In the wake of a widespread cyber-attack that disrupted supermarket food supplies across France earlier this month, operators of critical refrigeration infrastructure are taking drastic measures to defend their systems. New data from the security research firm Censys reveals that internet-exposed Danfoss StoreView controllers—vital components in managing supermarket cold chain logistics—are being pulled offline at an unprecedented rate, as organizations prioritize immediate isolation over complex software patching.
The incident, which began on October 11, targeted hundreds of supermarkets across the country, prompting an urgent reassessment of how industrial control systems (ICS) are connected to the public internet. Within just 72 hours of the initial breach, researchers observed a staggering 71% reduction in the number of Danfoss StoreView instances accessible via the public web in France. This rapid withdrawal suggests that facility managers and IT departments are opting to sever direct internet connectivity entirely rather than navigating the often-lengthy process of auditing and patching legacy firmware.
Understanding the Vulnerability Landscape
Danfoss, a Danish multinational provider of temperature regulation technology, has acknowledged that its equipment was among the assets targeted in the French cyber-attack. The company’s Danfoss StoreView platform serves as the central nervous system for many industrial-grade refrigeration units, allowing managers to monitor and adjust temperatures within freezers and refrigerators.
However, the equipment involved in the recent compromises largely fell into two categories: older, legacy models that have reached their "end-of-life" and no longer receive security support, such as the AK-SM800 and AK-SC355 series, and newer models running outdated, vulnerable firmware, specifically the AK-SM800A line.
The security risk associated with these devices is significant. Danfoss had previously issued patches for three specific vulnerabilities affecting its AK-SM 800A controllers—one in March 2025 (CVE-2025-41450) and two in August 2025 (CVE-2025-41451 and CVE-2025-41452). A subsequent analysis by researchers at the industrial security firm Claroty demonstrated that these vulnerabilities could be chained together with devastating efficiency. By exploiting these flaws, a remote attacker could gain administrative control over the refrigeration system, enabling them to disable cooling cycles while simultaneously falsifying temperature telemetry. Such a maneuver would allow an adversary to compromise the integrity of the cold chain—potentially causing massive food spoilage—while masking the sabotage from remote monitoring systems.
While Danfoss has not officially confirmed the exact entry point used by the threat actors in the French attack, cybersecurity experts consider the exploitation of these internet-facing vulnerabilities to be the most plausible vector. The presence of these devices on the public internet, combined with the availability of known exploit chains, created a high-risk environment for supermarket operators.
A Mass Migration Offline
The report published by Censys on October 14 highlights the severity of the industry’s reaction. Censys utilizes a specialized search engine to scan and index internet-connected devices, identifying systems that are visible to the public web without the protection of obfuscation layers, such as Virtual Private Networks (VPNs).
On October 11, the day the cyber-attack became public, Censys identified 2,991 internet-exposed hosts worldwide running the Danfoss StoreView interface. Of those, a significant majority—1,825, or 61%—were located in France. By October 12, the number of exposed French controllers had dropped to 1,781. By October 14, that figure had plummeted to just 537, marking a 71% reduction in exposed assets within three days.
This massive contraction of the "attack surface" in France stands in stark contrast to the rest of the world. While other regions also saw a slight decline in exposed instances, the trend was far less pronounced, dropping from 1,166 to 966 over the same period. This discrepancy underscores that the French market, feeling the immediate impact of the supply chain disruption, initiated an emergency containment strategy that other global operators have yet to adopt.
Patching Versus Isolation
A critical finding in the Censys report is that the decline in exposed devices is not the result of a systematic patching campaign. Had operators been applying the necessary security updates to their hardware, the distribution of software versions would have shifted accordingly. Specifically, if the systems were being patched, researchers would have observed a notable increase in the prevalence of version 4.3.1 or later—the releases that address the three vulnerabilities identified in 2025.
Instead, the data shows that the number of instances across all versions—including those that were already fully patched, those partially vulnerable (version 4.2.4), and those fully unpatched (versions below 4.2)—shrank by approximately 70% in equal measure. This confirms that instead of upgrading software, administrators simply took the devices off the internet.
Security analysts at Censys have largely endorsed this approach as a pragmatic, if reactive, response to the threat. "Frankly, this is probably the best choice; there is no reason these should be directly connected to the Internet," the researchers noted. In the context of industrial control systems, "security by obscurity"—or simply removing the device from public reach—is often a more effective immediate defense than relying on patches that may not be compatible with older, mission-critical hardware.
Global Exposure Concerns Persist
Despite the rapid cleanup in France, the global footprint of unpatched and exposed Danfoss equipment remains a significant concern. Although version 5.3.2 is the current standard for StoreView, the vast majority of controllers indexed by Censys globally continue to run versions older than 4.2, which remain vulnerable to the full suite of known exploits.
The risk is not confined to any single country. On October 11, the day the French attack made headlines, other nations showed concerning levels of exposure. Poland, for instance, had 81% of its internet-exposed StoreView instances running versions older than the patched 4.3.1 release. Romania and Belgium followed with 80% and 76% respectively. Even in the Netherlands and the United States, there were dozens of internet-facing, unpatched controllers still active at the time of the scan.
The French incident serves as a stark reminder of the "Internet of Things" (IoT) risks inherent in critical infrastructure. When industrial controllers—designed for the controlled environment of a factory or a supermarket back-office—are connected to the global internet without robust access controls, they become easy targets for remote exploitation. The massive, sudden exodus of these devices from the public web indicates that the industry is finally beginning to recognize the gravity of the threat. However, for many organizations, the shift from "always online" to "securely isolated" is happening only after a high-profile, damaging cyber-event has forced their hand. As the global landscape of connected industrial equipment remains vast, the lessons learned in France may prove to be a critical turning point for how the retail and food supply sectors approach the security of their automated systems.
