Supermarket Fridge Controllers in France Vanish From the Internet After Cyber-Attack

Internet-exposed refrigeration controllers in France are disappearing from public view after a cyber-attack on supermarket food supplies. Censys researchers recorded a 71% drop in exposed Danfoss StoreView controllers in just three days following the October 11 incident, which targeted hundreds of supermarkets. This suggests operators are moving quickly to limit how visible their systems are online.

Danfoss, a Danish temperature regulation provider, has confirmed its equipment was targeted. It said most affected controllers were older models that no longer receive security updates (AK-SM800 and AK-SC355), or newer models running outdated firmware (AK-SM800A). Danfoss patched three vulnerabilities in the AK-SM 800A in 2025 (CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452). A Claroty researcher later showed that two of them could be chained to take remote control, disable cooling and falsify temperature readings, potentially hiding cold chain failures. Danfoss has not confirmed how the attackers got in, but exploiting unpatched, internet-exposed controllers is a plausible explanation.

BeING visible to the internet does not mean a device is vulnerable. However, systems that are both unpatched and exposed face a much higher risk of compromise. The lesson reaches beyond supermarkets: any business running connected equipment, from refrigeration to building controls, should know what is reachable from the internet.