Summary
- Cyber-defence.io reports over 800 UK refrigeration and building-management controllers reachable from the internet.
- The researchers distinguish a relatively small UK Danfoss population from broader building automation exposure.
- An accessible management service is an exposure finding, not proof of unauthorised access.
UK security research firm Cyber Defence identified more than 800 refrigeration and building management controllers whose interfaces appeared reachable from the public internet, following the cyberattack that disrupted supermarket refrigeration across France. The finding comes from a 12 October assessment published by Cyber-defence.io, which combined its own scanning observations with publicly available internet measurement data.
The researchers examined systems associated with several equipment families, including Danfoss, Carel, and Copeland, rather than limiting their search to the refrigeration controllers discussed in the French attack. The stated figure represents exposed interfaces in the dataset; it is not a verified number of vulnerable UK stores, compromised systems, or facilities that would suffer comparable consequences if attacked.
Peter Bassill, the firm’s founder and head of threat disruption, described a substantially smaller visible population of Danfoss units in Britain than in France. The public scanner data cited in the report identified 15 UK Danfoss AK-SM or AK-SC hosts, compared with a far greater concentration of that family in France. The report also identified around 73 Copeland or Emerson XWEB hosts and roughly 66 Carel pCOWeb interfaces in UK scans.
Those vendor-specific counts should not simply be added to other categories described in the report. Building automation protocols such as BACnet and Tridium Niagara are discussed as part of a wider control-system exposure picture and may encompass different device types, roles, and overlapping assets. The methodology and coverage of any internet scan affect the meaning of each figure.
Visibility does not establish exploitability
A management interface reachable from the internet creates a potential route for remote administration and warrants attention, but reachability alone does not show that authentication can be bypassed or commands can be changed. Exposure can also be restricted by access controls, network policy, or the deployment architecture even when a service responds to a scan.
Conversely, a smaller count on a public search engine does not demonstrate that a region’s systems are secure. Asset discovery engines index services they can see during a particular measurement period. They may miss equipment using unusual connections or ports, devices behind gateways, or systems accessible through third-party remote support infrastructure.
The French refrigeration incident involved reports that attackers manipulated temperature and defrost controls, with stores losing chilled products. While research previously identified vulnerabilities in certain commercial refrigeration products, Cyber-defence.io’s UK scan cannot establish that any of the devices it observed were reached through the same weakness or that a similar intrusion has taken place in Britain.
Building control systems operate equipment that directly affects the physical environment. Commercial refrigeration preserves food, HVAC keeps premises safe and usable, and industrial controllers may coordinate machinery. Loss of availability or unauthorised changes therefore have consequences different from an ordinary office application outage. Establishing how equipment is managed is part of understanding those risks.
Many installations are maintained by specialist contractors. The retailer or building operator may have purchased the hardware while another business administers remote connections, passwords, and firmware updates. Mapping those dependencies can be difficult when equipment was installed years before cyber asset registers were developed.
The measurements reflect one security company’s internet-facing observations, rather than a complete national inventory. Its findings are useful for directing investigation of publicly reachable services, but cannot establish the prevalence of unpatched software, weak passwords, or successful intrusions without device-level testing and corroboration.
Differences between French and British scan results may reflect the equipment deployed and the way measurement services recognise device interfaces. A country with fewer visible controllers of one manufacturer may use other products or connect equipment through managed gateways. The study’s counts therefore do not amount to a direct national security ranking. They describe what particular scanning methods could see at the time of collection, not every device installed in a country’s commercial buildings.
The UK findings were published hours after the French disruption came to light. No confirmed connection between the observed UK interfaces and an active campaign against British facilities was reported.
