Censys sees exposed Danfoss StoreView panels in France drop 71% in three days after the supermarket attack
Censys counted 71% fewer internet-exposed Danfoss StoreView panels in France three days after the October 11 attack on hundreds of supermarkets. It found no rise in patched firmware, so the older versions are still running.
The Watch · Security desk
Censys counted 537 internet-exposed StoreView panels in France on October 14, against 1,825 exposed hosts on October 11. Each of three version groups (below 4.2, 4.2.4 and patched) shrank by about 70%.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Exposed StoreView panels in France, October 14 | 537 panels | 3 | |
| France, Oct 11 | 1,825 hosts | 2 | |
| Drop in each of three version groups, about | 70% | below 4.2, 4.2.4 and patched versions | 6 |
What happened
- Danfoss confirmed its equipment was targeted and said most affected controllers were older AK-SM800 and AK-SC355 units without security updates, or AK-SM800A units on outdated firmware.
- A Claroty researcher showed that CVE-2025-41450 and CVE-2025-41451 can be chained for remote code execution, disabling cooling while falsifying temperature readings.
- Danfoss has not confirmed the initial access vector used against the supermarket controllers.
- Censys found 2,991 internet-exposed hosts with a StoreView control panel on October 11, and 1,825 of them, 61%, were in France.
Why it matters
- What doesn't add up contradiction The 71% measures lost reachability. Censys saw no rise in patched versions, so the firmware Claroty chained is still on the controllers that left the scan.
- What it limits constraint Owners of AK-SM800 and AK-SC355 units have no security update to install, so isolating the panel is the control left to them.
- Who's exposed exposure Most exposed StoreView controllers worldwide still run versions older than 4.2, against a current release of 5.3.2.
- Who has to decide decision Owners outside France face the choice French operators made: cut the panel's direct internet connection, or move to 4.3.1 or later, the releases that fix all three CVEs.
Most of the French decline came late. Censys's 71% figure covers the three days after the attack [1]. The count of exposed StoreView hosts in France went from 1,825 on October 11 to 1,781 on October 12 [2][3], a fall of 44 [16]. By October 14 it was 537 [3]. That is 1,244 hosts in two days [17], about 97% of the whole decline [18]. Infosecurity Magazine reads the drop as operators moving quickly to limit their exposure [8].
Censys read the pattern as removal. Its researchers said operators do not appear to be patching their controllers but "simply taking them off the internet" [4]. "Patching would have left a mark in the data: the share on 4.3.1 or later (the releases that fix all three CVEs) would have grown," the researchers said [5]. Instead, instances below version 4.2, instances on 4.2.4 and instances on patched versions each shrank by about 70% [6]. The first group is exposed to all three CVEs and the second to CVE-2025-41451 and CVE-2025-41452 [15]. "Frankly, this is probably the best choice; there is no reason these should be directly connected to the Internet," the researchers said [7].
Danfoss patched CVE-2025-41450 in the AK-SM 800A in March 2025, and the other two flaws, CVE-2025-41451 and CVE-2025-41452, that August [10]. Infosecurity Magazine calls unpatched flaws on exposed controllers a plausible way in [24]. In our view the entry point stays unproven until Danfoss names it. Exposure alone does not make a host vulnerable [23]. The risk sits where exposure meets old firmware, and on October 11 that described 74% of France's exposed StoreView instances, which ran below the patched 4.3.1 [13].
Poland, Romania and Belgium had higher shares below 4.3.1, at 81%, 80% and 76% [13]. The Netherlands still had 62 exposed, unpatched instances on October 11 and the US had 58 [14]. For the rest of the world, Infosecurity reports 966 hosts on October 11, down from 1,166 three days earlier [19]. That date conflicts with the article's own totals: 2,991 hosts minus France's 1,825 leaves 1,166 for October 11 [20]. We read 966 as the October 14 figure, a fall of about 17% [21].
