In October 2026, a cyberattack targeting refrigeration systems in French supermarkets caused operational disruption and significant food losses. The incident, which involved Danfoss equipment among other systems, illustrates the challenges of industrial cybersecurity and highlights the importance of the Cyber Resilience Act for connected product manufacturers.
When a digital vulnerability affects physical operations
During the night of 11 to 12 October 2026, several French food retailers experienced failures in their refrigeration installations following compromises of remote control systems.
The attackers were able to alter the operating parameters of certain systems, including defrost cycles and temperature settings. The consequences for the affected stores were immediate, including food losses, operational interruptions and recovery work.
On 12 October, France’s Government Computer Emergency Response Team (CERT-FR) issued an alert covering several families of refrigeration controllers, including the Danfoss AK-SM and AK-SC series, as well as Copeland and Dixell equipment.
In the industrial sector, this incident is a reminder that the cybersecurity of a connected product directly affects the reliability of the operations it supports.
A supervisory system, sensor or industrial device now forms an interaction point between digital and physical environments. Its compromise can affect production, service quality, installation safety and business continuity, as well as create reputational and financial consequences.
From known vulnerabilities to update challenges
The Danfoss case also highlights a recurring issue in industrial equipment cybersecurity. Discovering a vulnerability, publishing a patch and effectively deploying it are three separate steps.
Security research had already documented vulnerabilities affecting certain refrigeration controllers. However, the investigations available at this stage still make it difficult to establish precisely which mechanism was used in each compromise.
In industrial environments, maintaining connected products often involves several parties. Manufacturers, integrators, operators and technical service providers intervene at different stages of the equipment lifecycle.
An update may require planned work, technical validation or a temporary service interruption. Risk management therefore depends on the quality of the information shared, the identification of affected equipment and coordination between the parties involved.
A patch delivers its full value when its deployment can be organised, monitored and verified.
What the Cyber Resilience Act changes for manufacturers
The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, establishes a common cybersecurity framework for products with digital elements.
Since 11 September 2026, its reporting obligations have required affected manufacturers to notify actively exploited vulnerabilities and severe incidents affecting the security of their products.
An early warning must be submitted within 24 hours of becoming aware of the event, followed by a more complete notification within 72 hours. The process relies on the European reporting platform operated by ENISA.
These obligations also apply to products already placed on the market when they fall within the scope of the Regulation. Their application to the specific Danfoss incident depends on the classification of the facts and the conditions laid down in the legal text.
On 11 December 2027, the CRA’s main requirements will become generally applicable. Manufacturers will notably need to integrate cybersecurity from the design stage, organise vulnerability handling, document conformity and monitor products throughout their support period.
The refrigeration system incident therefore illustrates the full reach of the Regulation. Compliance relies on precise knowledge of products, their components, associated risks and the actions taken throughout their lifecycle.
Responsibility across the entire value chain
Several priorities emerge for digital product manufacturers.
The first is mapping products and their components. Rapidly identifying references, software versions and exposed equipment makes it possible to assess the potential impact of a vulnerability.
The second is vulnerability and patch management. Each alert must be assessed, linked to the affected products and tracked until the appropriate measures have been implemented.
The third is coordination and traceability. Product, Engineering, Cybersecurity, Support and Compliance teams need consistent information and clearly defined responsibilities.
Finally, managing risk requires the ability to document decisions, communications and corrective actions. This continuity supports maintenance operations, conformity assessments and preparation for regulatory obligations.
For companies, the CRA therefore encourages an evolution in product governance practices. Cybersecurity must be addressed over time, from the first design decisions through to the monitoring of equipment in operation.
Hoctave, a product-centred approach to compliance
Recent events confirm the importance of structured and accessible information for managing digital product cybersecurity. This is the perspective behind Hoctave CRA Manager, a European SaaS platform dedicated to managing Cyber Resilience Act compliance. Among other capabilities, it enables manufacturers and software publishers to centralise their products, components, regulatory requirements, vulnerabilities, risks and compliance evidence in a shared environment.
This approach is designed to facilitate team coordination, action tracking and preparation for regulatory deadlines.
Sources and references
- CERT-FR, Security incident targeting remote controllers for refrigeration installations, alert CERTFR-2026-ALE-012, October 2026.
- Claroty Team82, France Supermarket Hacks Expose Risks of Internet-Facing Refrigeration Systems, 12 October 2026.
- European Commission, Cyber Resilience Act – Reporting obligations.
- Regulation (EU) 2024/2847 of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements.