CERT-FR named Danfoss AK-SM and AK-SC. Pull the management UI.

Overnight 11–12 Oct French grocers lost cold-chain control. CERT-FR 12 Oct has numerous compromises of Danfoss AK-SM and AK-SC. No CVE in the alert. Danfoss says most hit units are EOL. Not Ahold.

RWP Ventures · 2026-10-13 · event 2026-10-11 · 14 min read · priority 9.3

Do not collapse five facts.

1. This is process impact, not an IT outage at a grocer. Overnight 11–12 October, French supermarket operators reported refrigeration cases and cold rooms leaving the cold chain — extended defrost, spoiled stock, some stores describing equipment that had been driven hot. CERT-FR’s product class is the system manager that sets those cases. That is OT. It is not yesterday’s [GlobalProtect cookie](/posts/2026-10-12-globalprotect-cve-2026-0257-settra/). It is not Ahold Delhaize taking websites offline.
2. CERT-FR did not name a CVE. The 12 October alert has no CVE, no firmware floor, and no exploit write-up. Do not brief the CISO that this event is CVE-2025-41450 or CVE-2025-41451. Those IDs exist. They are AK-SM 8xxA rows from 2025, patched in R4.2 / R4.3.1, republished by CISA as ICSA-25-140-03. They are the right background for a current 800A that was never upgraded. They are not a confirmed exploit path for this weekend.
3. Danfoss says most of the hit fleet is already EOL. Statement to Cooling Post, 12 October: majority of affected units were legacy products or current products on outdated firmware. Named: AK-SM800, declared end-of-life May 2021; AK-SC355, phased out 2016. Those trains no longer receive software or security updates. Some current AK-SM800A units were also in — those were on outdated firmware. The operator close for EOL is replace and remove internet, not “apply R4.3.1 to a 2016 box.”
4. Ahold Delhaize is a different ticket. Ahold’s 12 October newsroom note is a network security issue, systems taken offline, stores still open. Help Net Security and Ahold’s later comment to Reuters: no reason to see a connection with the French refrigeration event. Do not merge Albert Heijn apps going dark with Intermarché cases defrosting.
5. This is not August’s research note. [9 August](/posts/2026-08-09-danfoss-ak-sm-800a-refrigeration/) was Team82 at DEF CON 34: code-of-the-day, command injection, Nginx injection, exploitation UNKNOWN. Overnight 11–12 October is the material development: CERT-FR numerous compromises, retailer-confirmed cold-chain loss. Same product family. Different evidence grade.

Catalog freeze this morning is still 2026.10.08 / 1739. No Danfoss CVE is on that list.

What happened

Night of 11–12 October 2026. French grocers reported refrigeration plant behaving as if someone had taken the defrost schedule. Les Mousquetaires (Intermarché / Netto) described equipment driven hot for hours; Coopérative U president Dominique Schelcher called the event extremely serious and confirmed an attack on cold-production installations in the network; Carrefour told Le Parisien 80 of its roughly 6,000 stores. Store-count totals in secondary reporting run from about 150 (an early Les Mousquetaires figure) to several hundred across banners. Treat the census as REPORTED. Treat cold-chain loss at named banners as CONFIRMED by those operators. Paris prosecutors opened an investigation into a large-scale attack on connected refrigerators; press attributed food losses and some store fires to the same night. Fires as a universal cyber effect are not established. They are a prosecutor/press item, not CERT-FR.

12 October, CERT-FR. Alert CERTFR-2026-ALE-012. Title: security incident targeting Danfoss AK-SM and AK-SC series. Summary: numerous compromises. Diagnosis in the bulletin: management interface on the internet. Temporary control if remote admin is mandatory: restrict to trusted IPs. Standing control: follow CERT-FR hardening for energy and water actors (CERTFR-2025-DUR-003). Solution line: disconnect or filter access to AK-SM and AK-SC instances. If compromise is suspected: filter to the contractor only, factory reset, apply every available security fix, rotate secrets, review accounts, reconfigure the box. CERT-FR posted the same sentence on X at 16:57 UTC.

12 October, Danfoss. Not a numbered PSIRT for this incident as of this writing. The company told Cooling Post it is in contact with supermarket customers in France, that most affected units were legacy or current-on-old-firmware, and that it is working mitigations: firmware where available, stronger network protections, removing direct internet exposure where applicable. EOL boxes do not get a hotfix. Current 800A boxes that skipped R4.2 / R4.3.1 still have a vendor path.

