France's Cyber Agency Says Supermarket Refrigeration Controllers Have Been Broken Into

CERT-FR, the alert service of France's national cybersecurity agency ANSSI, said on Oct. 12, 2026, that it knows of numerous compromises of Danfoss AK-SM and AK-SC series equipment (the controllers that run refrigeration in food stores) and told the companies operating them to disconnect the units or filter access to them.

That equipment sits between a store's cold rooms and whoever maintains them. Danfoss's own product page calls the AK-SM system manager the brain of the refrigeration and climate-control system it sells to food retailers: it coordinates data to and from the individual case controllers, including the temperature readings used for logging and alarms, and it can be reached through a web browser for remote work.

The agency gave no count of affected sites and named no company. In the summary of its alert, CERTFR-2026-ALE-012, CERT-FR said that putting a management interface on the internet runs against good practice and that, where remote administration cannot be avoided, a first temporary measure is to restrict access to trusted IP addresses.

Where a compromise is suspected, the alert sets out six steps, in order: restrict network access so that only service providers can reach the AK-SM and AK-SC units, perform a factory reset, apply every available security fix, replace the passwords and keys the equipment holds, check the accounts that exist on it, and reconfigure the unit completely.

The alert names no specific software flaw, identifies no attacker, lists the two product families by series rather than by affected software version, and leaves its risk field as not specified by the vendor. The one document it points operators to is a set of hardening recommendations CERT-FR wrote for the energy and water sectors.