Note, 13 October 2026

Your device will outlive your support

On the night of 11 October 2026 a cyberattack hit the refrigeration of hundreds of French supermarkets. Danfoss, whose controllers were among those compromised, told AFP that most of its affected units no longer receive updates. A device keeps working long after its maker has stopped looking after it. This note is about those years.

What happened

E. Leclerc, Intermarché and Coopérative U confirmed to AFP that they had suffered a cyberattack. Their counts to AFP exceed 400 stores; BFM TV was told fewer. BFM TV reports that the attackers are said to have forced the automatic defrost to run continuously, set to 50 °C. Intermarché told AFP that the affected branches have to throw away all their fresh and frozen products. The Paris prosecutor's office has opened an investigation; it told AFP victims reported "foodstuff losses and the outbreak of fires".

France's CERT-FR, in an alert dated 12 October, says it knows of numerous compromises of Danfoss AK-SM and AK-SC remote refrigeration controllers. It now also lists Copeland and Dixell xweb units. It does not say how the attackers got in. It does say that attack campaigns are probably still under way, and that exposing a management interface online is in general against good practice.

Danfoss told AFP that most of the affected equipment was "legacy" products which "no longer receive software or security updates". Its statement to Cooling Post, as the paper reports it, names the AK-SM 800, declared end of life in 2021, and the AK-SC 355, phased out in 2016, and says the affected units of the current AK-SM 800A ran outdated firmware.

It had happened before

In its customer newsletter of October 2025 Danfoss listed earlier cases. "Russia, 2022: Sixteen supermarkets using AK SM 800 were targeted by cyberattacks at the start of the war." And "Israel, 2022: Forty stores were hacked. All affected stores lacked proper firewall or VPN protection, and all used AK SM 800." In the same text it says it enforces a "hard End of Service" on products past end of life, and recommends moving to its current model.

In 2023 Synacktiv reported that the SM800 firmware it tested accepted, besides a user name and password, a code of the day computed from the date alone, and gave out its date to anyone. By Synacktiv's account Danfoss answered that the flaw affected only end-of-life products, and set out network protections and a notice to customers. The advisory's mitigation is one line: "Restrict network access to the affected products." In August 2026 Claroty described a code of the day in the current AK-SM 800A as well, which it says Danfoss has fixed in newer firmware, and found 2,765 of those units exposed to the internet, by a Censys scan. Neither CERT-FR nor Danfoss has said whether any of this was the way in on 11 October.

Four questions for the years after

A maker cannot make a customer replace a machine that still works. It can decide, while it still writes the firmware, how the device behaves once nobody updates it. Four questions.

1. Who can reach it?

A device that serves its management page to whoever finds its address is one flaw, or one password, away from a stranger. Build it the other way round: the device calls out to your service and listens for nothing from outside, and a technician goes through that service, under a name. CERT-FR's advice for affected units: off the internet, and back only through a secure VPN or protected network.

2. Is there a way in that only you know?

A code worked out from the date alone would be one password for every unit, and it stops being yours the day somebody reads the firmware. If field service needs a way in, make it belong to one unit and need a person standing at it: a button held down, a code shown on the unit's own display.

3. What can a remote command not do?

Defrost is an ordinary function. Most devices have one like it: a mode that is harmless for minutes and ruinous for hours. Decide, for each, the limit that no setting can lift, and keep that limit close to the hardware, below the part that takes commands from the network. Send the alarm by a second route.

4. What happens on the last day of support?

Decide it while the product is new. Tell the buyer the date, and let the device show it on its own screen. Use the last update you will ever ship to close what you will no longer watch: remote management off, until someone standing at the unit turns it on. CERT-FR is blunt about end-of-life units left on the internet: they are very likely to be compromised, and a factory reset alone is not enough, because the unit stays vulnerable.

A drill

Three checks. List every product you have shipped that has a network port, each with the date of its last update. Search Shodan or Censys for the title of your product's management page and count the answers. Take one unit to the bench, pick the function that could do the most harm, and find out what stops it when the command comes from outside.

All notes