#CyberWeekly

Non-IT Walk the building this week and list every box a supplier can adjust from outside: cooling, HVAC, alarm, cameras, door access. Old ones come off the internet this month.

IT Danfoss told AFP its AK-SM800 and AK-SC355 lines were hit and that most of them no longer get updates: replace them or take them off the internet. The AK-SM 800A is fixed in R4.2 and R4.3.1 (CISA ICSA-25-140-03). Find them, and any other controller, on your clients' networks.

Is this your problem? Yes, if a supplier looks after any machine in your building over the internet: cooling, heating and ventilation, the alarm, cameras, door access, a production line, even the coffee machine. That is most Belgian SMEs, inside NIS2 scope or not. Belgian supermarkets were not hit: Comeos told VRT the problem sat with Danfoss France and that Belgian cooling ran normally.

What happened In the night of 11 to 12 October, hackers got into the system Danfoss uses to manage supermarket refrigeration from a distance. They switched fridges and freezers in French stores to permanent defrost, up to 50°C according to BFM TV.

In some shops the temperature climbed for six hours before anyone noticed. Staff emptied the chilled aisles, had a bailiff record it, and threw the food away.

• How many: France's finance minister told Parliament on 13 October that about 700 of the country's 10,000 supermarkets were affected (AP). The Mousquetaires group counts 300 Intermarché and Netto stores, Coopérative U 80 of its 2,000, Monoprix about 5% of its stores. Carrefour was hit too and gave no number.
• What it cost: one Intermarché in Alsace lost its whole frozen stock, around EUR 50,000. Two stores in that region put their combined loss at EUR 270,000. Nationally, several million euros. The Paris prosecutor's cybercrime unit is investigating, including reports of fires.
• How they got in: Danfoss says most of the hit units were older products that no longer get security updates. French officials say ANSSI found a vulnerability in the vendor's software but have not named it. What is proven: controllers that were out of support, or never updated, could be reached from outside the store. Step 3 below gets yours off the internet.

"Login admin, password today's date" went round this week. True for one Danfoss line (AK-SM 800A), fixed in 2025 (CISA advisory ICSA-25-140-03); not shown to be the way in. Whether your boxes have that flaw or another, the questions in step 2 find out.

The one thing: find every machine a supplier can reach from outside, and take the old ones off the internet.

Three things to do this week:

1. Non-IT List the machines, not the software. Walk the building and write down every box a supplier can adjust from their office: cooling, HVAC, alarm, cameras, access control, boiler, production line. If it has a network cable and nobody in IT owns it, it goes on the list.
2. Non-IT Ask the installer of each one, this week: "Which of our devices can be reached from the internet? Which are past end of life or behind on updates? Who has remote access, and when did anyone last check that list?"
3. Non-IT Anything out of support, or reachable from the whole internet: off the internet this month. If the installer needs remote access, it goes through a VPN they keep updated, on its own network, away from your office PCs. That is CISA's standing advice for exactly these controllers.

Keep the list from step 1. Under CyFun and NIS2 it is your asset inventory and your supplier-access control. For boxes out of support it is also the only warning you get: the EU Cyber Resilience Act (reporting duty since 11 September 2026) covers supported products only. The questions for step 2 are in our guide on what to expect from a supplier.

Non-IT Write your incident plan this week, on one page. First, the response: who may switch systems off (a name and a deputy), who you call (IT partner, insurer, the CCB), who tells customers and staff what. Then the fallbacks: for each system, can you still run the business if a hacker takes it out for a day? Website, email, till, phones, invoicing, shared files. Write the workaround next to each one, like orders by phone on a paper pad while the webshop is down.

IT Nothing to update. Book a 30-minute drill with each client: "the website and orders are down, now what?" Walk the page, then test one restore.

What happened On 12 October Ahold Delhaize, Delhaize's parent, found "a security issue within its network" and took some systems offline itself. The websites of Delhaize and Albert Heijn went dark; stores stayed open and kept selling. On 13 October it said it had no evidence that customer or employee data was stolen. It is a different company with different systems, and nobody has tied it to the fridge attack.

