ENISA says EU cyber law does not require patches for end-of-life fridge controllers

What happened

• In early October 2026, remote controllers for refrigeration systems at several French grocery chains were compromised, forcing units into a 50 °C defrost cycle and resulting in massive food loss.
• The EU Cyber Resilience Act, which entered into force last month, obliges manufacturers to report actively exploited vulnerabilities even for products that are no longer sold or supported.
• ENISA clarified that the separate obligation to fix vulnerabilities applies only while a product is under the manufacturer’s support period, which ended for the affected Danfoss and Copeland controllers.
• No perpetrator has been identified and investigations continue.

Why it matters

Manufacturers of discontinued IoT hardware must have processes to log and report exploited flaws, even if they cannot issue patches, while retailers should audit exposed devices and isolate them from the internet.

Business impact

Retail operators may need to redesign network segmentation for legacy equipment, and manufacturers must update incident‑reporting procedures to cover end‑of‑life products.

What to check

1. 1

   Audit inventoryHigh priority

   Identify all connected devices that are end‑of‑life or no longer supported and document their network exposure.

2. 2

   Implement reporting processHigh priority

   Establish a workflow to report any actively exploited vulnerabilities of those devices to national CSIRTs under the Cyber Resilience Act.

3. 3

   Isolate legacy controllersMedium priority

   Disconnect or apply strict firewall rules to internet‑exposed refrigeration controllers until a mitigation strategy is in place.