IPinfo Scan Data Shows France Hosted 53% of Exposed Danfoss Dashboards Before Attacks

Weekly internet scan data from IPinfo reveals that France hosted the majority of internet-exposed Danfoss refrigeration dashboards five days before the ransomware attacks targeted European supermarkets. The October 6-7 scan identified 2,528 unique IP addresses serving Danfoss StoreView interfaces across 73 countries and territories. France accounted for 1,331 of these addresses, representing 53 percent of the global total. This concentration means France had more exposed units online than all other nations combined during that specific weekly scan window.

The scan results, published on the r/netsec forum by a user identified as /u/seremot, indicate that exposure levels in France were not driven by worse patching practices compared to the rest of the world. Approximately 85 percent of the French addresses ran software with known flaws, including 527 units of end-of-life AK-SM 800 hardware. In contrast, 84 percent of addresses outside France also ran vulnerable software. Only 195 of the French addresses had every known fix applied. That suggests the higher risk profile in France was due to a larger volume of connected devices rather than a lower rate of compliance with security patches.

Disconnection Trends Post-Attack

A follow-up scan conducted on October 14 showed a dramatic reduction in the number of exposed units in France. Only 316 addresses remained online, a decrease of 76 percent. IPinfo notes that a normal weekly loss rate for such services is typically between 3 and 7 percent. The fully patched units also dropped significantly, falling from 195 to just 54. According to the analysis, this sharp decline points to operators disconnecting the systems from the internet rather than applying patches. If patching had been the primary response, the count of fully secured units would likely have increased or remained stable, not plummeted alongside the vulnerable ones.

Methodology and Unknown Entry Points

The scanning methodology involved identifying devices by matching page titles for newer user interfaces and checking web server details plus Flash loader pages for older AK-SM 800 units. Firmware generations were determined by build dates exposed by the dashboards. The counts represent a floor for addresses found on scanned ports, meaning the actual number of exposed devices could be higher. Despite the clear data on exposure, the specific method attackers used to breach these systems remains unknown. Exposure on the public internet is not proof of the entry point used in the attacks, though it highlights a significant attack surface.

What should you do?

Organizations should review their network exposure to identify any internet-facing management interfaces. Administrators should verify whether legacy hardware, such as end-of-life units, is still connected to corporate networks. Security teams should monitor for unusual disconnection patterns or changes in asset visibility that might indicate emergency remediation efforts. Once the vendor provides an update, applying it promptly will be crucial for any remaining connected systems.

What to do and how to stay safe: Danfoss

• Conduct an internal inventory of all Danfoss StoreView and AK-SM 800 units to identify any with direct internet connectivity.
• Verify the firmware versions of all connected refrigeration controllers and compare them against known vulnerability lists.
• Implement network segmentation to isolate critical infrastructure management interfaces from the public internet.
• Monitor network logs for unauthorized access attempts to dashboard ports, even if the systems appear offline.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many exposed Danfoss dashboards were found in France before the attacks?

The October 6-7 scan found 1,331 exposed addresses in France, which was 53 percent of the global total of 2,528.

Did France have a higher rate of unpatched systems than other countries?

No, 85 percent of French units had known flaws, which is comparable to the 84 percent rate observed outside France.

Why did the number of exposed units in France drop so sharply by October 14?

The 76 percent drop, including a decline in fully patched units, suggests operators disconnected systems from the internet rather than patching them.