August 9, 2026 (background, not this CVE). Team82: AK-SM 800A web management. Hidden code-of-the-day authentication; command injection via alarm-to-mail fields to post-auth RCE; authenticated Nginx directive injection. Danfoss R4.3.1. CVE-2025-41450 is the earlier datetime-based password / improper-authentication row, floor R4.2, CISA CVSS 3.1 8.2. CVE-2025-41451 is CWE-77, prior to 4.3.1. Team82 counted 2,765 AK-SM 800A management interfaces on the public internet in that research window. That count is August exposure, not a 12 October victim list.

Not this event. Ahold Delhaize, 12 October newsroom: security issue in the network, some systems taken offline, stores open. Albert Heijn / Etos / Gall & Gall apps and e-commerce, Belgian Delhaize, and some US banners (Stop & Shop, Food Lion) saw IT disruption. Help Net Security: two European grocery stories the same weekend, no indication they are connected. Keep them unmerged.

Why it matters

A refrigeration system manager is the thermostat, the defrost clock, and the alarm path for the cases on the shop floor. Compromising that box is not “an ICS CVE with a theoretical spoilage scenario.” Overnight 11–12 October, the spoilage happened. Food-and-agriculture operators, grocers, cold-store 3PLs, and the contractors who VPN into those UIs from a laptop are the audience.

The second reason it matters is the patch story the vendor already told. Team82 and CISA published the 800A flaws in 2025–2026. Danfoss shipped R4.2 and R4.3.1. CERT-FR’s 12 October text still has to lead with disconnect, because a large fraction of the live fleet, per Danfoss, cannot be patched. EOL since 2021 is not a missing Tuesday update. It is an asset that should not have had a public management port.

The third reason is class, not brand. [Copeland XWEB Pro](/posts/2026-08-09-copeland-xweb-pro-refrigeration/) sat in the same DEF CON slot. Any grocer that inventories only “Danfoss 800A” and leaves Copeland, Hussmann, or a third-party remote-maintenance concentrator on the WAN has not closed the ticket.

Who / what is affected

Technical context

RWP is not reproducing a Danfoss exploit. Defenders need the class.

AK-SM / AK-SC boxes are store refrigeration system managers. They supervise multiple cases, cold rooms, and pack plant. The management path is a web UI that refrigeration contractors have historically put on the internet so a night-shift alarm can be cleared without driving to the store. CERT-FR’s diagnosis is that path.

Team82’s August write-up, for 800A only, is the public technical picture of what that UI can do if you own it: change temperature thresholds, change operating schedules, perform maintenance actions, and — on unpatched 8xxA — skip the login with a datetime-derived code (CVE-2025-41450 family) or land post-auth command injection on alarm-to-mail fields (CVE-2025-41451). CISA’s ICSA-25-140-03 still says no known public exploitation of those specific CVEs as of the 2025 update. That sentence is stale relative to this weekend’s event, but it is also not a CISA statement that 41450/41451 were used on 11 October. Keep the IDs on the hunt ticket. Do not put them in the incident title as “the CVE.”

ATT&CK mapping for the ticket — public reporting, not a playbook:

Independent probe temperature that does not ride the same controller is the detection that survives a hostile setpoint. A BMS alarm that reads the Danfoss box will lie if the box is the incident.

Threat / exploitation status

Confidence on CERT-FR’s compromise statement, the product series, disconnect/factory-reset guidance, and Danfoss’s EOL-majority statement: high. Confidence that Team82’s 800A primitives were the tool used against the EOL 800/355 majority: low — different hardware train, no CVE in the alert. Confidence on extra-France victim impact from this night: low until another CSIRT publishes. Confidence that internet-exposed AK-SM/AK-SC anywhere else is an emergency inventory item today: high.

