A 71% drop in internet-exposed Danfoss StoreView refrigeration control panels in France over three days followed an October 11 cyber-attack that disrupted hundreds of supermarkets, Censys researchers reported — an abrupt pullback that suggests operators raced to remove systems from public view rather than deploy fixes.
Censys telemetry shows a sudden disappearance of StoreView control panels
Censys, a specialized internet search engine that scans and indexes internet-connected devices, found 2,991 internet-exposed hosts running a Danfoss StoreView control panel on October 11. Of those, 61% — 1,825 — were located in France. By October 12 the number in France had fallen to 1,781, and by October 14 it had dropped again to 537, a 71% decline over three days.
The change outside France was less dramatic: Censys recorded 966 internet-exposed StoreView hosts on October 11, down from 1,166 three days earlier. Censys emphasized that instances discovered by its scans are typically connected without security controls such as a corporate VPN and that exposure does not automatically mean the instance is vulnerable; however, exposure combined with unpatched vulnerabilities materially raises the risk of compromise.
Danfoss equipment targeted, and which models were most at risk
Danfoss, the Danish provider of temperature-regulation systems, confirmed its equipment was targeted in the incident. According to Danfoss, most affected controllers were either older models that no longer received security updates — the AK-SM800 and AK-SC355 — or newer AK-SM800A units running outdated firmware.
Danfoss released patches for three vulnerabilities in its AK-SM 800A controllers in March 2025 (CVE-2025-41450) and in August 2025 (CVE-2025-41451 and CVE-2025-41452). Despite those fixes, Censys found that most publicly reachable Danfoss controllers worldwide were still running unpatched StoreView versions older than 4.2, even though the latest StoreView release is 5.3.2.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildExploit demonstration: how two CVEs can be chained to disable cooling and falsify readings
A year after the Danfoss CVE disclosures, a researcher at industrial security provider Claroty demonstrated a chained exploit using CVE-2025-41450 and CVE-2025-41451 that achieved remote code execution. Claroty’s demonstration showed how an attacker could disable cooling while falsifying temperature readings, which could conceal failures in the cold chain.
While Danfoss has not confirmed the exact initial access vector used in the October 11 incident, Censys and other observers noted that a plausible explanation is that attackers exploited unpatched vulnerabilities in internet-exposed Danfoss controllers to gain remote access to supermarket refrigeration systems.
Operators’ chosen fix: taking controllers off the internet rather than patching
Censys’ analysis indicates that operators responded by disconnecting StoreView instances from the internet rather than applying firmware updates. The researchers observed that if mass patching had occurred, the share of instances running StoreView 4.3.1 or later — the releases that fix all three CVEs — would have increased. Instead, all three observed StoreView categories (versions below 4.2, version 4.2.4, and patched versions) contracted by roughly the same amount, about 70%.
“Frankly, this is probably the best choice; there is no reason these should be directly connected to the Internet,” Censys researchers wrote, stressing the immediate security rationale for removing direct internet exposure.
Country-level telemetry on October 11 showed high fractions of internet-exposed StoreView instances running below the patched 4.3.1 release: France 74%; Poland 81%; Romania 80%; Belgium 76%. The Netherlands had 62 internet-exposed, unpatched StoreView instances on the same day, and the United States had 58.
What this means for technologists, supermarket operators, and adversaries
- Technologists and security teams: Censys’ findings underscore that visible remediation in telemetry (an increase in patched versions) did not appear; instead, teams appear to have reduced internet exposure. Security teams will weigh the immediate safety of isolation against the operational work of patching and firmware upgrades.
- Supermarket operators and procurement leaders: The incident highlights the risks of older controllers that no longer receive security updates (AK-SM800, AK-SC355) and newer units running outdated firmware (AK-SM800A). Procurement and maintenance choices — upgrade cycles and firmware management — directly shape exposure to exploits demonstrated by Claroty.
- Adversaries and threat actors: The public demonstration that CVE-2025-41450 and CVE-2025-41451 can be chained to achieve remote code execution establishes a credible technical path for attackers to both disable cooling and falsify temperature readings when exposed, increasing the appeal of internet-exposed, unpatched targets.
Operators’ swift removal of many StoreView instances from the internet reduced visible attack surface, but it also left open a central question: what exactly allowed the attackers initial access? Danfoss has not confirmed the initial access vector. The October 11 incident, the March and August 2025 CVE disclosures, Claroty’s exploitation demonstration, and the rapid drop in internet-exposed control panels together paint a compact record of vulnerability, demonstrated exploitability, and rapid operational mitigation — but not yet a full forensic account.
https://www.infosecurity-magazine.com/news/france-expose-danfoss-controllers/
