{"id":883322,"date":"2026-10-15T15:46:10","date_gmt":"2026-10-15T15:46:10","guid":{"rendered":"https:\/\/www.newsbeep.com\/us\/883322\/"},"modified":"2026-10-15T15:46:10","modified_gmt":"2026-10-15T15:46:10","slug":"france-internet-exposed-danfoss-controllers-drop-71-after-attack","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us\/883322\/","title":{"rendered":"France: Internet-Exposed Danfoss Controllers Drop 71% After Attack"},"content":{"rendered":"

\n\tInternet-exposed refrigeration controllers in France are disappearing from public view at a dramatic rate following a cyber incident targeting supermarket food supplies<\/a>.<\/p>\n

\n\tCensys researchers observed a 71% drop in internet-exposed Danfoss StoreView controllers in just three days after the October 11 cyber-attack targeting hundreds of supermarkets in France, suggesting that operators are moving quickly to limit their systems’ online exposure.<\/p>\n

\n\tDanfoss StoreView was among the equipment targeted by this cyber-attack<\/a>. StoreView instances are typically used as control panels for Danfoss refrigeration controllers that are installed in many French supermarket fridges and freezers.<\/p>\n

\n\tDanfoss, a Danish temperature regulation systems provider, has confirmed its equipment was targeted by the cyber-attack, and said most affected controllers were either older models that no longer received security updates (AK-SM800 and AK-SC355) or newer models running outdated firmware (AK-SM800A).<\/p>\n

\n\tDanfoss patched three vulnerabilities in its AK-SM 800A controllers in March 2025 (CVE-2025-41450) and August 2025 (CVE-2025-41451 and CVE-2025-41452).<\/p>\n

\n\tA year later, a researcher at industrial security provider Claroty demonstrated how CVE-2025-41450 and CVE-2025-41451 could be chained together to achieve remote code execution and thus disable cooling while falsifying temperature readings, potentially concealing failures in the cold chain.<\/p>\n

\n\tWhile Danfoss has not confirmed the exact initial access vector, a plausible explanation is that attackers exploited unpatched vulnerabilities in internet-exposed Danfoss controllers to gain remote access to supermarket refrigeration systems.<\/p>\n

\tOperators Take Danfoss Controllers Offline Instead of Patching<\/p>\n

\n\tIn a new report<\/a> published on October 14, researchers at Censys have shown a significant drop in France-based Danfoss StoreView instances exposed to the internet in just three days after the attack.<\/p>\n

\n\tCensys provides a specialized internet search engine that scans and indexes every internet-connected device, server and system on the globe. Instances that can be found with a Censys scan are typically connected to the internet without proper security controls obfuscating their activities, such as a corporate virtual server (VPN) connection.<\/p>\n

\n\tSuch exposure does not mean the instance carries a vulnerability. However, users of assets that are both vulnerable \u2013 like unpatched Danfoss AK-SM800A instances \u2013 and exposed to the internet, significantly increase their risk of compromise.<\/p>\n

\n\tCensys found 2991 internet-exposed hosts with a Danfoss StoreView control panel on October 11. Among these, 61% (1825) were located in France.<\/p>\n

\n\tAccording to the Censys report, the number of StoreView control panels in France fell to 1781 on October 12 and 537 on October 14 \u2013 a 71% drop.<\/p>\n

\n\tAcross other countries analyzed, the change isn\u2019t as dramatic, with 966 internet-exposed hosts with a Danfoss StoreView control panel on October 11, down from 1166 three days earlier.<\/p>\n

\n\tCensys researchers noted that their telemetry showed that operators of Danfoss StoreView instances don\u2019t appear to be patching their controllers, but \u201csimply taking them off the internet.\u201d<\/p>\n

\n\t\u201cPatching would have left a mark in the data: the share on 4.3.1 or later (the releases that fix all three CVEs) would have grown,\u201d they explained.<\/p>\n

\n\tInstead, all three StoreView categories observed \u2013 instances below version 4.2, vulnerable to all three vulnerabilities disclosed by Danfoss in 2025; instances in version 4.2.4, vulnerable to CVE-2025-41451 and CVE-2025-41452; and instances in patched versions \u2013 shrank by roughly the same amount, about 70%.<\/p>\n

\n\t\u201cFrankly, this is probably the best choice; there is no reason these should be directly connected to the Internet,\u201d Censys researchers stressed.<\/p>\n

\n\tIn addition, the researchers observed that, while the latest Danfoss StoreView version is 5.3.2, most Danfoss controllers that can be found with a Censys scan worldwide still run unpatched versions of StoreView (older than 4.2).<\/p>\n

\n\tFor instance, while France had 74% of its internet-exposed StoreView instances running below the patched version (4.3.1) on October 11, Poland, Romania and Belgium had even a bigger share (81%, 80% and 76%, respectively).<\/p>\n

\n\tMeanwhile, the Netherlands was still running 62 internet-exposed, unpatched StoreView instances on the same day, and the US, 58.<\/p>\n

\n\tImage credits:\u00a0Werner Lerooy \/ ricochet64 \/ Shutterstock.com<\/p>\n","protected":false},"excerpt":{"rendered":"Internet-exposed refrigeration controllers in France are disappearing from public view at a dramatic rate following a cyber incident…\n","protected":false},"author":2,"featured_media":883323,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[43],"tags":[174,74],"class_list":["post-883322","post","type-post","status-publish","format-standard","has-post-thumbnail","category-internet","tag-internet","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/883322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=883322"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/883322\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/883323"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=883322"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=883322"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=883322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}