Why it held. Someone was allowed to switch systems off without calling a meeting first. The stores knew how to sell without the website. Within a day the company said what it knew about customer data. Each of those can be a line on your page, written down before you need it.

If your company falls under NIS2, the first warning to the CCB is due within 24 hours. Put cert@ccb.belgium.be on the page.

Next: the first 15 minutes are in our incident response guide. Getting your files back is in the guide on backups that actually restore.

Non-IT Forward this section to your IT partner and ask for a yes on each of the four rows.

IT Per product: the flaw, the fix, the deadline and who checks.

• Ivanti Connect Secure
  Flaw: CVE-2026-104935, authentication bypass, exploited
  Fix: 25.1.3.0 and 22.8R2.5; 22.7R2.14 and earlier not affected (Ivanti's CVE record)
  Do by: Friday 16 October
  Who checks: IT or whoever manages the box
• Windows
  Flaw: CVE-2026-96951, Mark of the Web bypass, exploited
  Fix: October cumulative update: KB5127648 (Windows 11 24H2 and 25H2), KB5126653 (23H2), KB5126657 (Windows 10 22H2)
  Do by: this week
  Who checks: IT on every PC
• FortiGate VPN
  Flaw: no new CVE: stolen logins, 969 in use (CCB)
  Fix: the week-41 password reset, after checking the full account list
  Do by: now
  Who checks: IT
• Danfoss controllers
  Flaw: AK-SM 800A: CVE-2025-41450, 41451, 41452
  Fix: R4.2 and R4.3.1; AK-SM800 and AK-SC355 get no updates: replace, or off the internet
  Do by: this month
  Who checks: Non-IT Ask your installer what they fixed

In plain words:

• Ivanti Connect Secure (formerly Pulse Secure). Who should care: anyone whose staff log in from home through one. Ask: "Do we use Ivanti for remote access, and is the 13 October fix on it?" Unpatched, a stranger on the internet takes it over without a password and steals logins and data. CISA listed it as actively exploited on 13 October.
• Technician: CVE-2026-104935, authentication bypass with unauthenticated command execution. Commands run in memory, so the Integrity Checker Tool may show nothing. Fixed builds are in Ivanti's advisory, linked from the CISA alert below.
• Windows. Who should care: everyone with a Windows PC. Ask: "Did October's Windows updates install on every PC?" Technician: 1,770 entries in the October round; CVE-2026-96951 lets a downloaded file skip its "are you sure?" warning and was already in use before the fix shipped.
• Fortinet, follow-up to week 41. Who should care: anyone with a FortiGate firewall, the box with the Fortinet badge. Ask: "Did we reset the VPN passwords from week 41?" Detail: the CCB says a ransomware gang calling itself "The Gentlemen" is using the stolen stash, 969 working FortiGate VPN logins and some 14,700 devices, six confirmed Belgian victims this year. The steps are in last week's issue.

Our guide on why updating matters even when nothing looks broken covers the "assess before you patch" step for already-exploited flaws like these.

You (or whoever runs ECP for you): if one corner (the shop floor, hosted phones) does not fit a control, make it a group and write down why.

IT Use it for client sites with OT or hosted kit, instead of claiming a control for everyone.

One part of the company that works differently should not drag the whole score down, or force you to pretend. One corner does not fit the rule: the phone systems you host for customers, or the shop floor. Until now you claimed the control for everyone and hoped the auditor did not look, or you left it red.

What changed:

• Set that part apart, by name. Type a word that appears in those devices' names, and ECP groups them and shows how many it found.
• Score a risk for that part on its own. Ransomware on hosted phone systems is not ransomware on office laptops. The group gets its own score and owner; the rest of the company keeps its old score, and a device added later lands in the rest, so nothing drops off the register.
• Accept a risk, and ECP proposes a matching exception on its controls, ending no later than the review date you set. The risk's owner or an admin has to confirm it, and the review date tells them when to look again. Under CyFun it shows as a deviation, not as done.

Why an auditor accepts it: every group and exception carries a written reason and an end date, and the audit export spells them out.

Non-IT Open Scope, make one group for the part that is genuinely different, and write why. The help page walks you through it. Everything else that shipped is in the changelog.