The essentials
- On 12 October 2026, CERT-FR issued alert CERTFR-2026-ALE-012: many compromises affect Danfoss AK-SM and AK-SC controller series.
- The agency states that exposing a management interface on the Internet conflicts with good practice; until hardening is in place, restrict access to trusted IP addresses.
- Immediate actions: disconnect or filter access to affected instances; if compromise is suspected, factory reset, patches, secret rotation, and full reconfiguration.
- The link to the CERT-FR energy/water sector guide (CERTFR-2025-DUR-003) ties the incident to ongoing OT recommendations.
What the CERT-FR alert says
On 12 October 2026, France’s CERT-FR published alert CERTFR-2026-ALE-012 on a security incident targeting Danfoss equipment in the AK-SM and AK-SC series. The bulletin reports many compromises on these models. It does not pin a single attack vector: the operational priority is to remove exposure and restore suspect installations.
The document stresses governance: making a management interface reachable from the Internet is against good practice. When remote maintenance is mandatory, a temporary step is to restrict access to trusted IP addresses — while planning full hardening aligned with CERT-FR guidance for energy and water sector operators.
Why these controllers matter to IT leadership
AK-SM and AK-SC series units run refrigeration control: alarms, setpoints, defrost cycles, sometimes remote maintenance via a web UI for contractors. They are not typical “IT servers”: they sit at the store edge, in warehouses or industrial sites, often owned by facilities or refrigeration vendors rather than the CISO. Compromise is not only a data breach: a bad remote setpoint can break the cold chain and write off stock.
In the night of 11–12 October 2026, trade press reported a cyberattack on major French retail chains (Intermarché, Coopérative U, E.Leclerc, with other banners mentioned but not confirmed by those brands), involving refrigeration control systems manipulated remotely — a scenario consistent with the equipment class covered by the CERT-FR alert, although the official bulletin does not name retailers.
Emergency measures and remediation
CERT-FR’s first-line recommendation is to disconnect or filter access to AK-SM and AK-SC instances. If compromise is suspected, the official sequence is: filter network access to authorized contractors only; perform a factory reset; apply all available security patches; rotate secrets; review accounts; reconfigure the device globally.
- OT inventory : map AK-SM/AK-SC by site, firmware version, and access path (VPN, public IP, VLAN).
- Segmentation : separate IT and OT; block direct Internet admin without a bastion.
- Vendors : named accounts, logging, fast revocation when contracts end.
- Patches : align with vendor bulletins and record the actual apply date for audits.
- Local safeguards : defrost limits and standalone alarms where the vendor allows them.
Sources
This note was drafted with AI tools from the cited sources, then reviewed and published under the responsibility of Jordan FOUASSIER, publication director. We summarise the facts and add our reading; source text and images are not reproduced. An error? Write to contact@aigyrosgroup.com.