Danfoss AK-SM and AK-SC: CERT-FR alert and OT access review

On 12 October, CERT-FR warned of compromises affecting Danfoss AK-SM and AK-SC devices and recommended disconnecting or filtering access. Source: alert CERTFR-2026-ALE-012.

Danfoss describes its System Manager units as components of food retail refrigeration and HVAC systems, coordinating temperature data, alarms and defrosting, among other functions. This application context comes from the manufacturer’s product description.

Breachroad’s conclusion: the site owner, technical service team and IT should jointly establish who can change device settings and how to restrict access while maintaining control of the process. The steps below are our organisational plan, rather than an account of an individual victim.

Start with the device and its owner

We suggest creating a device list containing the model, version, location, configuration owner and service provider. An entry saying that a contractor handles refrigeration is too broad to establish who will confirm settings and decide on access changes.

Also identify who receives alarms and how an operator reports unexpected behaviour. If the inventory exists only in a service provider’s tool, the organisation needs an agreed way to obtain that information. The person responsible for the site should know how to contact the technical owner and understand their responsibilities.

Review the entire remote access path

In our assessment, the review needs to establish the management interface’s actual reachability: public addresses, port forwarding, partner access and connections from other network segments. Do not limit it to the method normally used by a service technician.

Record the people and systems authorised to administer devices, the purpose of connections and how access ends. Review shared accounts and old permissions. Using a VPN does not establish which devices a user can reach after signing in.

Our recommendation is to coordinate every access restriction with the process owner and service team. Confirm that required alerting and support remain available. The result should show both the allowed access scope and verification of required functions after the change.

Suspected compromise requires a recovery plan

For suspected compromise, CERT-FR lists restricting connections to service providers, a factory reset, all available security patches, secret rotation, account review and device reconfiguration.

We recommend planning these actions with the installation owner and incident handlers. Before changes, where feasible without delaying urgent protection, preserve available logs and state information. Identify a trusted configuration source, necessary parameters and how they will be confirmed after recovery.

The plan should identify the sequence, approving owners and conditions for resuming operation. Resetting a device is one recovery step; the owner also needs evidence that the correct configuration and operator access were restored. Do not automatically treat an arbitrary settings copy as trusted.

Review device and process status separately

In our plan, IT assesses accounts, connections and available events, while the installation owner confirms required functions and alarm handling. Both teams should record their findings in the same ticket.

If part of the assessment remains incomplete, identify the limitation and an owner for further work. A broad statement that the device works does not establish whether change history was explained or remote access reviewed. Closing a network rule likewise does not describe the entire installation state.

A scenario for technicians and operators

Consider a site where several partners use one administrative account and an operator observes an unapproved settings change. This is a hypothetical discussion scenario, rather than a reconstruction of an incident in France.

Ask participants to identify the reporting route, who owns the access decision and what evidence is needed to reconstruct the history. The exercise should connect the operator’s procedure with service and IT responsibilities. It can use a written scenario without changing settings on live equipment.

For more on access boundaries, read our guide to Zero Trust. Organisations seeking to practise cooperation between operators, service providers and IT during a security event can explore our cybersecurity training for teams.