France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack

Internet-exposed refrigeration controllers in France are disappearing from public view at a dramatic rate following a cyber incident targeting supermarket food supplies.

Censys researchers observed a 71% drop in internet-exposed Danfoss StoreView controllers in just three days after the October 11 cyber-attack targeting hundreds of supermarkets in France, suggesting that operators are moving quickly to limit their systems' online exposure.

Danfoss StoreView was among the equipment targeted by this cyber-attack. StoreView instances are typically used as control panels for Danfoss refrigeration controllers that are installed in many French supermarket fridges and freezers.

Danfoss, a Danish temperature regulation systems provider, has confirmed its equipment was targeted by the cyber-attack, and said most affected controllers were either older models that no longer received security updates (AK-SM800 and AK-SC355) or newer models running outdated firmware (AK-SM800A).

Danfoss patched three vulnerabilities in its AK-SM 800A controllers in March 2025 (CVE-2025-41450) and August 2025 (CVE-2025-41451 and CVE-2025-41452).

A year later, a researcher at industrial security provider Claroty demonstrated how CVE-2025-41450 and CVE-2025-41451 could be chained together to achieve remote code execution and thus disable cooling while falsifying temperature readings, potentially concealing failures in the cold chain.

While Danfoss has not confirmed the exact initial access vector, a plausible explanation is that attackers exploited unpatched vulnerabilities in internet-exposed Danfoss controllers to gain remote access to supermarket refrigeration systems.

Operators Take Danfoss Controllers Offline Instead of Patching

In a new report published on October 14, researchers at Censys have shown a significant drop in France-based Danfoss StoreView instances exposed to the internet in just three days after the attack.

Censys provides a specialized internet search engine that scans and indexes every internet-connected device, server and system on the globe. Instances that can be found with a Censys scan are typically connected to the internet without proper security controls obfuscating their activities, such as a corporate virtual server (VPN) connection.

Such exposure does not mean the instance carries a vulnerability. However, users of assets that are both vulnerable – like unpatched Danfoss AK-SM800A instances – and exposed to the internet, significantly increase their risk of compromise.

Censys found 2991 internet-exposed hosts with a Danfoss StoreView control panel on October 11. Among these, 61% (1825) were located in France.

According to the Censys report, the number of StoreView control panels in France fell to 1781 on October 12 and 537 on October 14 – a 71% drop.

Across other countries analyzed, the change isn’t as dramatic, with 966 internet-exposed hosts with a Danfoss StoreView control panel on October 11, down from 1166 three days earlier.

Censys researchers noted that their telemetry showed that operators of Danfoss StoreView instances don’t appear to be patching their controllers, but “simply taking them off the internet.”

“Patching would have left a mark in the data: the share on 4.3.1 or later (the releases that fix all three CVEs) would have grown,” they explained.

Instead, all three StoreView categories observed – instances below version 4.2, vulnerable to all three vulnerabilities disclosed by Danfoss in 2025; instances in version 4.2.4, vulnerable to CVE-2025-41451 and CVE-2025-41452; and instances in patched versions – shrank by roughly the same amount, about 70%.

“Frankly, this is probably the best choice; there is no reason these should be directly connected to the Internet,” Censys researchers stressed.

In addition, the researchers observed that, while the latest Danfoss StoreView version is 5.3.2, most Danfoss controllers that can be found with a Censys scan worldwide still run unpatched versions of StoreView (older than 4.2).

For instance, while France had 74% of its internet-exposed StoreView instances running below the patched version (4.3.1) on October 11, Poland, Romania and Belgium had even a bigger share (81%, 80% and 76%, respectively).

Meanwhile, the Netherlands was still running 62 internet-exposed, unpatched StoreView instances on the same day, and the US, 58.