GajIPS Threat Advisory — Danfoss Refrigeration Controller Attacks (AK-SM / AK-SC)

Severity: High | Priority: 1

On the night of 11 October 2026, attackers took remote control of refrigeration management systems in hundreds of supermarkets across France. Stores belonging to Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc were affected. Fridges and freezers were forced into defrost mode, and in some stores they were heated to as much as 50°C. Large amounts of food had to be thrown away, and some equipment began to overheat to the point of fire. One affected group expects losses in the tens of millions of euros. Activity was also reported in Spain, Portugal, Poland, Germany and Belgium. The French national cyber agency issued an emergency alert the next day, and a criminal investigation is under way. No group has been publicly identified as responsible.

The systems involved are Danfoss AK-SM and AK-SC store controllers. They manage refrigeration, lighting and HVAC equipment in retail, cold-storage and food-processing sites. Most of the units hit were older AK-SM 800 and AK-SC 355 models that no longer receive updates, along with current AK-SM 800A units running outdated firmware. Danfoss has said its software was involved, but how the attackers got in has not been confirmed.

Researchers had previously disclosed three weaknesses in the AK-SM 800A web management interface:

• An authentication bypass. The login check can be switched to a “code of the day” that depends only on the device’s date, so an attacker who knows the method can calculate a valid password and gain full administrator access without any credentials. Fixed in firmware 4.2.
• A command-injection flaw. It sits in the email settings and lets an authenticated user run commands on the controller. Fixed in 4.3.1.
• A configuration-injection flaw. It lets an authenticated user replace part of the web server configuration and crash the management service. Fixed in 4.3.1.

Together, the first two give an unauthenticated attacker full control of the controller. Thousands of these management interfaces were found reachable directly from the internet.

Organisations running Danfoss AK-SM or AK-SC controllers in your network should immediately remove their management interfaces from direct internet exposure. Where remote access is unavoidable, limit it to a VPN or a short list of trusted service-provider IP addresses. Upgrade AK-SM 800A units to the latest firmware. Systems on version 3.x must move to 4.x first. Plan to replace end-of-life AK-SM 800 and AK-SC 355 units, since they will not be fixed. For any controller that may already have been accessed, follow the national guidance: restrict access to service providers, reset the unit to factory settings, apply all available updates, change all passwords and keys, review user accounts, and reconfigure it from a known-good baseline. Keep an independent temperature alarm in place for critical cold-storage equipment, so tampering is noticed even if the controller itself is compromised.