In the wake of a significant cyber-attack targeting food supply chains across France, a rapid and unprecedented shift is occurring within the nation’s retail infrastructure. Following the October 11 breach, which compromised the temperature regulation systems of hundreds of supermarkets, operators have initiated a mass withdrawal of internet-exposed refrigeration controllers from the public web. Data provided by the cybersecurity firm Censys reveals that the number of publicly accessible Danfoss StoreView controllers—the interface used to manage commercial refrigeration units—plummeted by 71% in France within a mere 72-hour window.
The incident has brought into sharp focus the precarious nature of Industrial Control Systems (ICS) when they are left exposed on the open internet. The Danfoss StoreView platform, a suite of software used to monitor and manage refrigeration temperatures, was identified as a primary target in the coordinated attack. By gaining unauthorized access to these control panels, attackers could theoretically manipulate the cooling environment of grocery stores, potentially leading to widespread food spoilage or, more insidiously, falsifying temperature readings to conceal system failures from store management.
The Vulnerability Landscape
Danfoss, a prominent Danish manufacturer of temperature regulation technology, confirmed that its equipment was indeed targeted in the breach. According to the manufacturer, the majority of the impacted units were older hardware models—specifically the AK-SM800 and AK-SC355 series—that had reached the end of their lifecycle and were no longer eligible for security updates. Furthermore, some newer units, such as the AK-SM800A, were also found to be compromised, though in these cases, the systems were running on outdated firmware that left them susceptible to exploitation.
The security concerns surrounding these devices are not theoretical. Over the past year, researchers at the industrial security firm Claroty have demonstrated exactly how these systems could be weaponized. Through a sophisticated chain of vulnerabilities—specifically CVE-2025-41450 and CVE-2025-41451—an attacker could achieve remote code execution. This level of access grants the perpetrator the ability to disable cooling cycles entirely while simultaneously feeding the central monitoring system fabricated data, ensuring the "cold chain" appears normal even as products reach dangerous temperatures. While Danfoss has not provided a definitive account of the initial access vector used by the attackers, cybersecurity experts suggest that the most plausible explanation involves the exploitation of these known, yet unpatched, vulnerabilities on controllers that were inadvertently left connected to the public internet.
A Rapid Response: Disconnection Over Patching
The reaction from French supermarket operators has been swift, though perhaps not in the way cybersecurity professionals typically advise. Rather than embarking on a nationwide effort to update the firmware of their thousands of refrigeration controllers, operators appear to have prioritized immediate risk mitigation by simply severing the devices’ connection to the internet.
Censys, which maintains a global search engine designed to scan and index internet-connected hardware, provided the telemetry that highlights this trend. On October 11, the day the attack occurred, the firm identified 2,991 internet-exposed hosts worldwide running the Danfoss StoreView control panel. A staggering 61% of these—1,825 instances—were located within France. By October 12, that number had dropped to 1,781. By October 14, just three days after the incident, the count in France had plummeted to 537. This 71% reduction represents an urgent, reactive posture taken by supermarket chains to insulate their critical infrastructure from further intrusion.
The data suggests a clear pattern: the disappearance of these devices from the public web was not a result of a widespread patching campaign. If administrators had updated their systems, one would expect to see a migration of devices from older, vulnerable versions of the software to the newer, patched iterations—specifically those running version 4.3.1 or later. Instead, Censys observed that the number of instances across all versions—including those vulnerable to all three disclosed CVEs, those vulnerable to the later two, and even those that were already fully patched—shrank by roughly the same 70% margin.
"Patching would have left a mark in the data: the share on 4.3.1 or later would have grown," the researchers noted in their report. Instead, the evidence indicates that the primary strategy has been to simply take the control panels offline, moving them behind firewalls or VPNs where they are no longer discoverable by public scanners.
A Global Problem of Exposed Infrastructure
While the recent incident in France has served as a catalyst for immediate change, the broader issue of internet-exposed Industrial Control Systems remains a global concern. The Censys researchers have emphasized that there is no operational justification for these sensitive refrigeration controllers to be directly accessible via the public internet. By removing them from public view, operators are significantly reducing the "attack surface" available to threat actors.
However, the scale of the remaining problem is significant. Even after the massive disconnection efforts in France, other countries remain exposed. The data shows that in regions such as Poland, Romania, and Belgium, the share of unpatched, internet-exposed StoreView instances is actually higher than it was in France prior to the attack, with some nations showing as much as 81% of their visible devices running outdated, vulnerable software.
Furthermore, the issue is not confined to Europe. On October 11, the Netherlands still maintained 62 exposed, unpatched instances, while the United States accounted for 58. Globally, the vast majority of Danfoss controllers that remain reachable by a Censys scan are running versions of StoreView older than 4.2—versions that lack the critical security patches released by the company in March and August of 2025.
The incident in France serves as a stark warning to the retail and industrial sectors. While the act of taking systems offline is an effective stop-gap measure to prevent unauthorized access, it does not address the fundamental need for robust security maintenance. As modern supermarkets increasingly rely on complex, interconnected systems to manage everything from climate control to inventory, the pressure on facility managers to secure these "Internet of Things" (IoT) devices will only intensify.
For now, the rapid decline in French exposure statistics indicates that operators have recognized the gravity of the threat. By prioritizing the isolation of their refrigeration management systems, they have effectively closed a door that had been left wide open to potential exploitation. Yet, as the global footprint of unpatched and exposed controllers remains substantial, the cybersecurity community continues to stress the necessity of a more sustainable approach: moving beyond simple disconnection and toward a culture of consistent, proactive patch management and secure network architecture. Whether other countries will follow the French example before a similar incident occurs within their borders remains to be seen.
