Danfoss AK-SC 355

Danfoss AK-SM and AK-SC refrigeration controllers compromised, with forced defrost reported at hundreds of French supermarkets; CERT-FR advises disconnecting or filtering access

Coopérative U, Intermarché and E. Leclerc confirmed to AFP a cyberattack on their refrigeration systems overnight on 11 to 12 October 2026; AFP reports from the retailers' statements at least 300 Intermarché or Netto shops and more than 100 Coopérative U outlets, and the Paris prosecutor opened an investigation (AFP, 2026-10-12). BFMTV puts the Intermarché and Netto count at 300, twice the first estimate of 150 that Infosecurity quotes, and Coopérative U below 100 stores (BFMTV, 2026-10-12; Infosecurity Magazine, 2026-10-12). BFMTV, writing in the conditional, reports that the attackers are said to have imposed a forced, continuous defrost with the setpoint at 50 degrees, on software older than version 4, heating the equipment for hours (translated from French) (BFMTV, 2026-10-12). CERT-FR's alert says it knows of numerous compromises of Danfoss AK-SM and AK-SC series devices and that exposing a management interface to the internet is contrary to good practice (CERT-FR, 2026-10-12). Danfoss told AFP that most affected units are legacy products that no longer receive software or security updates, naming the AK-SM800 and AK-SC355 regulators, and a person close to the Prime Minister said ANSSI had identified a vulnerability in software from a Danish company and that other countries may be affected (AFP, 2026-10-12). Intermarché told BleepingComputer that the attack reportedly affected a service provider that manages refrigeration systems in stores (BleepingComputer, 2026-10-12), and E. Leclerc told AFP that a cyberattack affected one of its refrigeration equipment suppliers (AFP, 2026-10-12). Infosecurity says the affected stores include those running vulnerable consoles with remote control and no adequately secured communication channel (Infosecurity Magazine, 2026-10-12). No source names an actor or the flaw or states how the attackers got in, and none ties the attack to the 2025 AK-SM 8xxA vulnerabilities that Claroty found (BleepingComputer, 2026-10-12).

Triage: a defrost cycle is normal; BFMTV quotes sector professionals saying installations can be programmed for two hours of defrost per 24 hours, whereas the reported attack is said to be a continuous forced defrost at a 50-degree setpoint held for hours (translated from French) (BFMTV, 2026-10-12).

Builds on: A hidden authentication mechanism discloses internal network layout before an attacker even…