In the wake of a sophisticated and disruptive cyber-attack that targeted the food supply infrastructure of hundreds of French supermarkets, a significant shift in digital security posture has emerged. New data from the internet security research firm Censys reveals that internet-exposed refrigeration controllers, specifically Danfoss StoreView units, are being removed from public view at a dramatic pace. This rapid defensive maneuver suggests that operators across the country are prioritizing the immediate disconnection of their critical infrastructure from the public internet to mitigate the risk of further compromise.
The incident, which first drew public attention on October 11, highlighted the precarious nature of Industrial Control Systems (ICS) when they are left exposed to the global web. According to Censys, there was a staggering 71% reduction in internet-exposed Danfoss StoreView controllers in France within just three days of the initial breach. This swift reaction underscores a collective realization among facility managers and security teams that the exposure of these specialized control panels represents a severe, exploitable vulnerability.
Understanding the Vulnerable Infrastructure
Danfoss StoreView platforms serve as the central nervous system for many modern supermarket refrigeration units. These controllers are responsible for managing the temperature regulation of fridges and freezers, ensuring that food products remain at safe, mandated temperatures. Because the cold chain is vital to food safety and regulatory compliance, the compromise of these systems carries significant health and economic implications.
The Danish company Danfoss, a global leader in temperature regulation technology, has acknowledged that its equipment was indeed involved in the recent cyber-attack. In a statement addressing the incident, the company clarified that the most vulnerable controllers were predominantly older models that had reached the end of their lifecycle and no longer received security updates, such as the AK-SM800 and AK-SC355 series. Furthermore, the company noted that some newer models, specifically the AK-SM800A, were also implicated, though these were often running on outdated firmware that left them exposed to known threats.
The underlying security risks associated with these devices are not theoretical. Throughout 2025, Danfoss released patches for three critical vulnerabilities identified in its AK-SM 800A controllers—one in March and two in August. A year later, researchers at the industrial cybersecurity firm Claroty provided a chilling demonstration of how these flaws could be chained together. By combining CVE-2025-41450 and CVE-2025-41451, an attacker could achieve remote code execution on the target controller. Once inside, an adversary could not only disable the cooling systems entirely but also manipulate the data reported to the monitoring system. By falsifying temperature readings, an attacker could hide a catastrophic failure in the cold chain, potentially allowing massive amounts of perishable goods to spoil without the operator ever receiving an alert.
Defensive Tactics: Disconnection Over Remediation
While Danfoss has stopped short of confirming the specific initial access vector used by the attackers in the French supermarket incident, the presence of these vulnerabilities in internet-exposed controllers provides a highly plausible path for intrusion. When devices that are both inherently vulnerable and accessible from the public internet are targeted, the results can be devastating.
Censys, which maintains a specialized search engine that scans and indexes global internet-connected devices, provided a granular look at how these systems are being taken off the map. In their October 14 report, the researchers illustrated that the remediation strategy adopted by French operators has been binary: rather than engaging in the complex process of firmware updates and patching, they are simply severing the connection to the internet.
On October 11, the day the scale of the attack became clear, Censys identified 2,991 internet-exposed hosts worldwide running the Danfoss StoreView control panel. A significant portion of these—1,825, or 61%—were located within France. By October 12, that number had dropped to 1,781. By October 14, just three days after the initial observation, the number of exposed French controllers plummeted to 537. This 71% drop is a remarkable example of rapid incident response in an industrial setting.
The researchers at Censys were able to confirm that this drop was not a result of a widespread patching campaign. By analyzing the version numbers of the remaining exposed systems, they noted that the distribution of firmware versions remained relatively static. "Patching would have left a mark in the data: the share on 4.3.1 or later (the releases that fix all three CVEs) would have grown," the researchers explained. Instead, the number of controllers across all firmware categories—ranging from outdated versions vulnerable to all three 2025 CVEs to those on the 4.2.4 version—shrank by roughly the same 70% proportion. This confirms that the systems were being pulled offline entirely rather than being updated to secure versions.
Global Exposure and the Need for Better Security Practices
From a security standpoint, the decision to take these systems offline is being widely praised by industry experts. "Frankly, this is probably the best choice; there is no reason these should be directly connected to the internet," the Censys report noted. In an era where Industrial Control Systems are increasingly being integrated into networked environments for remote management, the failure to implement robust security perimeters—such as Virtual Private Networks (VPNs) or air-gapped configurations—leaves critical infrastructure dangerously exposed.
The problem, however, is not confined to France. The Censys data shows that while the reaction in France has been swift, many other regions remain highly exposed. As of October 11, researchers found 966 internet-exposed Danfoss StoreView hosts outside of France. Unlike the French figures, this number had only seen a modest decrease from the 1,166 instances recorded three days prior.
The data further highlights a concerning lack of maintenance across the board. While the latest version of the Danfoss StoreView software is 5.3.2, the vast majority of controllers visible to the internet are running versions older than 4.2, meaning they are inherently susceptible to the vulnerabilities discovered in 2025. The geographic spread of this exposure is significant. For instance, while 74% of French controllers were unpatched prior to the mass disconnection, the figures were even higher in other countries. In Poland, 81% of internet-exposed StoreView instances were running unpatched versions; in Romania, the figure was 80%; and in Belgium, it stood at 76%. Even in nations with highly developed digital infrastructure, the problem persists, with 62 exposed, unpatched instances identified in the Netherlands and 58 in the United States on the same day.
The events in France serve as a stark reminder of the security debt that many organizations carry. Relying on "security by obscurity"—the hope that an internet-connected device will remain unnoticed by malicious actors—is a strategy that has proven increasingly ineffective as automated scanning tools become more sophisticated. The sudden, mass removal of these controllers from the public internet suggests that while many organizations are currently choosing the path of immediate isolation, the long-term challenge of securing the cold chain remains. As the industry moves forward, the focus will likely shift from simple disconnection to the implementation of secure, encrypted, and monitored architectures that allow for the benefits of remote management without the inherent risks of direct internet exposure. For now, however, the French retail sector remains in a defensive crouch, prioritizing the integrity of their food supply over the convenience of remote, unshielded connectivity.
