National cyber security incident response teams have issued emergency operational technology warnings following a widespread physical disruption attack targeting food supply infrastructure. Remote adversaries exploited authentication bypass flaws in industrial refrigeration controllers to disable cooling systems and spoil commercial inventory.
The operational technology attack targeted Danfoss AK-SM 800A and legacy AK-SC 355 refrigeration managers installed across more than 500 French supermarket locations. Unauthenticated remote actors leveraged unpatched web interface authentication bypass flaws to override temperature setpoints, heating commercial walk-in freezers up to 50 degrees Celsius. CERT-FR advised site operators to isolate exposed industrial controllers, perform factory resets, and apply Package 5.3.x firmware updates to prevent further physical damage and operational downtime.
Subverting industrial operational technology devices causes immediate physical impact and supply chain disruption. When internet-exposed building management and cooling controllers lack network isolation or mandatory patch maintenance, remote threat actors can bypass perimeter defenses to tamper with critical physical processes and destroy commercial assets.
– Disconnect all Danfoss AK-SM and AK-SC refrigeration controllers from public internet routing immediately.
– Enforce strict industrial control system OT segmentation, placing facility management devices on isolated VLANs.
– Perform factory resets and apply current Package 5.3.x firmware updates published for Danfoss controller units.
– Audit industrial network access logs for unverified remote connection attempts or unauthorized configuration changes.
Operational technology defense requires strict network segmentation and zero internet exposure for industrial control systems to guarantee critical physical infrastructure remains protected from remote disruption attacks. #CodeDefence #ICS #OTSecurity #Danfoss #SupplyChain #CriticalInfrastructure #IncidentResponse #AppSec #CERT_FR
/
