Danfoss AK-SM 800 and AK-SC 355 controllers exposed online enabled remote defrost attacks on 500+ French supermarket cold chains

Hundreds of Intermarché, Carrefour, Coopérative U and Monoprix locations lost stock after the controllers were placed into extended defrost. CERT-FR confirmed compromises limited to the AK-SM and AK-SC series and issued immediate guidance to isolate or firewall the devices. Danfoss stated the majority of affected units were AK-SM 800 and AK-SC 355 models declared end-of-life in 2021 and 2016 respectively, with no further firmware or security updates available. Procurement records and Danfoss newsletters show these controllers were sold with remote management interfaces intended for maintenance contractors; many remained reachable from the public internet years after support ended. No CVE has been published and Danfoss has issued no formal advisory, leaving operators without a coordinated patch path. The pattern matches prior OT incidents where legacy building-management and refrigeration systems were left exposed after integrator hand-off. Independent confirmation of the attack vector remains limited to CERT-FR’s alert and retailer statements; French authorities have not released packet captures or initial access details. This absence prevents technical attribution and leaves open whether credentials were stolen, brute-forced, or obtained through contractor accounts. The incident reveals a systemic gap between retail supply-chain security expectations and the actual lifecycle support of embedded controllers. Operators must now accelerate replacement of unsupported AK-SM 800 and AK-SC 355 hardware while enforcing strict network segmentation on remaining AK-SM 800A units. ANSSI is expected to publish updated filtering rules within 30 days; failure to isolate exposed controllers will likely trigger mandatory reporting under upcoming NIS2 transposition.