Madrid, 13 October 2026. Cadena SER reports a cyberattack that remotely disrupted refrigeration at French supermarkets and caused food losses. [1] The case highlights how securing connected products also protects physical processes and business operations.
CRA: identify products and responsibilities. Connected equipment and its digital components may fall within scope; both the product and the organisation’s role must be assessed. Simply using equipment does not make a supermarket its manufacturer. The main obligations apply from 11 December 2027. Since 11 September 2026, manufacturers subject to the CRA must report actively exploited vulnerabilities and severe incidents affecting the security of their products. [2, 3]
Prepare with Internet Security Auditors. Internet Security Auditors provides applicability and classification assessments, gap analysis, risk assessment and technical testing, implementation support and internal compliance audits. This work helps prioritise access controls, updates and vulnerability handling, prepare documentation and organise reporting procedures. [4]
Continuity and recovery. For operators and facilities, we propose business impact analysis, business continuity plans (BCP), disaster recovery plans (DRP) and exercises. These should address independent alarms, operational alternatives and validation before returning to service. Restoring systems cannot recover spoiled food. Cybersecurity audits complement reviews of remote access, networks and suppliers.
References
[1] [1] Cadena SER — Refrigeration systems incident (12 October 2026)
[2] European Commission — CRA: summary of Regulation (EU) 2024/2847
[3] European Commission — CRA: reporting obligations
[4] Internet Security Auditors — CRA assessment and compliance support
