Significant Drop in Internet-Exposed Refrigeration Controllers in France Post-Cyber Attack
In the wake of a recent cyber incident targeting supermarket food supplies in France, a startling trend has emerged. Internet-exposed refrigeration controllers, particularly the Danfoss StoreView models, are disappearing at an alarming rate. This development, observed by researchers from Censys, indicates a swift and decisive response from operators aiming to reduce their systems’ online exposure.
On October 11, a major cyber-attack hit hundreds of supermarkets across France, leading to an immediate 71% decline in the number of Danfoss StoreView controllers accessible via the internet within just three days. This drastic reduction suggests that the operators of these refrigeration systems are taking significant measures to safeguard their equipment, likely moving quickly to disconnect vulnerable systems from the internet.
The Danfoss StoreView system serves as a critical control panel for refrigeration controllers found in various French supermarket fridges and freezers. Following the attack, Danfoss, a Danish company specializing in temperature regulation systems, confirmed that its devices were indeed targeted. It was noted that many affected devices were either older models no longer receiving security updates, such as the AK-SM800 and AK-SC355, or newer models operating on outdated firmware—specifically, the AK-SM800A.
This incident underscores a serious security issue, as Danfoss had previously patched three vulnerabilities in its AK-SM800A controllers in March and August of 2025. The vulnerabilities, identified under the Common Vulnerabilities and Exposures (CVE) system, raised concerns when a researcher from Claroty demonstrated how two specific vulnerabilities (CVE-2025-41450 and CVE-2025-41451) could be combined to execute remote code. Such exploits could disable cooling systems while simultaneously providing false temperature readings, ultimately compromising the integrity of food storage—a critical concern for supermarkets.
While the exact access point for the attackers remains unconfirmed by Danfoss, it is speculated that they may have exploited unpatched vulnerabilities in the Danfoss controllers exposed to the internet. In a recent Censys report published on October 14, researchers detailed their findings, illustrating a rapid decline in the number of internet-exposed Danfoss StoreView instances following the incident.
Censys operates a specialized internet search engine designed to identify internet-connected devices globally. Their scans indicated that on October 11, there were 2,991 internet-exposed hosts utilizing the Danfoss StoreView control panel, with 61% (1,825) situated in France. By October 12, this number dropped to 1,781, and by October 14, it plummeted to just 537, showcasing a massive 71% decrease in a matter of days. In contrast, other countries did not experience a similarly dramatic decline. For instance, while the number of StoreView instances in the rest of the world sagged from 1,166 to 966, the change was not as severe as that seen in France.
Censys researchers further noted that operators of Danfoss StoreView instances appear to be opting for a strategy of taking devices offline rather than implementing patches. According to their insights, if operators had applied patches to vulnerable systems, growth in versions 4.3.1 or later (the updates that addressed all three vulnerabilities identified by Danfoss) would have been visible in the data. Instead, both vulnerable and patched instances saw roughly equal drops of about 70%.
The Censys team emphasized the rationale behind this decision, suggesting that it was a prudent choice to disconnect the refrigeration controllers from internet exposure. They asserted that there is little justification for these devices to remain directly connected to the internet, given the potential risks involved.
Interestingly, the latest Danfoss StoreView version, 5.3.2, remains underutilized, as many worldwide are still operating with older, unpatched versions. On October 11, a startling 74% of internet-exposed StoreView instances in France were running versions inferior to the patched update (4.3.1). Other nations, such as Poland, Romania, and Belgium, exhibited even higher proportions of vulnerable instances, reaching up to 81%, 80%, and 76%, respectively. Countries like the Netherlands and the United States also recorded the presence of persistent, unpatched instances, further illustrating the widespread nature of this vulnerability.
As supermarket operators in France respond to the significant breach, the focus shifts toward enhancing cybersecurity measures and ensuring that critical infrastructure like refrigeration systems are secured against future threats. The rapid decline in exposed StoreView controllers serves as a crucial reminder of the importance of cybersecurity vigilance in an increasingly interconnected world.