French operators have removed 71% of internet-exposed Danfoss StoreView refrigeration-control panels since attackers remotely switched supermarket refrigerators into defrost mode on Oct. 11, according to measurements from Censys. The overnight incident affected hundreds of supermarkets, spoiled food and, in some cases, contributed to fires, while France’s cyber agency issued an emergency warning about compromised refrigeration systems.
Censys identified 1,825 exposed StoreView hosts in France on Oct. 11. That total fell to 537 by Oct. 14, although the reduction appears to reflect operators taking controllers off the public internet rather than installing updates. Censys said patched and unpatched systems declined at roughly the same rate, and Danfoss has not confirmed the precise initial-access method used in the attacks.
The incident centers on Danfoss AK-SM refrigeration controllers and their StoreView management interfaces. Danfoss says that most affected systems were either older models no longer receiving security updates or newer controllers running outdated firmware. France’s CERT-FR alert reported numerous compromises involving Danfoss AK-SM and AK-SC series controllers; subsequent reporting also identified affected Copeland XWEB and Dixell XWEB systems.
Three Danfoss vulnerabilities are relevant to the exposure. CVE-2025-41450 is an authentication-bypass flaw in AK-SM 8xxA Series software before version 4.2. CVE-2025-41451 is a post-authentication command-injection vulnerability that can enable remote code execution, while CVE-2025-41452 concerns post-authentication Nginx configuration injection. Danfoss lists versions before 4.3.1 as affected by the latter two flaws and recommends installing the latest AK-SM 8xxA software through its security advisories.
The National Vulnerability Database describes the affected versions and vulnerabilities but has not assigned its own CVSS assessment for the records, so a current NVD CVSS score should not be inferred. Claroty’s Team82 researchers later demonstrated that the authentication bypass and command-injection flaws could be chained for remote code execution, but neither Censys nor Danfoss has established that a specific CVE or that chain was used in the French attacks. No named threat actor or confirmed public proof of concept has been tied to the incident.
Defenders should treat internet-exposed refrigeration management interfaces as an urgent operational-technology risk: remove them from direct public access, restrict administration to trusted networks or a secured VPN, segment controllers from business systems, and upgrade to version 4.3.1 or later where the hardware supports it. Operators of end-of-life devices should coordinate with Danfoss or their maintenance provider on replacement or compensating controls, then investigate logs and credentials for unauthorized access before reconnecting any controller.
