INTERNET-EXPOSED Danfoss StoreView controllers in France have been disappearing from public view at a rapid pace in the wake of a cyber incident affecting hundreds of French supermarkets’ food supplies. Censys researchers reported a 71% drop in internet-facing StoreView instances in France over three days following the October 11 attack, suggesting operators are removing exposure rather than applying patches.
Danfoss confirmed its StoreView equipment was targeted, with affected controllers primarily older models that no longer receive security updates (AK-SM800 and AK-SC355) or newer models running outdated firmware (AK-SM800A). Danfoss had patched three vulnerabilities in the AK-SM 800A line in 2025 (CVE-2025-41450, CVE-2025-41451, CVE-2025-41452). A 2026 demonstration by Claroty linked CVE-2025-41450 and CVE-2025-41451 to remote code execution that could disable cooling and falsify temperature readings.
While the initial access vector hasn’t been officially confirmed, the working hypothesis is exploitation of unpatched, internet-exposed controllers to gain remote access to supermarket refrigeration systems.
Censys data show 2,991 internet-exposed Danfoss StoreView hosts on October 11, with 61% (1,825) in France. By October 14, French exposure fell to 537, with a 71% drop. Across other countries, declines were smaller. Notably, many still run unpatched StoreView versions (below 4.2) or older patched releases, underscoring ongoing risk if devices remain internet-connected. Researchers emphasised that the prudent step is not exposing these controllers to the internet at all.