Only obsolete, end-of-life Danfoss units were affected
Assessment
Danfoss stated that most affected systems were older generations — the AK-SM 800 (end-of-life since 2021) and AK-SC 355 (phased out 2016) — that no longer receive security updates. This is the vendor's own characterisation and tends to shift responsibility toward operators running outdated hardware. Reporting indicates that some current-model AK-SM 800A units were also hit, reportedly while running outdated firmware, and CERT-FR frames the root problem as internet exposure of management interfaces rather than model age alone, adding Copeland and Dixell product lines to the same alert. 'Only obsolete equipment' understates the exposure of supported devices and the broader configuration issue.
Where this claim appeared
L'Usine Digitale · 2026-10-13
https://www.usine-digitale.fr/cybersecurite/frigos-de-supermarches-sabotes-des-controleurs-danfoss-obsoletes-des-failles-documentees-et-des-responsabilites-a-eclaircir.OUL4TOPO3BFNTNXUC4QILX3OAY.htmlWhat “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
French supermarket cyberattack: Danfoss fridge controllers forced into defrost, stock spoiled, fires reportedThink this assessment is wrong? Report an error.