French Supermarkets Disconnect 71% of Danfoss Controllers After Attack
Censys data shows a sharp drop in internet-exposed Danfoss refrigeration units in France following the October cyber-incident targeting supermarket cold chains.
Key points
- Censys researchers recorded a 71% decline in internet-exposed Danfoss StoreView controllers in France within three days of the October 11 attack.
- Danfoss confirmed that older models lacking updates and newer models with outdated firmware were targeted during the incident.
- Claroty researchers previously demonstrated that chaining two known vulnerabilities could allow remote code execution and falsified temperature readings.
French operators of Danfoss refrigeration systems have rapidly reduced their internet exposure following a cyber-attack that disrupted supermarket food supplies. Censys researchers observed a 71% drop in internet-exposed Danfoss StoreView instances in France over just three days after the October 11 incident, indicating a swift operational response to limit exposure.
The attack targeted hundreds of supermarkets, causing refrigeration failures that threatened perishable goods. As Threat Times reported on October 15, an estimated 700 French supermarkets faced system failures after attackers exploited known vulnerabilities in three controller models previously flagged by security firms. The rapid disappearance of these devices from public scans suggests operators are prioritizing immediate isolation over other remediation strategies.
Context and Background
Danfoss, a Danish provider of temperature regulation systems, confirmed its equipment was the target of the cyber-attack. The company stated that most affected controllers were either older models that no longer receive security updates, specifically the AK-SM800 and AK-SC355, or newer models running outdated firmware, such as the AK-SM800A. These devices serve as control panels for refrigeration units installed in many French supermarkets.
Danfoss patched three vulnerabilities in its AK-SM 800A controllers in March 2025 (CVE-2025-41450) and August 2025 (CVE-2025-41451 and CVE-2025-41452). Despite these patches, older and unpatched systems remained vulnerable. A researcher at industrial security provider Claroty demonstrated how CVE-2025-41450 and CVE-2025-41451 could be chained to achieve remote code execution, allowing attackers to disable cooling while falsifying temperature readings to conceal cold chain failures.
Who Is Affected
The primary victims were French supermarket operators relying on Danfoss StoreView controllers for their refrigeration infrastructure. Censys, which scans and indexes internet-connected devices globally, noted that the exposed instances typically lacked proper security controls, such as corporate virtual private network connections, to obfuscate their activities. This exposure does not inherently mean the instances carried a vulnerability, but it made them visible and accessible to potential attackers.
While Danfoss has not confirmed the exact initial access vector, the pattern suggests attackers exploited unpatched vulnerabilities in internet-exposed controllers to gain remote access. The scale of the disruption, affecting hundreds of stores, highlights the risks of connecting critical industrial control systems directly to the public internet without adequate segmentation or updated firmware.
What should you do?
Security professionals should monitor for similar rapid de-trending patterns in industrial control system exposures as indicators of active incident response. Organizations using Danfoss or similar refrigeration controllers should verify their firmware versions and patch status immediately. It is critical to ensure that industrial control systems are not directly exposed to the internet and are protected by strict network segmentation and access controls.
What to do and how to stay safe: Danfoss
- Audit all internet-facing industrial control systems to identify any devices running outdated firmware or unsupported software versions.
- Implement strict network segmentation to ensure refrigeration controllers and other critical infrastructure are isolated from the public internet.
- Verify that all known CVEs for your specific hardware models are patched, and disable remote access features that are not essential for operations.
- Monitor network traffic for anomalous connections to control panels, which may indicate unauthorized access or command-and-control activity.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific Danfoss controllers were targeted in the French supermarket attack?
The attack targeted older models AK-SM800 and AK-SC355 that no longer receive updates, as well as the AK-SM800A model running outdated firmware.
How did attackers potentially gain access to these systems?
Attackers likely exploited unpatched vulnerabilities in internet-exposed Danfoss controllers, leveraging known CVEs to achieve remote code execution.
What evidence shows that operators are responding to the attack?
Censys data shows a 71% drop in internet-exposed Danfoss StoreView controllers in France within three days of the October 11 incident.
