French Supermarket Hack Underscores the Need for the EU CRA

Refrigerator temperatures spiking over 100°F and ruining millions of Euros worth of perishable food. This was the reality of a massive cyberattack that impacted hundreds of supermarkets across France and other EU countries this week.

The attackers executed this physical destruction by accessing Danfoss refrigerator control units that had been left exposed to the public internet. The hackers were able to gain access to these devices and forced the refrigeration systems into continuous defrost cycles.

The suspected method of compromise is an authentication bypass widely referred to as the "code-of-the-day" vulnerability. The exploit was simple: upon request, the device discloses its internal date from memory. Then that date can be used as a password to access the device and change modes of operation.

While a software patch for this bug was eventually provided for newer Danfoss controllers, older Danfoss controllers—which were the main targets of the attack—are at an "End-of-Life" (EOL) status. Because of this EOL status, they were no longer receiving necessary software updates. Unfortunately thousands of these older units were still in operation, on the public internet, and vulnerable to the “code-of-the-day” authentication bypass attack.

If these devices had been shipped after December 2027, which is when the EU Cyber Resilience Act (CRA) will be in full effect, the EU Commission surely would have classified this as a severe incident. The CRA imposes maximum penalties of up to 2.5% of worldwide annual turnover (annual revenue) for severe vulnerability handling failures. For Danfoss, that would have meant an exposure of up to €235 million in possible fines.

If EU CRA requirements and processes were followed, this attack would not have happened. The regulation mandates strict security-by-design principles and requires manufacturers to perform comprehensive threat and risk analyses before shipping a product. The CRA also requires support periods based on the true term of use by customers and a rational for the support period duration to be documented by the manufacturer. The intent is that software updates will be provided for free while devices are in use. If industrial controllers are expected to run for 10 to 15 years, they must be supported for that timeframe. Additionally, the "code-of-the-day" vulnerability would have been considered a default credential and would violate the requirement of “protection from unauthorized access” listed in Annex I of the EU CRA regulation.

The lessons learned from this attack are clear. OT and product cybersecurity risk assessments must evaluate safety, operational availability, and financial impacts, not just data exfiltration. Manufacturers must declare an accurate end-of-life date for product use and patch vulnerabilities with software updates. Finally, because traditional network monitors miss unusual native system command behavior, securing these assets requires deploying host-based intrusion detection systems (IDS)—like BG Networks’ AnCyR—to detect and block anomalous behavior from the inside before physical destruction occurs.

If you are considering beginning a company-wide EU CRA conformity effort, are wondering which of your products are in scope, or are budgeting for 2027, and if you’re not sure where to start, BG Networks can help you get underway.