Muslim
In a startling demonstration of the vulnerabilities inherent in the modern "Internet of Things" (IoT) landscape, hundreds of French supermarkets have been forced into a defensive posture following a sophisticated cyber-attack that targeted their critical cold-chain infrastructure. As investigations into the October 11 incident continue, new data from the cybersecurity firm Censys reveals that thousands of Danfoss StoreView refrigeration controllers have been yanked from public internet visibility in a massive, reactive effort to mitigate further damage.
The incident has highlighted a dangerous reality: the industrial control systems that keep our food fresh are often exposed to the public internet, lacking basic security hygiene, and are frequently running on outdated, vulnerable firmware.
The Chronology of a Digital Freeze
The crisis began in earnest on October 11, when a wave of cyber-attacks hit supermarket chains across France. The attackers specifically targeted Danfoss StoreView units—control panels responsible for managing the temperature of industrial fridges and freezers.
- October 11: Reports emerge of a coordinated cyber incident targeting food supply refrigeration systems in France. Censys records 2,991 internet-exposed Danfoss StoreView hosts globally, with a significant concentration of 1,825 units located within France.
- October 12: Within 24 hours of the initial reports, the number of exposed Danfoss controllers in France drops sharply as IT teams and facilities managers scramble to disconnect these units from the public web.
- October 14: A comprehensive report by Censys confirms a staggering 71% reduction in internet-exposed Danfoss controllers in France. The count plummeted from 1,825 on October 11 to just 537 by the end of the weekend.
The speed of this exodus suggests that the supermarket operators were acting under extreme duress, prioritizing the physical security of their inventory over the convenience of remote, internet-based management.
Understanding the Vulnerability: A Perfect Storm
The hardware at the center of this incident, the Danfoss StoreView system, acts as a command center for temperature regulation. While these devices are essential for maintaining the "cold chain"—the temperature-controlled supply chain that prevents food spoilage—they have become a prime target for threat actors.
Danfoss, a prominent Danish provider of temperature regulation technology, acknowledged that their equipment was indeed compromised. The manufacturer noted that the affected units largely consisted of two categories: older, legacy models that have reached their "end-of-life" and no longer receive security patches (specifically the AK-SM800 and AK-SC355 series), and newer models (the AK-SM800A) running outdated firmware.
The Vulnerability Chain
The danger is not merely theoretical. In 2025, Danfoss released patches for three specific vulnerabilities:
- CVE-2025-41450 (Patched March 2025)
- CVE-2025-41451 (Patched August 2025)
- CVE-2025-41452 (Patched August 2025)
A year after these disclosures, researchers at the industrial cybersecurity firm Claroty demonstrated a "chaining" attack. By exploiting CVE-2025-41450 and CVE-2025-41451 in tandem, an attacker could achieve remote code execution. This level of access allows an intruder to do more than just disable cooling; they can falsify temperature sensor readings, effectively "blinding" the supermarket staff to a system failure while the food inside warms to dangerous levels.
Supporting Data: The Global Exposure Gap
Censys, which maintains a specialized search engine for internet-connected devices, provides the most comprehensive view of the scope of this exposure. Before the attack, the prevalence of internet-facing controllers was high, not just in France, but across Europe and North America.
The "Patching" Paradox
One of the most revealing findings from the Censys analysis is the methodology used by the operators to secure their systems. When a device is found to be vulnerable, the gold standard of cybersecurity is to update the firmware to the latest secure version. However, that is not what happened in France.
According to Censys telemetry, there was no meaningful increase in the number of controllers running patched firmware (version 4.3.1 or later). Instead, every category of device—those fully patched, those partially vulnerable, and those entirely exposed—saw a uniform 70% drop in public visibility. This indicates that operators opted for the "nuclear option": disconnecting the devices from the internet entirely rather than undertaking the complex task of auditing and patching individual controllers.
Global Exposure Statistics
The problem is not confined to France. While France had a 74% share of unpatched, exposed devices on October 11, other nations showed even higher rates of negligence:
- Poland: 81% of exposed units were unpatched.
- Romania: 80% of exposed units were unpatched.
- Belgium: 76% of exposed units were unpatched.
- The Netherlands and the US: Continued to host dozens of unpatched, internet-exposed units even as the French crisis unfolded.
Implications for the Future of Industrial Security
The French supermarket incident serves as a cautionary tale for any industry that relies on Industrial Control Systems (ICS). The push toward "Smart" infrastructure—where every compressor, thermostat, and refrigeration unit is connected to the web for easier maintenance—has created a massive, unmanaged attack surface.
The Danger of "Direct Connectivity"
Censys researchers were blunt in their assessment: "There is no reason these should be directly connected to the internet." Direct exposure of industrial equipment, especially legacy hardware, is a fundamental security failure. In an ideal architecture, these controllers should be tucked behind a Virtual Private Network (VPN) or a dedicated, air-gapped management network, ensuring they are never reachable by an outside entity performing a port scan.
The Cost of Convenience
The incident highlights the trade-off between operational convenience and security. For a supermarket manager, being able to monitor freezer temperatures from a smartphone app is an undeniable benefit. However, when that convenience allows a malicious actor to reach into the heart of a store’s infrastructure from across the globe, the cost becomes unsustainable.
The rapid removal of these devices from the internet suggests that the private sector has finally realized the severity of the threat. However, the fact that they chose to disconnect rather than patch points to a deeper issue: the difficulty of maintaining industrial systems in a 24/7 retail environment. Many of these controllers are "set and forget" assets that, once installed, are rarely touched by IT teams until a disaster occurs.
Conclusion: A Turning Point for Retail Cybersecurity
The fallout from the October 11 attack will likely trigger a ripple effect in regulatory and security standards for the food industry. As the cold chain becomes increasingly digitized, the reliance on outdated, unpatched hardware is no longer just a technical debt—it is a public health risk.
Moving forward, the industry must shift toward a "Security by Design" approach. This includes:
- Strict Network Segmentation: Ensuring that critical industrial controllers are never accessible from the public internet.
- Aggressive Lifecycle Management: Decommissioning legacy hardware that can no longer receive security updates.
- Proactive Vulnerability Management: Moving away from the "if it isn’t broken, don’t fix it" mentality that has left thousands of controllers exposed for years.
The events in France represent a harsh wake-up call. While the immediate threat has been mitigated by taking these systems offline, the underlying vulnerabilities remain. For the retail sector, the challenge will be to rebuild their connectivity in a way that prioritizes security over mere accessibility, ensuring that the next time a cyber threat emerges, the food supply remains cold, secure, and untouchable.
Basiran
Iffa Jayyana
Raul Delapena Setiawan
Reynand Wu
Sagoh
Azzam Bilal Chamdy
Ali Ikhwan