French Supermarket Fridge Attack Linked to Exposed Danfoss Dashboards
Analysis reveals France hosted over half of the world's vulnerable refrigeration controllers before the incident.
1Massive Exposure in France
IPinfo scans conducted between October 6 and 7 identified 2,528 Danfoss StoreView dashboards globally. France accounted for 1,331 of these, representing 53% of the total worldwide exposure. This concentration significantly exceeded the combined total of all other 72 countries, including Poland, the United States, Portugal, and Belgium, highlighting a localized infrastructure risk.
2Critical Patching Deficits
Approximately 85% of the French units operated with known software vulnerabilities. Specifically, 527 units were end-of-life AK-SM 800 models, while 609 others lacked essential 2023 or 2025 security updates. Only 195 units were fully patched. The global patching rate remained similarly low, suggesting the primary issue was the high volume of exposed devices.
3Network Architecture Patterns
Analysis shows 98% of these controllers resided on local telecom networks rather than secure data centers. This configuration typically allows remote access for technicians or head office monitoring. Many of these devices were long-term exposures, with 1,019 of the French addresses already accessible online as early as March 30, 2024.
4Post-Attack Infrastructure Shift
Following the October 11–12 attack, a scan on October 14 revealed a 76% reduction in exposed French dashboards. This drop significantly exceeded the typical weekly fluctuation of 3% to 7%. Data from Censys corroborated this trend, showing a 71% decline, indicating that many stores chose to disconnect devices rather than apply security patches.
5Technical Identification Methodology
Researchers identified newer interfaces via page titles and older AK-SM 800 units through their web server and Flash loader pages. Firmware generations were determined by dashboard build dates. The study excluded 16 non-Danfoss devices sharing similar web servers and two potential honeypots to ensure the accuracy of the final count of exposed units.
6Scope and Limitations
The reported figures represent a floor for the total number of exposed devices, as the scan targeted specific ports and may have missed AK-SC 355 units. While the exposure was widespread, researchers emphasize that this data does not confirm the specific entry point used by attackers to trigger the defrost cycle in supermarkets.
7Operational Impact of Disconnection
The rapid decline in online dashboards suggests a reactive security posture among facility managers. Because the number of fully patched units also dropped from 195 to 54, it is clear that organizations prioritized immediate isolation over remediation. This shift effectively removed the attack surface but likely disrupted remote management capabilities for these stores.
8Industrial Security Implications
This incident underscores the inherent risks of exposing industrial control systems directly to the public internet. The high density of legacy, unpatched hardware in a single geographic region created a concentrated target. Moving forward, securing these controllers requires both rigorous patch management and the implementation of network-level access controls to prevent unauthorized exploitation.