Technology & Science
France’s CERT-FR warns of compromised Danfoss refrigeration systems
The national cyber agency urges operators to restrict or disconnect exposed management interfaces and reset suspected systems. Authorities have not publicly identified who carried out the attack or how the controllers were reached.
Executive summary
- Official warning: CERT-FR, France’s national cybersecurity incident-response team, said it was aware of numerous compromises involving Danfoss AK-SM and AK-SC refrigeration-management systems. Its Oct. 12 alert recommends disconnecting or filtering access to affected systems and tightening remote access to trusted service providers.[1][2]
- Retail disruption: The alert followed an overnight cyberattack on supermarket refrigeration systems. Intermarché and Coopérative U told AFP that stores in their networks were affected; the Paris prosecutor’s office said its investigation would identify victims and establish links between the attack and reported damage, including food losses and fires.[3][2]
- What is not established: CERT-FR’s notice confirms many compromised controllers but does not name an attacker, specify an entry route, or identify a vulnerability used in the incident. Its general warning against internet-exposed management interfaces is not proof that exposure was the attack path in these stores.[1][2]
France’s CERT-FR issued an alert on Oct. 12 saying it had knowledge of numerous compromises of Danfoss AK-SM and AK-SC refrigeration systems. The notice identifies the affected product families and gives operators immediate containment steps. It does not estimate how many controllers were compromised or provide a store-by-store count.[1]
The warning followed an attack on connected refrigeration equipment at French grocery chains overnight into Monday. Intermarché and Coopérative U reported affected stores to AFP. The Paris prosecutor’s office opened an investigation to identify victims and establish links between the attack and damage reported by retailers, including food losses and fires. Reuters separately reported that Carrefour said 80 stores were hit and that Intermarché reported about 150 affected locations; the full scope was still being assessed.[3][2]
The immediate impact was on the systems that keep perishable goods cold. Intermarché told AFP that affected branches would have to discard fresh and frozen products. The available reports do not provide a settled nationwide loss total, a final count of affected stores, or a completed food-safety assessment.[3][2]
CERT-FR says exposing a management interface directly to the internet is contrary to good practice. Where remote administration is necessary, it recommends limiting access to trusted IP addresses as an interim measure and following its hardening guidance. For suspected compromises, the agency advises filtering network access to service providers, restoring factory settings, applying available security updates, rotating secrets, checking accounts and reconfiguring the equipment.[1]
Danfoss told Reuters that it was aware of incidents in France involving a limited number of refrigeration-management systems and said affected units were running outdated firmware. The company said it had long advised customers to keep supported systems updated and move legacy equipment to current-generation products. That response does not by itself establish which configuration weakness was used in the supermarket attack.[2][4]
The technical advisory is narrower than some early explanations of the incident: it documents compromises and recommends defensive action, but does not attribute the activity or connect it to a specific publicly disclosed flaw. The prosecutor’s investigation is still meant to determine the victims and link the reported losses and fires to the attack. The route into the controllers, the attackers’ identity and the final scale of damage remain unresolved in the cited records.[1][3][2]