Three weeks ago, after attackers turned hundreds of French supermarket freezers into basically ovens, we at Bitsight TRACE went out to determine how many of the refrigeration controllers manufactured by Danfoss that were involved were sitting on the open internet. The search returned about 2,000 results, which we estimated at roughly 1,100 real controllers. On Monday, 2 November, someone made it again, in eight countries this time, and one of them was mine.
So I went back to the data to see what had changed. Some things had improved. One thing had become badly wrong: the number itself. If you search our internet-scanning data for these controllers today, you get about 4,000 results, nearly twice what we saw in October. That figure is mostly fake, and working out why turned into the most interesting part of this research.
Key takeaways
- Honeypots inflated the raw exposure count, but exposure is falling.
- A search on 3 November returned about 4,004 results, nearly double October’s 2,166. But credible observations fell 32%.
- ISPs and maintainers can help reach affected owners, since most exposed addresses sit on telecom business lines rather than retailer networks.
- Cyberattacks have now also hit blood bank refrigeration.
What happened, twice
In the night of 11 to 12 October, refrigeration in hundreds of French supermarkets was switched into defrost, with setpoints pushed to about 50 °C / 122 °F (Techniques de l'Ingénieur). Food was destroyed, and the Paris prosecutor opened an investigation. This was a coordinated attack, focused on the French cyber space.
Overnight into 2 November, it happened again across the north of Europe. Stores in Sweden, the Netherlands, Belgium, Ireland, Luxembourg, and Estonia reported temperature spikes and spoiled food (NBC News), and later tallies added Finland (Tech Insider). Delhaize, Colruyt, ICA, and Coop were among those hit (CNBC). The refrigeration contractor for Delhaize said the evaporators had been switched to defrost mode, the same trick as in France (NBC News), and Reuters reported that some of the affected units ran the same Danfoss software (Forbes).
In Portugal, seven Intermarché stores were affected, with product losses in three (ECO). The group said the attack appears to have targeted an external company that manages its refrigeration systems (Observador). Keep that detail in mind, because it comes back at the end.
No one has claimed either wave, and how the attackers got in has not been confirmed publicly. What we can measure from the outside is narrower but still useful: how many of these controllers anyone on the internet could reach, and whether that changed between the two attacks.
Dark web chatter
We also looked beyond the exposed devices. Searches in Bitsight Cyber Threat Intelligence (CTI), covering August through 3 November, found discussion of both waves, but no claim of responsibility or listings explicitly offering access to the affected refrigeration controllers in the sources we reviewed. Most forum activity repeated public reporting and security research. Some pro-Russian channels tried to associate the incidents with hacktivist activity, but the material we reviewed did not establish involvement. Public exploit material was also circulating, potentially lowering the barrier for copycats without telling us how either wave actually happened.
The more actionable finding was in infostealer log markets. Listings advertised stolen login data associated with Danfoss services, mostly its customer and partner sign-in portal. A few also included refrigeration, building-automation, and remote-access services, suggesting that some infected machines may have belonged to technicians or installers.
None of the reviewed listings directly identified StoreView or AK-SM controller credentials, and we found no evidence connecting them to these attacks. They do, however, highlight another exposure worth investigating: the computers and accounts used to maintain refrigeration systems. Access to those systems could give attackers valuable information to where all of the freezers actually are and any credentials needed to conduct a more successful attack.
The number that doubled overnight
For this analysis, we focused on Danfoss refrigeration system managers: the controllers that supervise equipment such as cold rooms, display cabinets, and freezers. Their StoreView management interfaces have recognizable webpage titles, which we searched for in our own internet-scanning data. I’m sure some of you have tried similar searches using public engines. In October, our search returned 2,166 results. On 3 November it returned 4,004.
Did exposure double right after an attack that made headlines across Europe? Did folks run to buy vulnerable fridges? It didn't and they haven’t.
Seventy-one percent of today's results (2,844 of them) answer on ports no refrigeration controller has any business using: Minecraft (25565), LDAP (Lightweight Directory Access Protocol, 636 and 389), Oracle databases (1521), VNC remote desktop (5901), and dozens more. A supermarket freezer that also runs a Minecraft server would be a story of its own (and possibly a very cool one, pun intended). A simple honeypot does exactly that by design.
After the French attack, a lot of people set up honeypots that imitate this login page to watch who comes looking. That is good research practice, and some of those honeypots are probably watching us back. But it means that anyone who runs this search today and reports the total will report about 4,000 exposed supermarket fridges, at least. Some engines report over 6,000. Go ahead, go check your favourite scan engine. After filtering, 975 credible observations remain, about a quarter of the raw total, and the number of devices behind them is lower still.
How we counted
Before any conclusions, here are the caveats, because this dataset has more traps than usual.
