Hacked refrigeration: CERT-FR issues alert on Danfoss AK-SM and AK-SC controllers

On October 12, 2026, CERT-FR, the French government's computer security monitoring and incident response center attached to ANSSI (France's national cybersecurity agency), published an alert (CERTFR-2026-ALE-012) on Danfoss AK-SM and AK-SC series refrigeration controllers. It says it is aware of “numerous compromises” of these devices. The alert follows the attack on the night of October 11 to 12, in which hackers forced the defrosting of refrigeration systems at several hundred Intermarché, Netto, Coopérative U and Leclerc supermarkets.

Danfoss blames older equipment

In a statement to AFP, the Danish manufacturer says most of the affected devices are older products that no longer receive software updates or security patches. It cites the AK-SM 800 and AK-SC 355 controllers, and a version of the AK-SM 800 that ran outdated firmware. Danfoss says it advised retailers long ago to replace these models. It did not say how many systems were affected.

Several vulnerabilities have been published for these devices in recent years. The best known, CVE-2025-41450, reported by the company Claroty, allows an attacker to gain an administrator session remotely. It has been fixed since firmware version 4.2 of the AK-SM 800A; the two other flaws reported in 2025 are fixed in version 4.3.1. Claroty counted more than 2,700 AK-SM 800A administration interfaces accessible from the Internet. However, the link between these vulnerabilities and the attack is not established. Next also points out that changing a defrost cycle is a normal administrative function: a valid login is enough, with no need to exploit a vulnerability. How the attackers gained access has not been confirmed, and no one has publicly claimed responsibility.

A criminal investigation is open

The Paris prosecutor's office has confirmed it has opened an investigation into the cyberattack, according to AFP. It reports fires linked to the attack. According to Le Monde, cited by Next, the investigation has been assigned to the Office anti-cybercriminalité (OFAC), France's anti-cybercrime office. According to LeMagIT, some stores report losses of tens or even hundreds of thousands of euros. ANSSI says it is mobilized to support victims and coordinate with its European counterparts.

What to do if you operate these devices

CERT-FR reminds operators that exposing an administration interface on the Internet goes against best practices. It recommends:

• disconnecting AK-SM and AK-SC units from the network, or filtering access to them;
• if remote administration is essential, temporarily restricting access to trusted IP addresses.

If a compromise is suspected, CERT-FR advises:

1. limiting network access to authorized service providers only;
2. resetting the device to its factory configuration;
3. applying all available patches;
4. changing secrets (passwords, keys);
5. reviewing existing accounts;
6. fully reconfiguring the device.

The alert provides no indicators of compromise. For models that are no longer maintained, the only lasting solution is to replace them. Also check your maintenance contracts: these controllers are often managed by a refrigeration contractor or by the manufacturer, not by the IT department.