Remote access security, and the controllers nobody meant to publish

What CERT-FR said, in its own words#

On 12 October 2026, the French national cyber agency published alert CERTFR-2026-ALE-012, titled in French as an incident targeting the Danfoss AK-SM and AK-SC series. The alert says the agency knows of “nombreuses compromissions”, which translates as numerous compromises, of those two controller families. It names no retailer, no sector and no device count, and it gives no firmware version. The CERT-FR alert is short, and it is the document to read first.

The advice is blunt. The alert calls exposure of a management interface to the internet contrary to good practice. Where remote administration cannot be avoided, its first temporary step is to restrict access to a list of trusted IP addresses. Where a compromise is suspected, it recommends restricting access to service providers only, performing a factory reset, applying every available patch, rotating secrets, reviewing accounts and reconfiguring the device from scratch.

That is a short list for a long estate. A controller in a store is rarely a single box. It sits on a network, answers to a central system and gets reached by a contractor on a Thursday afternoon. Each of those routes is a trail an attacker can follow, and remote access security needs an owner for each one, who can say who uses it, from where, and under which account. Remote access security covers every one of those routes, not only the front panel of the device. A store estate is a thicket of controllers, and the undergrowth around them is where remote access security goes wrong.

Why remote access security is a buyer’s problem#

The controller is rarely the first target. Its management interface is the door, and the flaws Danfoss has published over three years are the locks that did not hold. The company’s own security advisories are the most useful documents in this story, because they are dated, versioned and scored, which is more than most press coverage manages. Remote access security is a question about doors, not about the controller alone, and the scent of an open interface is easy to follow.

The 2023 advisory, DSA-2023-08-01, was published on 21 August 2023 and covers the AK-SM 800A. It lists three CVEs. Two are rated HIGH with a base score of 7.5, and one is rated CRITICAL with a base score of 9.8. Danfoss says the fix is to install the latest patch, numbered 3.3. The 2025 advisory, DSA-2025-08-01, was published on 1 August 2025 and covers the AK-SM 8xxA series before version 4.3.1. It describes post-authentication operating system command injection, rated 8.7 for CVE-2025-41451 and 6.8 for CVE-2025-41452.

Scores are only half the reading. The FIRST specification for CVSS v3.1 places a score from 9.0 to 10.0 in the Critical band, which is the line the chart below draws against.

The sources also disagree on some fixes. CISA’s advisory ICSA-25-140-03 maps the authentication flaw, CVE-2025-41450, to firmware R4.2, and the injection flaws to R4.3.1. Claroty’s Team82 write-up, dated 9 August 2026, says R4.3.1 addresses all three. Check the version against your own device, and ask the vendor in writing when the sources disagree.

Notice what the 2025 advisory does not say about remote access security. It names the AK-SM 8xxA series and says nothing about the AK-SC. Anyone who runs AK-SC controllers should not assume the 4.3.1 fix covers them until the vendor says so in writing.

The retail week, and the claims we did not confirm#

On 12 October, Ahold Delhaize’s newsroom carried a statement that the company was “experiencing a security issue within its network”, and that its teams were “taking steps to assess and mitigate the issue”. The statement gives no cause, no supplier and no timetable. We have not linked Ahold Delhaize to the Danfoss controllers, and nothing we read does.

Press coverage and social posts went further. They described what they called a supermarket cyberattack in France, with cabinets forced into defrost and temperatures rising sharply enough to spoil stock. CERT-FR’s alert does not repeat those details, names no retailer and gives no temperature. This piece therefore treats the supermarket account as unconfirmed, and it does not use any figure from it.

Social posts about the controller story rose quickly in the hours after the alert, and one practitioner’s advice is worth quoting because it is the same advice the agency gave. The post is an unverified voice on the wider story, quoted here only for its advice.

That advice is the right one, and it is the same advice the agency gave. The post also says the fix is a firmware version written as “R4.3.1”. Danfoss’s own advisory writes the fix as 4.3.1, so the article uses the vendor’s wording and not the post’s.

What to do about industrial control systems security before Monday#

Most of the work is inventory, not technology. Before anyone buys a product, find out which controllers in your estate have a management interface that answers from outside your own network, and which of those interfaces are on a firmware line the vendor has already patched. That is the whole job, and remote access security starts with it.

The steps below follow the order CERT-FR and Danfoss set out. Where a step is general practice rather than advice from either source, the text says so.

Two further sources set the frame. CISA’s exposure reduction guidance is direct that “internet exposure reduction does not mean disabling necessary remote access”, and that necessary access should run through a secure gateway or VPN. The UK’s National Cyber Security Centre, with partner agencies, puts the underlying risk plainly: “Exposed and insecure OT connectivity is known to be targeted by both opportunistic and highly capable actors.” The secure connectivity principles for operational technology are the reference for the boundary work.

The sequence matters. Restricting access costs an afternoon, a patch can take a planned window, and a reset takes longer still. Doing the cheap step first is what an outfit with a lean team does, and it is the only order that protects a store while the engineers catch up. Good remote access security is mostly disciplined bookkeeping, and the hedgerow of exposed interfaces is cleared one entry at a time.

Selling ot network security without selling the fear#

The temptation, when a story like this breaks, is to put the incident in the headline of an advertisement and imply that a product would have stopped it. That is the wrong promise. Nothing in CERT-FR’s alert says a product would have prevented the compromises, and a vendor that implies otherwise is making a claim it cannot support.

The more durable move is to answer the question a buyer is already asking. A safety officer at a food retailer wants to know which controllers are exposed, which firmware they run and who can reach them. A plain inventory, a dated patch plan and a named owner for each remote route are worth more than a fear campaign, and they can be sold honestly.

The buyer here is not a hacker and not a reader of threat reports. It is an operator who must keep a cold chain running, a cybersecurity lead who must explain the exposure to a board, and a procurement team that will ask what changed after the alert. Write to those three people, and say what the client did in the week after the news.

Teams that sell into operational technology should also read the wider threat picture, which is covered in our review of the ENISA threat landscape. Our own cybersecurity marketing work starts from the same discipline: claims a buyer can check, not claims a headline can carry.

What we still do not know about the refrigeration controller security case#

Four questions remain open. The first is scale. CERT-FR says “nombreuses” compromises and gives no number, so no figure for devices affected should appear in any headline or advertisement. Four questions remain open about remote access security, and about the wider case, as the quiet prowl of the story continues.

The second is the retailers. Press coverage names chains, but the agency does not, and naming them here would turn a press claim into a fact. The third is the route in. Nothing we read says whether the compromises used the management interface, a stolen credential or a flaw in firmware, and the alert’s recommendations apply in every case.

The fourth is Ahold Delhaize. Its statement describes a security issue within its network and nothing more. If a later statement connects the two events, this article should be updated, and the connection should be sourced to that statement alone. Remote access security is the thread that ties those questions together.

Until those answers arrive, the defensible position on remote access security is the narrow one: controllers in the Danfoss AK-SM and AK-SC series were compromised in numbers serious enough for the national agency to publish an alert, and the agency’s advice is to take the management interface off the open internet.

Frequently asked questions#