Close to 5,000 refrigeration controllers from Danfoss have been found exposed on the internet, fueling concerns about how peripheral systems like supermarket cooling infrastructure are increasingly vulnerable following recent attacks. While not all exposed units are confirmed compromised, the risk they represent has professionals sounding alarms.
Scope of Exposure
A recent analysis by International Cyber Digest identified 4,980 hosts publicly displaying Danfoss-related web pages through a Shodan search. France alone accounts for 2,911 of these hosts—nearly 60%—followed by South Africa with 517. Germany, Portugal, the U.S., Poland, Belgium, Sweden, Spain, and the Netherlands were also among the countries with high counts. Around 80% of all exposed hosts are located in Europe. This exposure count does not confirm successful attacks across the board. In a more tightly filtered search, researchers still found 4,551 units matching Danfoss controller fingerprints.
The Incident & Vulnerabilities
The surge in exposed systems comes after attacks on October 11–12 that forced supermarket freezers in France to defrost remotely, damaging perishable inventory. Temperatures reportedly reached as high as 50°C in some stores, although those readings are not confirmed across all affected locations. France’s CERT-FR issued an alert on October 12, affirming that Danfoss AK-SM and AK-SC devices were among those compromised. The agency instructed retailers to sever internet access or isolate exposed units while they assess damage and restore systems.
Investigations peered into firmware weaknesses. One flaw (CVE-2025-41450) in the AK-SM 800A platform allowed an alternate authentication route based solely on the device’s date—effectively permitting administrative access if the date-based algorithm could be recreated. Other issues identified include a command injection flaw in email alert settings and a misconfiguration vulnerability in the web server—tracked under CVE-2025-41451 and CVE-2025-41452, respectively. All affect firmware before versions R4.2 (authentication fix) and R4.3.1 (patches for the other flaws).
Remediation & Best Practices
Operations using Danfoss controllers are being urged to install the latest firmware or replace outdated hardware. CERT-FR’s guidance includes isolating control networks, removing direct internet exposure, resetting to factory defaults, changing all authentication credentials, and segmenting the system away from general business networks. For immediate safety, organizations are also asked to restrict outside access and monitor and audit affected units carefully as they recover.
Not every exposed unit has confirmed signs of attack, and the methods used in recent incidents aren’t yet fully validated. The importance, however, is clear: when refrigeration systems—integral to food safety and retail operations—are linked directly online without sufficient protection, the stakes are high.
This event highlights how industrial control systems remain among the most exposed assets globally. Better firmware patching, strong access controls, and network segmentation are no longer optional—they’re essential. Going forward, how quickly vendors and operators adopt defenses will determine whether these incidents stay rare or become routine.
