Overnight on October 11th, 2026, a cyberattack disrupted refrigeration systems across French supermarket chains. Attackers exploited a vulnerability within outdated firmware and legacy Danfoss refrigeration controls, causing temperatures to rise and forcing retailers to discard spoiled food. Since this incident, the same vulnerability was found to be present in Copeland’s XWEB controllers as well. The incident demonstrated how vulnerabilities within connected equipment can translate into physical disruption and financial losses and highlighted an issue growing in importance: cybersecurity within the OT environment.
Adopted in 2024, the EU’s Cyber Resilience Act (CRA) establishes requirements for product security and ongoing vulnerability handling, with its main requirements applying from December 11th, 2027. The Danfoss incident illustrates some of the operational risks the CRA seeks to address. However, the success of the act depends on coordination between component suppliers, OEMs, and end users.
The vulnerability that was exploited in Danfoss’ affected equipment was tied to legacy products which no longer received software or security updates, according to a statement made by Danfoss. In its October 2025 newsletter, Danfoss reiterated its end-of-service policy for legacy products, including refrigeration controllers discontinued years earlier, and encouraged customers to discuss replacement options.
This incident highlights a critical issue between component suppliers, OEMs, and end users: a product can reach the end of its supported life while remaining essential to daily operations. For end users, replacing a functioning controller can be difficult to justify, particularly when upgrades involve hardware costs, integration work, validation, and downtime. Given many of these products are purchased through OEMs rather than directly from the manufacturer of the component itself, an additional layer exists which can further complicate decisions to replace a component reaching end-of-support.
This multi-layered sales channel for equipment creates a highly nuanced cybersecurity challenge. Even when a security update is available, implementing it requires coordination. The component supplier understands the vulnerability and provides a remedy, but the OEM may need to check compatibility with the machine’s software and validate its operation. The end user must also arrange the resources and maintenance window needed to make the change. A delay at any stage of this process can leave equipment exposed.
The CRA gives these ongoing expectations a clearer legal basis. It requires manufacturers to address product security during development and throughout a defined support period, while providing guidance for secure use and decommissioning for products sold after December 11, 2027.
The first step is establishing and communicating that support period. Article 13(8) requires manufacturers to determine a period that “reflects the length of time during which the product is expected to be in use”. This must generally be at least five years, unless expected use is shorter. Article 13(19) requires manufacturers to make the support end date clear at purchase and, where technically feasible, notify users when support ends. This allows OEMs to assess whether component support aligns with the needs of the machine and gives end users information to plan maintenance, retrofitting, and replacement.
Customers also need to understand how to access support and maintain equipment securely. Annex II requires manufacturers to provide security support information, vulnerability reporting contacts, and instructions covering secure commissioning, updates, and decommissioning, including “how security-relevant updates can be installed”. In practice, this guidance helps OEMs assess how changes affect the wider machine, while allowing end users to better plan their implementation.
Together, these provisions formalize the relationship between vendors, OEMs, and end users by establishing support commitments and clearer expectations of the information manufacturers must provide. These obligations extend the relationship beyond the initial sale, making continuing communication part of maintaining the product securely. Their practical value depends on each party understanding what it needs from the others and coordinating action before a vulnerability or support deadline becomes an operational problem.
For vendors, implementing CRA commitments will place additional demands on service capabilities. However, it also offers vendors a very strong opportunity to develop a competitive advantage. Customers will need help interpreting security information in the context of newly installed equipment, requiring closer engagement with OEMs and end users.
Delivering that support across different markets will require stronger regional capabilities. Local technical teams and trained service partners could help customers assess installations, coordinate with machine builders, and carry out work during planned shutdowns. Where components are sold through distributors or incorporated into broader systems, the original supplier may have limited visibility of the final installation. Suppliers with a clear process for communicating security information to maintenance teams and helping customers enact changes quickly, are more likely to be favored as adhering to the CRA becomes crucial.
At the end of support, this relationship must also accommodate replacement. Trade-in programs could reduce the purchasing cost, while configuration assistance, OEM validation, and local commissioning may address the disruption of replacements. Together, these services potentially make replacement more feasible for customers retaining outdated and unsupported products.
The French supermarket attack made the operational consequences of compromised controls visible. For industrial automation, the wider implication is that confidence in connected equipment depends partly on the support available after installation.
The CRA gives manufacturers clearer obligations for product security and support. Component suppliers, OEMs and end users will need to translate those commitments into workable maintenance and replacement decisions. Suppliers that can connect product expertise with accessible service will be better placed to help customers maintain secure operation and earn their confidence in future purchasing decisions.
While the CRA addresses this for products sold after December 11th, 2027, vulnerabilities in the existing installed base will still be present. As the CRA is rolled out, vendors will have an opportunity to expand their service offerings and strengthen relationships with end users, creating a competitive advantage as cybersecurity becomes an increasingly important purchasing consideration.
", "author": { "first_name": "Chloe", "last_name": "Starks" }, "format_version": 6 }