Summary
Attackers compromised Danfoss AK-SM800 and AK-SC355 refrigeration supervisory controllers at more than 700 French supermarkets overnight on October 11–12, 2026, manipulating temperature controls to extend defrost cycles and drive cold storage temperatures as high as 50°C. In a number of locations the thermal anomalies activated automatic sprinkler systems, causing water damage in addition to spoiled inventory. CERT-FR issued an advisory on October 13; Paris prosecutors have opened an investigation and ANSSI is actively investigating the campaign.
Timeline
| Date | Event |
|---|---|
| Oct 11–12, 2026 | Attackers access Danfoss AK-SM800/AK-SC355 controllers at 700+ French supermarkets overnight; defrost cycles extended from 1 hour to 8 hours; cold storage temperatures reach 50°C; sprinkler systems activated at multiple sites. |
| Oct 13, 2026 | CERT-FR issues advisory covering CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452. Paris prosecutor opens criminal investigation. ANSSI investigation begins. |
What Happened
The Danfoss AK-SM800 and AK-SC355 are supervisory refrigeration controllers widely deployed in European retail. They monitor and manage compressor banks, defrost cycles, and alarm thresholds across large multi-case installations. Affected retail chains include Intermarché and Netto (an estimated 300 or more stores), Carrefour (approximately 80 stores), Coopérative U (approximately 80 stores), and Monoprix (approximately 30 stores). The impacted controllers are also found in deployments using Copeland xweb and Dixell xweb supervisory systems.
Three CVEs affect the AK-SM8xxA series. CVE-2025-41450 (CVSS 8.2) is an authentication bypass in firmware prior to version 4.2, allowing unauthenticated access to the management interface. CVE-2025-41451 (CVSS 8.7) is a post-authentication OS command injection flaw in firmware prior to version 4.3.1, enabling remote code execution after exploitation of the bypass. CVE-2025-41452 (CVSS 6.8) creates a denial-of-service condition. The AK-SM800 and AK-SC355 product lines are end-of-life; Danfoss has confirmed no further firmware updates will be issued for these models, leaving the vulnerabilities permanently unpatched in affected deployments.
Industrial refrigeration controllers in retail environments are frequently connected to building management networks, and in some deployments accessible via internet-facing VPNs or remote management interfaces intended for vendor support. Internet-exposed instances of Danfoss AK-SM8xx controllers have been indexed by internet scanning services. CERT-FR recommends isolating affected controllers from internet-accessible networks, disabling remote management interfaces where possible, and replacing end-of-life hardware. For units that cannot be replaced in the near term, strict network access controls and enhanced logging on upstream equipment are advised.
Domain Intelligence
danfoss.com — 62.43 / D
danfoss.com scores in the low-trust range. Danfoss manufactures the AK-SM800 and AK-SC355 refrigeration controllers at the center of this incident; the affected product lines are end-of-life with no patch pathway.
copeland.com — 60.96 / D
copeland.com scores in the low-trust range. Copeland xweb supervisory systems were present in a portion of the affected supermarket deployments alongside Danfoss hardware.