France: Internet-Exposed Danfoss Controllers Drop 71% After Attack
Censys researchers observed a 71% drop in internet-exposed Danfoss StoreView controllers in just three days after the October 11 cyber-attack targeting hundreds of supermarkets in France, suggesting that operators are moving quickly to limit their systems' online exposure.
Censys researchers observed a 71% drop in internet-exposed Danfoss StoreView controllers in just three days after the October 11 cyber-attack targeting hundreds of supermarkets in France, suggesting that operators are moving quickly to limit their systems' online exposure.
Danfoss StoreView was among the equipment targeted by this cyber-attack .
StoreView instances are typically used as control panels for Danfoss refrigeration controllers that are installed in many French supermarket fridges and freezers.
Danfoss, a Danish temperature regulation systems provider, has confirmed its equipment was targeted by the cyber-attack, and said most affected controllers were either older models that no longer received security updates (AK-SM800 and AK-SC355) or newer models running outdated firmware (AK-SM800A).
Danfoss patched three vulnerabilities in its AK-SM 800A controllers in March 2025 (CVE-2025-41450) and August 2025 (CVE-2025-41451 and CVE-2025-41452).
While Danfoss has not confirmed the exact initial access vector, a plausible explanation is that attackers exploited unpatched vulnerabilities in internet-exposed Danfoss controllers to gain remote access to supermarket refrigeration systems.
Censys provides a specialized internet search engine that scans and indexes every internet-connected device, server and system on the globe.
Instances that can be found with a Censys scan are typically connected to the internet without proper security controls obfuscating their activities, such as a corporate virtual server (VPN) connection.
A year later, a researcher at industrial security provider Claroty demonstrated how CVE-2025-41450 and CVE-2025-41451 could be chained together to achieve remote code execution and thus disable cooling while falsifying temperature readings, potentially concealing failures in the cold chain.
In a new report published on October 14, researchers at Censys have shown a significant drop in France-based Danfoss StoreView instances exposed to the internet in just three days after the attack.
However, users of assets that are both vulnerable – like unpatched Danfoss AK-SM800A instances – and exposed to the internet, significantly increase their risk of compromise.
Instead, all three StoreView categories observed – instances below version 4.2, vulnerable to all three vulnerabilities disclosed by Danfoss in 2025; instances in version 4.2.4, vulnerable to CVE-2025-41451 and CVE-2025-41452; and instances in patched versions – shrank by roughly the same amount, about 70%.
In addition, the researchers observed that, while the latest Danfoss StoreView version is 5.3.2, most Danfoss controllers that can be found with a Censys scan worldwide still run unpatched versions of StoreView (older than 4.2).
Censys found 2991 internet-exposed hosts with a Danfoss StoreView control panel on October 11.
What happened
Censys researchers observed a 71% drop in internet-exposed Danfoss StoreView controllers in just three days after the October 11 cyber-attack targeting hundreds of supermarkets in France, suggesting that operators are moving quickly to limit their systems' online exposure.
Danfoss StoreView was among the equipment targeted by this cyber-attack .
StoreView instances are typically used as control panels for Danfoss refrigeration controllers that are installed in many French supermarket fridges and freezers.
What changed
Danfoss, a Danish temperature regulation systems provider, has confirmed its equipment was targeted by the cyber-attack, and said most affected controllers were either older models that no longer received security updates (AK-SM800 and AK-SC355) or newer models running outdated firmware (AK-SM800A).
Danfoss patched three vulnerabilities in its AK-SM 800A controllers in March 2025 (CVE-2025-41450) and August 2025 (CVE-2025-41451 and CVE-2025-41452).
While Danfoss has not confirmed the exact initial access vector, a plausible explanation is that attackers exploited unpatched vulnerabilities in internet-exposed Danfoss controllers to gain remote access to supermarket refrigeration systems.
Who is affected
Censys provides a specialized internet search engine that scans and indexes every internet-connected device, server and system on the globe.
Instances that can be found with a Censys scan are typically connected to the internet without proper security controls obfuscating their activities, such as a corporate virtual server (VPN) connection.
Why it matters
A year later, a researcher at industrial security provider Claroty demonstrated how CVE-2025-41450 and CVE-2025-41451 could be chained together to achieve remote code execution and thus disable cooling while falsifying temperature readings, potentially concealing failures in the cold chain.
In a new report published on October 14, researchers at Censys have shown a significant drop in France-based Danfoss StoreView instances exposed to the internet in just three days after the attack.
Technical details
However, users of assets that are both vulnerable – like unpatched Danfoss AK-SM800A instances – and exposed to the internet, significantly increase their risk of compromise.
Instead, all three StoreView categories observed – instances below version 4.2, vulnerable to all three vulnerabilities disclosed by Danfoss in 2025; instances in version 4.2.4, vulnerable to CVE-2025-41451 and CVE-2025-41452; and instances in patched versions – shrank by roughly the same amount, about 70%.
In addition, the researchers observed that, while the latest Danfoss StoreView version is 5.3.2, most Danfoss controllers that can be found with a Censys scan worldwide still run unpatched versions of StoreView (older than 4.2).
Response
Censys found 2991 internet-exposed hosts with a Danfoss StoreView control panel on October 11.
According to the Censys report, the number of StoreView control panels in France fell to 1781 on October 12 and 537 on October 14 – a 71% drop.
What security teams should do
Across other countries analyzed, the change isn’t as dramatic, with 966 internet-exposed hosts with a Danfoss StoreView control panel on October 11, down from 1166 three days earlier.
Censys researchers noted that their telemetry showed that operators of Danfoss StoreView instances don’t appear to be patching their controllers, but they explained.
Attribution
Infosecurity Magazine: Censys researchers observed a 71% drop in internet-exposed Danfoss StoreView controllers in just three days after the October 11 cyber-attack targeting hundreds of supermarkets in France, suggesting that operators are moving quickly to limit their systems' online exposure.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.