- Ports: We kept only observations on ports genuine controllers use (80, 443, 8080, and a short list of common alternatives). That removes nearly all honeypots, but admittedly a handful of real units on unusual ports.
- Residual honeypots: Even on those ports, 185 of 1,160 rows (16%) were cloud-hosted honeypots. We checked every row and removed them one by one.
- Observations are not devices: Scanning data records one entry per address and port. One controller can answer on two ports, and a controller on a mobile connection changes address between scans (more on that in Portugal, which makes a very interesting case).
We did not log in to, test, or change any device. We recorded only the publicly served login page and, in Portugal, the publicly readable firmware version.
So how many are real?
After removing honeypots, 975 genuine observations remain today, against 1,427 in mid-October. France still holds the largest population, though it shrank by nearly 40%. Portugal had the largest percentage decline in our scanning data, more than half. Our direct checks show a smaller but still large fall: 30 live controllers in mid-October, 16 on 3 November. Poland and Romania barely moved. The United States seemed to go up, until we removed the honeypots sitting on American cloud ranges. Almost everywhere, the controllers sit on ordinary business or home internet lines in individual stores, not on a retailer's own network. There is no single corporate firewall to fix which is part of the problem. There are hundreds of little ones. If you work in ICS/OT, this isn’t really news for you.
Who was still online that night?
Because moving addresses distort every count, the cleanest question I could ask was simpler: of the controllers that had kept the same address since at least mid-September, how many were still reachable in the last 15 days?
Belgium is the only country where more than half went quiet. Twelve Belgian controllers that had answered from the same address since May or June were last seen between 7 and 11 October and have not answered since. That fits a reaction to the French attack, but it does not prove one. In Sweden and the Netherlands most stayed put, and several of them answered on 1 or 2 November, the night of the second wave. Being reachable on the night does not make a store a victim. But six in ten is a lot of open doors three weeks after the first break-in.
How attackers get in
So far we talked about all those exposures but not how attackers are actually abusing the freezers. Although the entry vector has not been confirmed, suspicions are on an authentication bypass that allows an attacker to avoid password verification. After that, an attacker just controls the device at will. As far as we could tell, Florent Sicchio of Synacktiv is the earliest documented researcher to mention this, a report made public back in May of 2023 (over 3 years ago).
Here’s how it works: to authenticate on the vulnerable freezers, apart from the username/password combination, a per-day code can also be used. The problem is that this daily code relies only on the actual daily date. It is not the date directly, some math tricks are used first, and this is widely documented in both research and public exploits.
Once attackers figure this process out, they can log in to any vulnerable device. And this was known to anyone that: a) reverse engineered the firmware or b) had an internet connection for the past 3 years.
Why do we keep seeing this type of thing?
This unfortunate practice, as in many ICS/OT devices, was likely intended for vendor support or maintenance. The causes are mostly economic and organisational rather than technical ignorance. These devices sit in thousands of remote sites, are installed and serviced by third-party integrators rather than the owner, and operators regularly lock themselves out or lose credentials when contractors change.
A universal recovery code lets a support line resolve that over the phone without a truck roll, which is cheap and convenient. The mechanism is usually added early in a product’s life when the device was assumed to sit on an isolated network, and then survives for 15 to 20 years of field deployment while the threat model changes around it. It is also invisible to the customer, so there is no market pressure to remove it.
However, this is not a good practice. It is not recommended. At all. The references against this are extensive, from US CISA to EU CRA: CISA/FBI Product Security Bad Practices, CWE-798 Use of Hard-coded Credentials, CWE-912 Hidden Functionality, CWE-1392 Use of Default Credentials, CWE-305 Authentication Bypass by Primary Weakness, ISA/IEC 62443-4-1 and 62443-4-2, NIST SP 800-53 control IA-5(7), NIST SP 800-82 Rev. 3, NISTIR 8259A, MITRE ATT&CK for ICS T0891 Hardcoded Credentials, ETSI EN 303 645 provision 5.1-1, the UK Product Security and Telecommunications Infrastructure Act 2022, the EU Cyber Resilience Act Annex I, and even the OWASP IoT Top 10.
Portugal: Counting things that move fast
This part is somewhat personal since, well, I’m from Portugal. Portugal is where I spent the most time trying to make sense of our numbers: it was showing as the 2nd or 3rd country with the most exposures. But no, Portugal does not have 140 refrigerators exposed to the internet, as some reports suggest.
The four answers disagree with each other, and the reasons why are the best explanation I have of what internet-scan numbers can and cannot tell you.
119 and 30 cannot both describe the same refrigerators. 119 observations do not imply 119 distinct controllers. So which one is right?