What defenders should do

1. Inventory every Danfoss AK-SM and AK-SC — 800, 800A, SC355, contractor-managed, test, warehouse, ghost store. Record firmware, who has the VPN, and whether port 80/443 answers from the WAN. Shodan/Censys hits on StoreView or AK-SM banners are the first list, not the complete one.
2. CERT-FR’s close, in order. Disconnect or filter to trusted contractor IPs. If compromise is plausible: factory reset, apply every remaining patch, rotate secrets, review accounts, rebuild config. Do not “reboot and hope.” A hostile defrost schedule that is still in NVRAM is the incident.
3. EOL is replace, not patch. AK-SM800 and AK-SC355 do not get R4.3.1. Danfoss has said so. Budget a swap. Until the swap, the box does not belong on a public address.
4. Current 800A: R4.2 minimum for CVE-2025-41450, R4.3.1 (or the current 5.3.x package Danfoss lists now) for 41451/41452. Check the exact string on the box against DSA-2025-03-01 and the AK-SM 800A download tab, not a slide that says “we patched Danfoss.”
5. Independent temperature. A second probe, a case thermometer round, or a BMS point that does not trust the Danfoss setpoint. Hunt overnight defrost duration, setpoint step-changes at 23:00–05:00 local, and alarm suppression. That is the OT ticket.
6. Do not stop at Danfoss. Copeland XWEB Pro was the other August refrigeration note. Same contractor pattern. Same “UI on the internet” failure.
7. Keep the IT tickets on the board. [AhsayCBS 10.3.4.45](/posts/2026-10-11-ahsaycbs-cve-2026-105134-exploit/) is still the close for 105134. Apple CVE-2026-86950 is due today, 13 October. This fridge event does not retire those. Ahold’s IT containment, if you are that grocer, is a parallel IR — not this CVE class.

RWP assessment

Score 9.3.

Highest-leverage development since yesterday’s GlobalProtect cookie is confirmed OT process impact on a refrigeration system manager that we already wrote as research in August, with CERT-FR as the primary and a vendor statement that most of the burned fleet is unpatchable EOL. Evidence quality is high on CERT-FR, Danfoss-to-Cooling Post, and named retailer confirmations. Evidence quality is intentionally split on the CVE (absent from the alert), on the store census, and on any extra-France victim claim.

It outranks Ahold Delhaize because Ahold is an IT containment with stores open and no process write on the current record. It outranks Microsoft’s 13 October early cloud/Exchange set (eight MSRC rows, CVE-2026-96940 still “not exploited”) because that is a Patch Tuesday floor, not a cold-chain incident. It outranks Apple CVE-2026-86950 because that KEV row has been on the board since [29 September](/posts/2026-09-29-apple-cve-2026-86950-coregraphics/); the due date is today, not a new add. It outranks a second day on AhsayCBS and on ReliaQuest/Settra because those already had Daily Tops. It outranks an unverified Redact leak-site claim against Eversource: no company confirmation, no process impact.

What we are not saying: that CVE-2025-41450 or 41451 is the exploit used Sunday night; that CERT-FR published a victim count; that Ahold and the French refrigeration event are one campaign; that every 50 °C figure is measured; that a nation-state did this; that this is a new KEV row.

What we are watching

• Whether CERT-FR revises ALE-012 with a CVE, a firmware floor, or a non-French CSIRT joint.
• Whether Danfoss publishes a numbered advisory that names the models and the current 800A package as the close.
• Whether CISA adds a Danfoss row to KEV or reopens ICSA-25-140-03.
• Whether Copeland XWEB or a third refrigeration OEM shows the same weekend pattern.
• Extra-France CSIRT notes (UK, BE, ES) as separate evidence, not as CERT-FR’s census.
• Catalog freeze remains 2026.10.08 / 1739.

Sources

• CERT-FR — CERTFR-2026-ALE-012
• CERT-FR — X, 12 October 2026 16:57 UTC
• CERT-FR — CERTFR-2025-DUR-003
• Cooling Post — Danfoss moves to mitigate cyberattack
• Danfoss — DSA-2025-03-01
• CISA — ICSA-25-140-03
• Claroty Team82 — Freeze the Controller, Defrost the Food
• CVE-2025-41450
• CVE-2025-41451
• Ahold Delhaize — 12 October newsroom
• Help Net Security — two grocery events, 12 October
• BBC — French supermarket fridges
• SecurityWeek — refrigeration controller hack
• The Hacker News — attackers heat French supermarket fridges
• CISA KEV JSON catalog 2026.10.08
• [RWP — Danfoss AK-SM 800A, 9 August 2026](/posts/2026-08-09-danfoss-ak-sm-800a-refrigeration/)
• [RWP — Copeland XWEB Pro, 9 August 2026](/posts/2026-08-09-copeland-xweb-pro-refrigeration/)
• [RWP — GlobalProtect Daily Top, 12 October 2026](/posts/2026-10-12-globalprotect-cve-2026-0257-settra/)