Danfoss AK-SM and AK-SC: compromises via exposed interfaces
CERT-FR reports numerous compromises of Danfoss AK-SM and AK-SC devices with their management interface exposed online. What the alert says and what to do now.
On 12 October 2026 CERT-FR, the incident response centre of the French agency ANSSI, published alert bulletin CERTFR-2026-ALE-012 on Danfoss AK-SM and AK-SC series devices. CERT-FR states that it is aware of numerous compromises of these devices and draws attention to the exposure of the management interface on the Internet.
For now the only source is the CERT-FR alert: below we report what it says, and point out what it does not say, without adding assumptions.
What happened
According to CERT-FR:
- numerous compromises of Danfoss AK-SM and AK-SC series devices are taking place;
- the affected systems are listed as the AK-SC series and the AK-SM series, with no distinction between models or firmware versions;
- the risk level is “not specified by the vendor”;
- exposing a management interface on the Internet goes against good practice.
The alert is in its initial version, dated 12 October 2026, and may be updated with new details.
What these devices are
AK-SM and AK-SC are Danfoss supervision and control units (system managers and system controllers) for refrigeration and air-conditioning systems, used mainly in food retail stores. They are operational technology (OT) devices: they monitor and regulate physical plant, and whoever controls their management interface can act on their settings.
Technical details: what the alert says and what it does not
- CVE: none listed in the alert.
- Affected versions: not specified; the alert refers to the series as a whole.
- Vector: the management interface reachable from the Internet. CERT-FR does not say how the attackers got in (a vulnerability, weak or default credentials, something else) or what they did on the compromised devices.
- Indicators of compromise: none published.
- MITRE ATT&CK for ICS: access to an industrial device directly reachable from the Internet corresponds to technique T0883 (Internet Accessible Device). The alert does not list the techniques used.
Among the remediation actions, CERT-FR asks to apply all available security patches, rotate secrets and review existing accounts: check with Danfoss or your installer which is the latest version available for your devices.
Impact for European and Italian organisations
The alert is French, but it concerns products, not a country: it applies to anyone with an AK-SM or AK-SC reachable from the Internet. The first organisations to check are food retail chains, cold-chain logistics and companies that entrust plant maintenance to an external provider with remote access: service providers are precisely the only parties CERT-FR allows to keep access in case of suspected compromise.
Food production, processing and distribution are among the sectors covered by the NIS2 Directive. If your organisation falls within scope, the compromise of a system that controls plant is an incident to assess for notification to the national CSIRT, which in Italy is CSIRT Italia at ACN.
What to do now
The measures indicated by CERT-FR:
- Disconnect or filter access to AK-SM and AK-SC instances.
- If remote administration is essential, as a first temporary measure restrict access to trusted IP addresses. CERT-FR still advises following its hardening recommendations, in particular document CERTFR-2025-DUR-003, “Recommendations for stakeholders in the energy and water sector”.
In case of suspected compromise, CERT-FR says to:
- filter network access to AK-SM and AK-SC instances, allowing it only to service providers;
- perform a factory reset;
- apply all available security patches;
- rotate secrets (passwords and other credentials);
- review existing accounts;
- fully reconfigure the device.
A factory reset erases the configuration, which then has to be rebuilt (the last step): plan it with whoever manages the plant, to limit refrigeration downtime.
To find out whether you are exposed, start from the inventory: which AK-SM and AK-SC devices you have, at which sites, and whether their management interface is reachable from the Internet, directly or through rules opened for the installer on the site’s router or firewall.
How ARXDOME helps
ARX Expose shows what an attacker sees from outside: open ports and recognised products on your organisation’s public addresses, useful to find out whether a management interface is reachable from the Internet. ARX Watch finds devices on the corporate network that have nothing installed, identifies their ports and services and alerts you when a new one appears. With ARX Sentry, firewall logs flow into the portal and the perimeter stays under control.
Last updated:
