Summary
- Censys measured 1,825 internet-visible StoreView hosts in France on 11 October and 537 on 14 October.
- Patched and older firmware groups became less visible at similar rates; Censys suspects reduced public exposure rather than mass patching.
- The measurements cannot identify compromised controllers, confirm individual mitigation steps, or establish that attacks caused the decline.
Internet scanning company Censys recorded a 71% fall in the number of internet-visible Danfoss StoreView refrigeration-controller hosts in France between 11 and 14 October, during the aftermath of attacks on French supermarkets.
Censys counted 1,825 reachable French StoreView hosts on 11 October, 1,781 on 12 October, and 537 on 14 October. Researchers interpret the near-uniform decline across firmware versions as consistent with reduced public connectivity rather than extensive patch installation. Their measurements cannot establish why individual hosts ceased to be visible or whether any had been compromised.
The analysis followed reported interference with supermarket refrigeration, which caused stock losses at French retail sites. The incident establishes a reason for authorities to encourage restrictions on exposed management interfaces, but Censys does not demonstrate that the incident itself caused the change in host counts.
Censys compared firmware versions during the same period. Systems running software older than version 4.2 declined from 1,158 to 341, a 71% fall. Those running version 4.2.4 declined from 191 to 61, while systems on version 4.3.1 or later fell from 475 to 133. That near-parallel reduction across both older and newer software does not resemble a migration in which the share of patched devices rises sharply.
A controller absent from a subsequent internet scan may have been placed behind a firewall or private connection, reassigned an address, switched off temporarily, or become unreachable for another reason. Censys cannot confirm the operator’s action in each case. The drop is unusually large compared with the measured reduction elsewhere, but that comparison does not independently prove remediation or establish the number of attacked devices.
Outside France, the company observed a smaller fall, from 1,166 to 966 StoreView hosts over the same interval. Its report also documents widespread use of older firmware, including releases dating from 2022 and 2023. The current version it identified was 5.3.2, issued in September 2026, although the relevant security fixes and exposure of an installation depend on the software branch and configuration.
Remote refrigeration management enables temperature monitoring, alarms, and operational changes without physical attendance at a store. That functionality can be important to estates spread over many sites, particularly where maintenance is provided by external contractors. Direct accessibility from the public internet, however, gives unauthorised parties an opportunity to reach interfaces that can influence physical processes.
Removing an interface from the internet may reduce immediate exposure without resolving underlying vulnerabilities. Conversely, a controller running patched firmware can still be unnecessarily exposed if its management service remains accessible to anyone on the network. The two controls address different aspects of risk: one restricts who can reach the system, while the other addresses known software weaknesses.
Supermarket groups also have to distinguish connectivity removal from a full recovery. Central maintenance and alarm arrangements may rely on connections that need to be restored through authenticated private access, rather than by re-exposing the same services. Where stock losses have already occurred, temperature records, controller logs, and supplier maintenance records may be relevant to incident reconstruction and subsequent insurance discussions.
The breakdown by firmware version limits what can be inferred from the decline. The largest absolute reduction occurred among systems running releases older than 4.2, but the group running 4.3.1 or later decreased by a similar proportion. The share of patched systems therefore did not rise as would be expected from widespread upgrades. A privately reachable controller would disappear from Censys’ internet-visible population even if neither its installed firmware nor its operating state had changed. The dataset measures external reachability, not patch compliance or recovery.
Between 11 and 14 October, Censys observed 1,288 fewer French hosts visible to its scanning system. No public evidence connects each of those hosts to the supermarket intrusions, and the measurement does not establish whether any particular controller was patched, isolated, taken offline, or previously compromised. Subsequent observations could show whether the reduction in public visibility persists.
