The CRA no longer looks like an overreaction

A coordinated attack on the refrigeration controllers of hundreds of French supermarkets has made it clear why the Cyber Resilience Act asks for what it asks for. They didn't attack the cold: they attacked the controller.

What happened in France

On the night of Sunday 11 to Monday 12 October, around 500 French supermarkets found their freezer rooms and frozen-food display cases at over 50 °C. There was no data theft and no ransom demand: someone remotely accessed the refrigeration monitoring systems, disabled the alarms using administrator privileges and forced a continuous defrost cycle.

The scope was wide: more than 300 stores of one chain, close to a hundred of another, eighty of a third and around thirty of a fourth. When they opened in the morning, fresh-produce managers found their stock ruined and the floors flooded. Reported losses range from €10,000–15,000 for a small store to €75,000 for a hypermarket, not counting the days of lost sales until shelves were restocked. Several chains have said their insurance does not cover this type of incident.

The Paris prosecutor's office opened an investigation, and France's national cybersecurity agency mobilised to coordinate the response with other European countries. This is not an isolated case affecting a single store: it is a coordinated attack on a country's cold chain.

The technical difficulty was low; the scale was not

The attackers used vulnerabilities that were already known and publicly documented. A cybersecurity expert quoted by the French press put it bluntly: a reasonably handy high-school student could have done it. What did require some sophistication was coordinating the intrusion across hundreds of sites at once.

That asymmetry explains the underlying problem. For decades, a refrigeration controller was an isolated device: it sat in the plant room, was programmed with a keypad and nobody could reach it from outside. It was designed with reliability and cost as priorities, which was the right call in that context. Connectivity came later, bolted onto an architecture that was never meant to withstand anyone.

The attack surface isn't the cold. It's the controller that governs the process and the channel through which it receives commands. It doesn't matter what sits underneath: a supermarket display case, a cold room of several hundred cubic metres, a drying chamber or an oven. What gets attacked is the device that decides the setpoint. And that device costs a few hundred euros, while what it protects can be worth hundreds of thousands and underpin the revenue of an entire business.

The sentence that should make us manufacturers uncomfortable

The manufacturer of the affected controllers responded that most of the units were old products, at the end of their service life, that no longer receive software or security updates.

It is a technically accurate answer and, until recently, a perfectly standard one in our industry. But it points exactly to where the hole is: an industrial refrigeration system is installed to last fifteen or twenty years, and it keeps running and connected long after the electronics that control it are no longer maintained.

A product's commercial life ends. Its operational life doesn't. Between those two dates lies an installed base that stays online with nobody watching over it, and that is where an attack like the one on 12 October fits. As electronics manufacturers, that window is our responsibility, not the installer's or the end user's.

What changes with the Cyber Resilience Act

When the Cyber Resilience Act was published, much of our industry thought it was disproportionate. Declaring a support period, maintaining an inventory of software components, monitoring for years the vulnerabilities in code you didn't write yourself: a heavy burden for an industrial controller that has been running trouble-free for thirty years. Read on Monday 12 October, the bar no longer looks so high.

Regulation (EU) 2024/2847 turns much of the above into a legal obligation for any product with digital elements placed on the European market. Two dates set the timeline:

• 11 September 2026 (already in force). Obligation to report actively exploited vulnerabilities and severe incidents: early warning within 24 hours, notification within 72.
• 11 December 2027. Full application: essential cybersecurity requirements, technical documentation, EU declaration of conformity and CE marking.

What matters for this case is in Annex I, Part II: the manufacturer must declare a support period, maintain an inventory of software components (SBOM), monitor vulnerabilities in those components, provide a reporting channel and a disclosure policy, and be able to distribute patches throughout that period.

In other words, "it's an old product we no longer update" stops being an acceptable explanation for devices placed on the market from that date onwards. It doesn't fix the installed base — the regulation does not apply retroactively except in the case of substantial modification — but it closes the door on the problem repeating itself with every new product generation.

Why we took this path before it was mandatory

At Conatec we have developed our own platform for secure connected electronic products. It is the foundation on which devices such as Smartic Cool, Smartic Dry and our convection oven controller are built.

Its defining elements:

• Crypto chip (secure element). Each device has its own cryptographic identity. Keys are generated and remain inside the chip: they don't travel, can't be extracted and aren't shared between units. Compromising one device doesn't hand over the whole fleet.
• Certificates and mutual authentication. The device verifies who it is talking to, and the platform verifies which device is talking to it. There are no generic factory credentials.
• Secure boot. The bootloader verifies the firmware signature before running it. An unsigned binary won't boot.
• Signed field updates. An installed device can be patched in a verified way, without anyone having to travel to it.
• Encrypted communication and role-based access control, with remote management supported by the platform layer.

The development predates the regulation. We didn't do it to comply with a standard, but because a device that will be connected for fifteen years needs to be maintainable for those fifteen years. But the result is what counts: the platform already incorporates the essential cybersecurity requirements of Annex I and puts us in a position to comply with the Cyber Resilience Act in full when it becomes fully applicable in December 2027 — including a declared support period per product family, a software component inventory and continuous monitoring of its vulnerabilities.

Six questions to ask your electronics supplier

If you build equipment with connected controls and don't know where to start, these six questions do a pretty good job of separating the wheat from the chaff:

1. What security support period does the controller manufacturer declare, and from what date does it start?
2. Can the firmware be updated in the field? Is the update signed, and does the device verify it before installing it?
3. Does each device have its own cryptographic identity, or does the whole fleet share the same credentials?
4. Is there a software component inventory (SBOM), and is someone actively monitoring published vulnerabilities in those components?
5. Is there a vulnerability reporting channel and a disclosure policy, or does the warning come from an angry customer?
6. Can an alarm be disabled through remote access without separate privileges and without leaving a trace?

The sixth explains the French case. The first five are the ones that prevent the next one.

The problem isn't connecting; it's walking away

Nobody is going to give up remote monitoring, and rightly so: it saves site visits, detects deviations before they ruin a batch and makes it possible to account for energy use. The problem isn't connectivity. It's treating a connected device as if it were a closed one, and considering it finished the day it leaves the factory.

A connected controller is a living product. It has maintenance, it has a patch cycle and it has a date until which someone commits to supporting it. That date has to be declared, and then it has to be honoured.

The facts of the incident are drawn from French and Spanish press coverage of 12 and 13 October 2026 (AFP, Sud Ouest). Loss figures are those reported by the chains themselves and may change as the investigation progresses.