France's government computer emergency response team, CERT-FR, issued an alert on October 12, 2026 saying it is aware of numerous compromises of Danfoss AK-SM and AK-SC series devices. Its advice is blunt: disconnect them from the internet or filter who can reach them, and if one may have been hit, wipe it back to factory settings and rebuild it.
The alert, CERTFR-2026-ALE-012, is short. It names no CVE, no attacker and no victim count, and it does not describe what the intruders did once inside. The risk field reads "not specified by the vendor". What it does say is that exposing a management interface on the internet runs contrary to good practice, which points at the way these devices were reached rather than at a newly disclosed software flaw.
The boxes that keep the freezers cold
Danfoss markets its AK-SM system managers to the food retail industry as supervisory controllers that coordinate a store's refrigeration and HVAC controllers, log temperatures and raise alarms, with a web interface for remote monitoring by service staff. That remote access is the convenience that, according to CERT-FR, becomes the problem when the management page is left open to anyone on the internet.
Even without technical detail, the agency's wording, numerous compromises, means this is not a theoretical risk. The agency points readers to its own hardening guide for the energy and water sectors, CERTFR-2025-DUR-003, for longer-term measures.
Take them offline, then reset and rotate
CERT-FR's immediate fix is to disconnect AK-SM and AK-SC instances from the internet or filter access to them. Where remote administration cannot be avoided, it suggests restricting access to trusted IP addresses as a first, temporary step. If a compromise is suspected, the agency lists six actions:
- limit network access to the devices to service providers only
- perform a factory reset
- apply all available security patches
- rotate secrets
- review existing accounts
- reconfigure the equipment from scratch
The alert does not name a fixed firmware version, so owners should check with Danfoss for the latest software for their model.
The warning fits a pattern of government agencies telling operators to stop exposing control equipment, including a UK alert on disrupted control systems in August, and follows CERT-FR's own September warning about mass Metabase break-ins. More French coverage sits on our France country page. For the retailers and refrigeration contractors who run these controllers, the lesson CERT-FR is drawing is simple: a management page that anyone can find is a management page somebody else will eventually use.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.