French operators isolate Danfoss controllers after cyber-attack disrupts cold chain

Managed service providers must prioritize Danfoss StoreView controllers, specifically the AK-SM800, AK-SC355, and AK-SM800A models, following the October cyber-attack on French supermarkets. Danfoss has patched vulnerabilities in the AK-SM800A controller, but the older AK-SM800 and AK-SC355 models no longer receive security updates. Teams should verify firmware versions immediately to determine if their assets are vulnerable to remote code execution.

How it unfolded

• On October 11, a cyber-attack targeted hundreds of supermarkets in France, disrupting food supplies and refrigeration systems.
• Danfoss confirmed its equipment was targeted, noting that most affected units were either unsupported older models or newer ones running outdated firmware.
• By October 14, Censys researchers observed a 71% reduction in internet-exposed Danfoss StoreView instances in France, suggesting operators are moving quickly to limit online exposure.

Who is affected

The primary impact is on French supermarket operators using Danfoss refrigeration controllers. The AK-SM800 and AK-SC355 models no longer receive security updates, making them vulnerable if exposed. Newer AK-SM800A units are affected if they are not running the latest firmware. A researcher at Claroty demonstrated that CVE-2025-41450 and CVE-2025-41451 could be chained to achieve remote code execution. This allows attackers to disable cooling while falsifying temperature readings, potentially concealing failures in the cold chain.

Our take on the response

Operators took Danfoss controllers offline instead of patching them. That suggests a preference for immediate containment over remediation when business continuity is at risk. While disconnecting limits remote access, it may also hinder remote monitoring capabilities. This approach highlights the difficulty of maintaining security on legacy industrial control systems that cannot be updated.

Who needs to act first

Teams should first inventory all Danfoss StoreView devices to identify unsupported models like the AK-SM800 and AK-SC355. For these, verify whether they are exposed to the internet; if so, isolate them from public networks immediately. For AK-SM800A units, check firmware versions and apply the latest patches from Danfoss. Test updates in a non-production environment first to ensure stability. Implement network segmentation to restrict access to these controllers, ensuring they communicate only with necessary internal systems and not directly with the internet.

What to do and how to stay safe: Danfoss

• Audit your network for internet-exposed Danfoss StoreView controllers and disconnect any that are not essential for remote management.
• Verify firmware versions on AK-SM800A units and apply the latest security patches provided by Danfoss to address known vulnerabilities.
• Isolate older AK-SM800 and AK-SC355 models from public networks, as they no longer receive security updates and remain vulnerable.
• Monitor for unusual activity on refrigeration systems, such as unexpected temperature changes or disabled cooling, which may indicate compromise.

Step-by-step guide: Social Engineering Tactics: How Attackers Bypass Technical Defenses

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Danfoss models are affected by this cyber-attack?

The AK-SM800 and AK-SC355 models are targeted and no longer receive updates, while the AK-SM800A is affected if running outdated firmware.

Is there a fix for the older AK-SM800 and AK-SC355 controllers?

No, Danfoss has confirmed that these older models no longer receive security updates, so no patch is available for them.

What vulnerabilities were exploited in the attack?

Researchers demonstrated that CVE-2025-41450 and CVE-2025-41451 could be chained to achieve remote code execution and falsify temperature readings.