerability identified in a discontinued, end-of-life generation of controllers, stating it is working with impacted customers to mitigate the risk. The company emphasized its commitment to strengthening cybersecurity through supported products, current software, and industry-recommended practices, though it did not disclose the number of affected customers. **Danfoss** has also indicated that its affected units are end-of-life, but has not yet responded to requests for further comment. This incident serves as a stark reminder for IT security professionals and privacy-conscious users about the inherent risks of relying on unsupported, internet-exposed legacy systems. While new regulations aim to improve transparency, the responsibility for securing end-of-life infrastructure largely remains with the operators.