French exposure of Danfoss StoreView panels fell 71% in three days after supermarket cooling attack

A rapid retreat after an attack

On 11 October 2026 a cyber-attack struck cooling systems at hundreds of French supermarkets, as reported by Infosecurity Magazine. That same day, according to Censys, 2,991 Danfoss StoreView control panels were reachable from the public internet, and 1,825 of them — 61% — sat in France. By 14 October the French count had fallen to 537, a 71% drop in three days. Panels outside France slipped from 1,166 to 966 over the same window, a 17% decline that Censys did not attribute to any specific cause.

Two engines, two very different numbers

An independent measurement taken on 22 October, eleven days after the attack, tells a much smaller story. A ZoomEye query matching the HTTP header string "Danfoss" returned 260 assets worldwide: 54 in the Netherlands, 28 in the United States, 25 in Germany and just one in France.

Analyses published on dev.to argue that neither figure is wrong; the engines measure different things. Censys fingerprints the StoreView interface itself, while the ZoomEye search only catches devices that emit the vendor name in a response header — a panel that does not send that string is invisible to it. ZoomEye's own product fingerprints for StoreView returned zero, so the header signal was the only one available there. Timing matters too: French operators were removing panels throughout the period, so a count from 22 October cannot be compared with one from 11 October regardless of engine. And after an incident, some assets get firewalled, powered down or re-addressed, so a later scan only sees the survivors.

The single French header match is not evidence that France escaped the problem. It suggests the header string is simply more common on assets outside France, while the French devices Censys counted exposed a different signature. Broad title searches on ZoomEye underline the point: "Danfoss" matched 27,287 pages and "StoreView" 17,384 on the same day, and neither is a device count.

Disconnection beat patching

Censys found that all three StoreView version categories it tracks shrank by roughly 70% — including panels already running patched releases. Patching would have shifted devices between categories; only removal explains the shape of the curve. The conclusion that operators pulled panels off the internet rather than updated them is a strong inference from one vendor's telemetry, and it has not been independently verified site by site.

The logic behind that choice is straightforward. Firmware work on a live cold-chain controller demands a maintenance window, on-site staff and the risk of a refrigeration loop failing mid-update. Removing a panel's public reachability takes a firewall rule or routing change, applied remotely, without touching the compressor.

What a fast drop leaves unpaid

Version 4.3.1, which covers CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, has been available since August 2025, and the current release is 5.3.2. Disconnecting the panels does not pay down that patching debt; it postpones it until someone re-enables remote access. A panel that is no longer publicly reachable also disappears from external scanners, so independent visibility is lost at the same moment the fix is still pending. Nothing in the exposure data shows whether the removals were permanent.

Why it matters

When two recognised scanning services differ by a factor of eleven on a population of a few thousand devices, any count carried to three significant figures is misleading. Teams measuring exposed operational technology should log the engine, the fingerprint used, the exact query string and the timestamp next to every figure, and treat disagreement between engines as information about coverage rather than an error to average away. The honest summary is narrow: a large number of refrigeration controllers were publicly reachable before the attack, French exposure collapsed within days, and each engine observes a different slice of the fleet. The real test of the response is not the 71% drop but how many of the 1,288 removed French panels come back running version 4.3.1 or later — a question no public source currently answers.