Connected Products Under Attack: The CRA and NIS2 Duties Exposed by the French Refrigeration Case

A cyber attack that disabled refrigeration in roughly 700 French supermarkets has turned the European reporting duties on connected products from a paper exercise into a live test, and it exposes three separate layers of liability that sit with three different parties: the manufacturer of the device, the operator of the site, and the maintenance contractor in between.

What happened

Over the night of Sunday 11 October 2026, attackers reached remote controllers that manage refrigeration plant across French food retail. The French national cyber agency published alert CERTFR-2026-ALE-012 on 12 October and revised it on 13 October to add further equipment. The advisory names four product families: Danfoss AK-SC, Danfoss AK-SM, Copeland xweb and Dixell xweb, the last an Italian brand owned by Copeland. The French finance minister told parliament on 13 October that around 700 of the country’s roughly 10,000 supermarkets were affected, and a scan the same day still found thousands of management interfaces reachable from the internet, as reported here. In one store near Bordeaux the freezer set point moved from minus 22 degrees to 150. Danfoss has stated that the incidents involve a limited number of systems running outdated firmware, mostly obsolete models that no longer receive security patches, and Copeland has attributed the flaw to an end-of-life controller generation. The Paris prosecutor has opened a criminal inquiry, and the French agency warns that the campaign is probably still running.

The technical finding at the centre of the advisory is unremarkable and, for that reason, instructive. The management interfaces were exposed to the internet, on equipment past the end of its support life. The legal consequences of that single configuration decision now run in three directions at once, and the European framework has already assigned each of them to a different party.

Three layers of liability, and only two of them carry a deadline

The manufacturer of the controller. Its primary duty is the reporting of actively exploited vulnerabilities and severe incidents under Article 14 of the Cyber Resilience Act, submitted through the ENISA Single Reporting Platform on a cadence of 24 hours, 72 hours and 14 days, in force since 11 September 2026. Its exposure sits in the support period it has declared for the product, and in whether a registered filer exists on the platform before an incident rather than after one.

The operator of the site, meaning the retailer, the cold chain business or the logistics provider. Its primary duty is incident notification under NIS2, and in Italy the completion of the base security measures by 31 October 2026 for entities included in the national list in 2025. Its exposure sits in operational technology assets that never entered the IT inventory in the first place.

The refrigeration or building management maintenance contractor. It has contractual obligations and ordinary liability in negligence, and no regulatory reporting duty of any kind. Its exposure sits in the decision to expose a management interface to the internet, which is the decision that caused the incident.

The asymmetry is the point of this case. The party that made the configuration choice is the only one of the three with no deadline, no filing obligation and no regulator reading its file, and it is also the party that will be asked to pay.

Connected products and the 24-hour reporting duty

Since 11 September 2026, manufacturers placing products with digital elements on the EU market must report actively exploited vulnerabilities and severe security incidents through the ENISA Single Reporting Platform, which went live on the same date, with an early warning at 24 hours, a notification at 72 hours and a final report at 14 days. The practical mechanics of that duty, and what it does to an incident response plan when the clock starts before the facts are known, are examined in this earlier analysis. Three features of the regime decide how a case like this one unfolds.

1. the trigger is actual exploitation rather than severity. A medium-rated flaw being used in the field starts the clock, while a critical flaw sitting unexploited in a backlog does not.
2. establishment is irrelevant. The duty attaches to placing the product on the EU market, so a manufacturer headquartered in California, Shenzhen or Seoul carries exactly the same 24-hour obligation as one in Milan.
3. the account precedes the incident. The platform operates through a registered filer, and a company that has not registered one cannot submit anything on the first morning. The operational question for any manufacturer is therefore not whether the duty applies, but which named person inside the organisation holds the account today.

The French case adds a fourth question, and it is the one that few manufacturers have answered. A product generation declared end of life still sits in thousands of installations. A manufacturer that announces a product no longer receives security patches has made a statement about its support period, and under the Cyber Resilience Act the support period is a regulated commitment rather than a commercial preference. The gap between the installed population and the supported population is where the next dispute in this area will be fought, and it interacts with the access and data obligations that now attach to the same devices, set out here.

NIS2, and the Italian deadline of 31 October

Food production, processing and distribution fall within the NIS2 sectors, which places large grocery retailers, cold chain operators and food logistics providers inside the regime. In Italy, entities included in the national list in 2025 have been subject to incident notification duties since January 2026 and must complete the base security measures by 31 October 2026 under a 2025 implementing measure of the national cyber agency, a timetable set out in this earlier analysis and whose registration mechanics are described here.

Two practical points follow for operators. Many hold an IT asset inventory that omits building management, refrigeration plant and other operational technology entirely, which means the assets most likely to be exposed to the internet are the assets least likely to appear in the compliance file. And an incident of this kind may produce no personal data breach at all, so the notification path runs to the cyber agency rather than to the data protection authority, while a large number of incident response plans describe only the second route. The allocation problem that follows, when a company’s own technology is the thing that was abused, is examined in this article.

From 23 October 2026 the same agency that holds an Italian company’s NIS2 registration and receives its incident notifications also acquires market surveillance powers over its artificial intelligence systems, including inspections without notice, under the Italian law of 7 October 2026 analysed here. Operators preparing for one deadline should recognise that they are preparing for the same counterparty across three regimes.

The contractual layer, where a connected products incident actually costs money

The French advisory states that exposing a management interface to the internet runs against good practice, and it instructs operators to check their insurance terms before cutting the data link to their refrigeration contractor. Those two sentences sit inside a technical bulletin, and they will be quoted in the claims that follow, because together they identify who made the decision and who insured the consequence.

Recourse against the integrator, the installer or the service company is the highest-value and least exercised part of the chain that an incident of this kind generates. It also has the shortest practical window, because the evidence consists of configurations that the contractor will remediate, often correctly and often without documenting the prior state. Operators that wait for the regulatory phase to close before examining their supply contracts will find the record gone.

Insurance follows the same question

Property damage to perished stock, business interruption and third-party claims from franchisees interact differently under a cyber policy than under a property policy, and the French retailers have already raised coverage questions publicly. Underwriters assessing these claims will ask one question before the others: who authorised the internet exposure, and what did the maintenance contract say about it.

Recommended actions

1. Manufacturers should confirm today that a named registered filer exists on the ENISA Single Reporting Platform, with a deputy, and that the 24-hour decision does not require a committee.
2. Manufacturers should reconcile the installed base against the supported base for every product line, and document what the stated support period commits them to.
3. Operators should extend the asset inventory to building management and refrigeration plant before 31 October, and record every device holding a public IP address.
4. Operators should test the notification path to the cyber agency specifically, separately from the data breach path, because an operational technology incident may never reach the privacy function.
5. Operators should pull the maintenance and integration contracts now and identify who holds the authority to expose a management interface, together with the indemnity that follows that authority.
6. Insureds should notify their carrier on a precautionary basis where the affected product families are present, rather than waiting for confirmed compromise.
7. Trade associations in food retail and in refrigeration should file into the open Italian consultation on enhanced network security measures, where the proportionality of operational technology requirements is still being written.

The incident will be remembered as a story about supermarket freezers. The durable lesson concerns connected products generally, because the European framework has already distributed the duties, attached dates to two of the three parties, and left the third, the one that actually made the configuration decision, with no deadline and the largest financial exposure.