Exposed Danfoss StoreView consoles, two weeks on: France down 75%

Overnight into Monday, October 12, attackers took over the refrigeration controllers of hundreds of French supermarkets and set their fridges and freezers to heat up. Intermarché's reached 50C for six hours. Carrefour said 80 of its 6,000 stores were hit and Monoprix 5% of its 400-plus, Intermarché and its Netto brand counted 180, and Coopérative U more than 100 (BBC). The software was Danfoss's, which lets a store run its cold units remotely, and Danfoss said the units hit were older models. CERT-FR's alert, CERTFR-2026-ALE-012, names Danfoss's AK-SM and AK-SC controllers and the XWEB supervisors sold by Dixell and Copeland, and tells operators to take them off the public internet and reach them only through a secure VPN or a protected network. Nobody has published how the attackers got in.

What was online before is already counted. IPinfo found 2,528 Danfoss StoreView dashboards on October 6 and 7, 1,331 of them in France, and 316 of the French ones left on October 14 (IPinfo). Censys counted 2,991 StoreView hosts on October 11 and a 71% drop in France by October 14 (Infosecurity Magazine). Neither count goes past October 14.

Web IP holds every host that answers on port 443 or 80, with its page title. One of its passes ran from October 6 to 11 and finished hours before the attack; the next started on October 20 and finished on October 25. We counted four makers' refrigeration and building controllers by page title in both.

Two weeks on, the French drop held

By the pass from October 20, 75% of the StoreView consoles in France were gone, about the drop IPinfo and Censys saw in the first three days. Outside France 22% went, most of them in Poland (72 to 36) and Portugal (38 to 11), while the US (47 to 50), Denmark (40 to 36) and Romania (28 to 27) barely moved.

XWEB, the other controller CERT-FR names, lost 72% in France, from 60 to 17, and 3 of its 927 everywhere else. Site Supervisor, which CERT-FR's alert doesn't name, didn't move, and all 30 of France's pCOWeb consoles were still at their addresses, with two more beside them.

Business broadband lines change addresses, so a console can leave one and answer from another. Of the 1,049 addresses serving StoreView before the attack, 461 still served it from October 20, 24 answered with another page and 564 gave no answer on either port. 58 consoles answered from addresses that served none before, 13 of them in France.

Every French network, not one

In France, Orange's AS3215 went from 394 StoreView consoles before the attack to 98 from October 20, and the other French networks from 175 to 46. Each lost three in four, so it isn't one ISP's customers unplugging.

A network's row counts its consoles in every country: IP Country places 9 of Orange's 403 outside France.

Half of France's remaining StoreView consoles were on plain HTTP

Port 80 is plain HTTP, so a console answering there serves its login page unencrypted, and anyone on the path can read or change it, password included.

Every console with no TLS on 443 answered on port 80 alone, so that column is the ones with no HTTPS at all.

In France, 77 of the 144 StoreView consoles from October 20 answered on port 80 (53%). Before the attack it was 282 of 569, so the plain HTTP ones went offline at about the same rate as the rest.

Outside every hosting list

Before the attack, 1,019 of the 1,049 StoreView consoles (97%) were on ISP networks and 24 in hosting space. From October 20 it was 487 of 519 (94%), and the other three makers' were 97% to 99% on ISP networks. These are business broadband lines, which a hosting or cloud range list such as Hosting IP doesn't hold and isn't meant to. Finding them takes an inventory of what answers on each address.

Finding them yourself

Web IP's title column holds each host's page title, so a filter on the console titles lists every one, with its port and last_seen. The titles we matched are Danfoss StoreView, Danfoss - StoreView Web, XWEB, XWEB EVO, XWEB PRO, Site Supervisor, Emerson Site Supervisor and Carel pCOWeb Home Page. Joined to IP Country and IP ASN on the address, they count by country and network as above. A host keeps its row for 30 days after it last answered, so last_seen is what tells the ones still online from the ones gone. Web IP's launch post shows what a row holds.

How we counted

A console is an address whose page title on port 443 or 80 is one of the titles above, counted once per address, and once for each maker where an address answers as two (one does). "Oct 6 to 11" is each address's newest response in that pass, and "From Oct 20" its newest since October 20. "With no TLS on 443" means the address completed no TLS handshake on 443. Country is IP Country's and network IP ASN's, typed by ASN, from the same build for both passes. A host is an address, not a store. Web IP covers ports 443 and 80 by address, while IPinfo's scan connects to "the usual ports that websites use" and counts the older Flash dashboard too, which is why its 2,528 is larger than our 1,049; the comparison here is between our two passes.

Getting access

Web IP ships as CSV, rebuilt weekly, and its docs page has the schema. Sign up to evaluate it from its sample. A license is per database and never metered: see licensing, or talk to us about what you need.