EU agencies' fridge-hack statement points to CRA reporting: what app teams should take from it
· 5 min read · CRA news
In short: on 4 November 2026 the European Commission, ENISA, Europol's EC3 and the EU's CSIRT networks issued a joint statement on large-scale cyber incidents in commercial refrigeration systems, and used it to remind manufacturers that CRA reporting has applied since 11 September 2026.
- The statement is about shop refrigeration, not apps but it shows EU agencies pointing at the CRA reporting duty in the middle of a live incident.
- Manufacturers must send an early warning within 24 hours of learning that a vulnerability is being exploited.
- That duty covers products already on the market, including old versions you no longer sell.
- If your app controls or monitors a connected device, you should be ready now, not in December 2027.
What the agencies said
The joint statement, published on the Commission's digital-strategy site on 4 November 2026, describes cyber incidents that hit commercial refrigeration systems and similar devices in several EU Member States. It dates the start to 11 October 2026, with a new wave on 1 and 2 November. The signatories ask organisations to act immediately to reduce their exposure, to follow advisories from their national CSIRTs, and they point to a collection of advisories maintained by ENISA.
The statement then turns to the CRA. It notes that since 11 September 2026 manufacturers of hardware and software products must report severe incidents and actively exploited vulnerabilities through the Single Reporting Platform, and that the main requirements (security by design, security support over the product's lifetime, fixing vulnerabilities without delay) apply from 11 December 2027.
Press coverage adds detail that the agencies have not confirmed. Security Affairs, summarising French media, reports that some of the affected controllers were older units past the end of support, or ran outdated firmware, and that earlier researcher reports of vulnerabilities in some controllers exist. It also says it is not confirmed that those flaws were used, and the initial access method is not described. We therefore do not draw conclusions about the cause.
Why an app team should care
Refrigeration controllers are far from mobile apps, but the pattern is familiar: a connected product, years of installed versions, some without updates, and an exploited weakness. Some such devices are managed through companion apps and cloud dashboards. Whether your app counts as a product with digital elements, or as part of one, depends on your facts (see Does the CRA apply to mobile apps?). Our reading is that if it does, the reporting duty applies to you today, long before the main obligations.
| Step (Article 14 CRA) | Deadline for an actively exploited vulnerability |
|---|---|
| Early warning | Without undue delay, within 24 hours of becoming aware. |
| Vulnerability notification | Without undue delay, within 72 hours. |
| Final report | No later than 14 days after a corrective or mitigating measure is available. |
For severe incidents the early warning and the 72-hour notification are the same, and the final report is due within one month of the incident notification. The wording is from the regulation's text; our reporting deadlines tool turns a date of awareness into your three dates.
Practical details from ENISA's platform FAQ
ENISA's FAQ for the platform, last updated on 15 October 2026, answers several questions that a small team would otherwise discover during an incident:
- Products already on the market are covered. You do not have to report a vulnerability whose exploitation you knew about before 11 September 2026, but exploitation you learn about after that date is reportable even if the flaw itself is old.
- Submission is through a web form. There is no API at launch, and each person needs a personal EU Login account with multi-factor authentication. A manufacturer has one primary representative and up to 20 secondary ones.
- You must pick the right national CSIRT, normally where your main EU establishment makes the cybersecurity decisions. A wrong choice may invalidate the notification.
- If the platform is down, wait for it to return and submit there. You may contact your CSIRT in the meantime, but that does not replace the notification.
What we would do this week
- List every app version still in use, including old releases and white-label builds, and note whether you could still ship a fix for each.
- Decide what counts as being aware of exploitation. A user report reaching support can matter as much as one reaching the security mailbox.
- Name one person with authority to start the 24-hour clock at any hour, and a deputy. Give both EU Login accounts and test them.
- Agree which CSIRT you would choose, and write down why.
- Review your support period and tell users when a version stops receiving updates. Article 13(8) sets a support period of at least five years, with an exception for products expected to be used for less time.
- Run a short tabletop: a customer reports an attack, and you must get to a draft early warning. Time each handover.
Our guide on CRA vulnerability reporting for app teams walks through the steps in more depth.
Knowing quickly which app versions contain a vulnerable component is half of a 24-hour response. Build an SBOM for your app and check it in seconds.
Open the free scannerSources
- European Commission: Joint statement on cyber incidents in refrigeration systems across the EU, 4 November 2026.
- Security Affairs: ENISA warns of cyberattacks targeting refrigeration systems across Europe (press detail, partly unconfirmed).
- ENISA: Single Reporting Platform FAQ, last updated 15 October 2026.
- Regulation (EU) 2024/2847 (CRA), full text: Articles 13(8) and 14.
This article summarises public statements and EU law for practical use. Incident details are still emerging and may change. It is not legal advice. Related: CRA vulnerability reporting for app teams · Does the CRA apply to mobile apps?