Safety-conscious controls for exposed refrigeration controllers

As of October 23, 2026, the public briefing reported exploitation of Danfoss refrigeration controllers across European supermarkets, while the captured search record was seeking confirmation involving AK-SM 800A and 700 French supermarkets.

That search capture contains no substantive result confirming the report, and the incident scale remains uncorroborated.

Immediate exposure reduction and independent verification are still warranted because AK-SM 800A units in scope directly support temperature and defrost control, while the recommended actions do not depend on proving the reported campaign.

Operators of exposed or suspected Danfoss AK-SM 800A units with direct internet access or remotely reachable management face the reported, but unconfirmed, access concern and should restrict that path.

Refrigeration operations staff relying on AK-SM 800A temperature and defrost controls face a distinct continuity and safety consequence if maintenance disrupts active refrigeration.

Administrators responsible for controller firmware, remote-management accounts, and access controls must perform the validation and restriction steps.

No affected firmware version is established, and the evidence does not support automatically extending this decision to other Danfoss refrigeration-controller models.

Support — The Roundtable final synthesis recommends removing direct internet exposure, validating firmware and accounts, independently verifying temperature and defrost controls, and completing safety checks before disruptive changes.

Context, not confirmation — The public briefing handoff states that Danfoss refrigeration-controller flaws were exploited across European supermarkets, but provides no underlying authoritative incident evidence.

Insufficient evidence — The captured search record contains a query and search header concerning AK-SM 800A, France, 700 supermarkets, fires, and food loss; it does not contain substantive results confirming those claims.

Evidence gap — The available material names AK-SM 800A but supplies no affected firmware range or basis for extending the decision to other Danfoss controller models.

The decision scout proposed removing direct internet exposure, controlling remote management, validating firmware and accounts, checking temperature and defrost controls, and avoiding several named disruptive actions.

The evidence auditor found strong support for exposure reduction and independent safety checks, but not for the categorical list of prohibited actions, coverage beyond AK-SM 800A, or confirmed exploitation.

The boundary reviewer resolved those issues by limiting the scope to exposed or suspected AK-SM 800A units and replacing the unsupported list with a general requirement to complete safety checks and continuity preparations before disruptive work.

The decision arbiter accepted that narrowed operational position. The decision linker found no prior record to update, although the absence of a retrieved prior record does not establish that none exists.