What to watch
- Danfoss naming the initial access vector, which would test the exposed-and-unpatched explanation.
- Censys's next count of the share on 4.3.1 or later, since patching would show up there.
- Whether exposure falls in Poland, Romania and Belgium, where the share below 4.3.1 is higher than in France.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption26
- Hype gap+12
- Incentives
- Not scored
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Censys researchers observed a 71% drop in internet-exposed Danfoss StoreView controllers in France in the three days after the October 11 cyber-attack targeting hundreds of supermarkets.
- [2]
Censys found 2,991 internet-exposed hosts with a Danfoss StoreView control panel on October 11, of which 61% (1,825) were in France.
- [3]
According to the Censys report, the number of StoreView control panels in France fell to 1,781 on October 12 and 537 on October 14.
- [4]
Censys researchers noted that their telemetry showed operators of Danfoss StoreView instances do not appear to be patching their controllers but are "simply taking them off the internet."
- [5]
Censys researchers said: "Patching would have left a mark in the data: the share on 4.3.1 or later (the releases that fix all three CVEs) would have grown,"
- [6]
All three StoreView categories observed (instances below version 4.2, instances on version 4.2.4, and instances on patched versions) shrank by roughly the same amount, about 70%.
- [7]
Censys researchers said: "Frankly, this is probably the best choice; there is no reason these should be directly connected to the Internet,"
- [8]
The 71% drop suggests that operators are moving quickly to limit their systems' online exposure.
- [9]
Danfoss confirmed its equipment was targeted and said most affected controllers were either older models that no longer received security updates (AK-SM800 and AK-SC355) or newer models running outdated firmware (AK-SM800A).
- [10]
Danfoss patched three vulnerabilities in its AK-SM 800A controllers in March 2025 (CVE-2025-41450) and August 2025 (CVE-2025-41451 and CVE-2025-41452).
- [11]
A researcher at Claroty demonstrated how CVE-2025-41450 and CVE-2025-41451 could be chained to achieve remote code execution and disable cooling while falsifying temperature readings.
- [12]
The latest Danfoss StoreView version is 5.3.2, but most Danfoss controllers found with a Censys scan worldwide still run unpatched versions of StoreView (older than 4.2).
- [13]
On October 11, 74% of France's internet-exposed StoreView instances ran below the patched version (4.3.1); Poland, Romania and Belgium had bigger shares, at 81%, 80% and 76% respectively.
- [14]
The Netherlands still had 62 internet-exposed, unpatched StoreView instances on October 11, and the US had 58.
- [15]
StoreView instances below version 4.2 are vulnerable to all three vulnerabilities disclosed by Danfoss in 2025; instances on version 4.2.4 are vulnerable to CVE-2025-41451 and CVE-2025-41452.
- [16]
France's exposed StoreView count fell by 44 hosts between October 11 and October 12.
- [17]
France's exposed StoreView count fell by 1,244 hosts between October 12 and October 14.
- [18]
About 97% of the decline in France's exposed StoreView count from October 11 to October 14 happened between October 12 and October 14.
- [19]
Infosecurity reports that across other countries analyzed there were 966 internet-exposed hosts with a StoreView control panel on October 11, down from 1,166 three days earlier.
- [20]
Exposed StoreView hosts outside France on October 11 number 1,166, matching the earlier figure Infosecurity gives.
- [21]
If 966 is the October 14 count outside France, the decline there is about 17%, against 71% in France.
- [22]
Danfoss has not confirmed the exact initial access vector.
- [23]
Internet exposure does not mean an instance carries a vulnerability, but assets that are both vulnerable and exposed, such as unpatched AK-SM800A instances, significantly increase their risk of compromise.
- [24]
A plausible explanation is that attackers exploited unpatched vulnerabilities in internet-exposed Danfoss controllers to gain remote access to supermarket refrigeration systems.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- infosecurity-magazine.comFrance: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.