Danfoss AK-SM / AK-SC refrigeration controllers hijacked in French supermarket attack (Oct 11-12 2026, CERT-FR CERTFR-2026-ALE-012; CVE-2025-41450/41451/41452): how do I secure or recover my controllers?

What happened: on the night of October 11-12, 2026 attackers took over Danfoss supervisory refrigeration controllers at hundreds of French supermarkets (reported chains include Intermarché, Coopérative U, Carrefour Market, Monoprix and Leclerc; the French finance minister cited about 700 stores) and drove cabinets and cold rooms into defrost, destroying stock worth tens of millions of euros. CERT-FR issued alert CERTFR-2026-ALE-012. Danfoss says most affected units were older models that no longer receive updates, though some AK-SM 800A units on outdated firmware were also hit. Known flaws in these controllers include CVE-2025-41450, an authentication bypass where the admin password can be derived from the date, and CVE-2025-41451/41452. The initial access vector hadn't been publicly confirmed. Am I affected: - Danfoss AK-SM 800 (end of life since 2021), AK-SC 355 (phased out 2016) and AK-SM 800A on firmware older than the current 5.3.x package, especially if the web interface is reachable from the internet or through a contractor's remote access. - Check with your refrigeration contractor which models and firmware versions you run, and test from outside your network whether the controller's web interface is exposed. Fix: 1. Immediately take controllers off the internet: disconnect them, or filter access so only specific trusted IP addresses can reach them (CERT-FR's temporary measure). 2. Require remote access (including the maintenance contractor's) to go through a single managed entry point such as a VPN with MFA, not direct exposure or port forwarding. 3. AK-SM 800A: update to the latest firmware (5.3.x as of mid-October 2026); version 4.0 and later enables Strict Session Control and mandatory HTTPS by default. 4. Replace end-of-life AK-SM 800 and AK-SC 355 units; they won't be fixed. 5. Change all default and shared passwords, and give each contractor its own account. Recovering a compromised unit (in this order): factory reset, apply security updates, change device secrets and passwords, audit accounts, then reconfigure from a known-good setup. Verify setpoints and alarm settings afterwards, and enable temperature alarms that notify staff out of hours. Sources: https://thehackernews.com/2026/10/attackers-heat-french-supermarket.html https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/ https://labs.cloudsecurityalliance.org/research/csa-research-note-danfoss-controller-french-retail-sabotage/