In the list we pulled on 15 October, 88% of Portuguese observations sat in address ranges that belong to mobile operators. In plain terms: the controller sits behind a small 4G or LTE router in the store, and that router gets a new public address every time its data session resets. So over a month period, the same refrigerator can show up under three or four different addresses, and each one looks like a separate device.
Double counting. Triple counting. Same fridge.
When we checked directly in mid-October, only one of those listed mobile addresses still had a controller on it. Most of the ten live pool controllers had turned up at addresses we had never seen before, in the same ranges. On fixed lines the picture was different: many of the listed addresses still had a controller on them. At any single moment, only 30 controllers were reachable in Portugal. That is closer to the real number of devices.
Ownership is just as slippery. The mobile ranges and the same operator's fixed broadband share one network identifier (ASN, autonomous system number), so a network lookup cannot tell a mobile router from a fixed line. None of the Portuguese hosts returned a hostname. Only the operator can say which SIM held which address at which minute, and in a pool that rotates within days, a list of addresses sent a week late points at the wrong customer. If you are a CERT (computer emergency response team) or an operator receiving these lists, the timestamp matters as much as the address.
The direct checks gave us a clearer picture of Portugal: we found 16 reachable controllers on 3 November, compared with 30 in mid-October. Seven were on mobile connections, down from 10, and nine were on other lines, down from 20. But a lower count does not tell us what happened to the missing controllers. The mobile connections show why. Sightings in those ranges had almost disappeared from our routine scanning data. Yet the direct check still found seven live controllers, all at addresses absent from the earlier check. With addresses changing this quickly, a controller can disappear from our records without its internet access having been removed.
Outside the mobile ranges, the evidence was mixed. Some previously reachable addresses were on dynamic DSL connections, so an address change could explain their disappearance too. Two controllers stood out: both had consistently answered at addresses marked as static, and neither answered our latest checks. One was still responding on 1 November, shortly before the second wave. Those two cases provide stronger evidence of a change in reachability, but not its cause. The interfaces may have been blocked, the equipment may have gone offline, or something else may have happened, but we cannot distinguish what from the outside.
We found fewer reachable controllers. We could not establish how much of that decline reflected deliberate remediation. And yet seven Intermarché stores were hit on 2 November here in Portugal, through what the retailer describes as an external company managing its refrigeration. Make no mistake, it doesn’t matter if there are 1,000 or just 1 exposure. If it is vulnerable and exposed, attackers will find it and exploit it.
Why ISPs hold the keys
Back in June, in our 2026 Global State of ICS/OT Exposure report, I wrote that ISPs (internet service providers) have quietly become enablers of ICS/OT (industrial control systems and operational technology) exposure, and that they are in a unique position to reduce it.
In almost every case, the internet address where the fridge is exposed belongs to a telecom operator's business-broadband service, not to the retailer. In plain terms: these controllers are sitting in individual stores, plugged into an ordinary business internet line, with the controller's management port forwarded straight to the internet. Only a handful of addresses could be tied directly to a retail group. That distribution is the structural weakness: there is no single network perimeter to fix, and the only parties who can reach the owners at scale are the ISPs and the maintainers (sometimes the manufacturer, too).
Take Portugal, for example, where a list of addresses goes stale within days because the SIM cards behind them keep getting new ones. Researchers like us can see the open door but not whose house it belongs to. The ISP is the only party that knows who held an address at a given minute and the only one that can reach thousands of small customers at once. The infrastructure is there, which they take full advantage of when it comes to renegotiating the contract as it comes close to the end, for example.
The 2026 report noted that the initial access in most ICS/OT incidents was a device exposed on the public internet, often behind a cellular modem that bypasses traditional monitoring, just like these supermarket fridges.
So what could ISPs actually do?
- Act as a remediation partner: Be more than a transit provider.
- Monitor: Watch for protocol abuse and unsafe deployments.
- Accept reports: Develop processes to receive reports and help identify device owners.
- Notify customers: Tell business customers when their line exposes a known OT interface, and work with national CERTs (computer emergency response teams) and researchers so that reports reach the right place.
None of this moves responsibility away from owners, integrators, and vendors. But as cyberattacks increasingly put critical infrastructure at risk, ISPs can have a clear role in an orchestrated response. For equipment connected through a carrier’s SIM card, they may offer the most practical way to identify and reach exposed customers at scale.
Understanding that life can depend on properly working fridges that are part of our critical infrastructure is important, as other recent attacks on the French Blood Establishment show.
What you should do
- If you own or install these controllers: Make sure the login page is not reachable from the internet, on a fixed line or a 4G router. Remove port forwards, use the vendor's secured remote access or a VPN (virtual private network), change default passwords, and apply vendor updates.
- If you maintain refrigeration for others: Review who can reach your customers' controllers, from where, and with which credentials. If your device is directly reachable from the internet, you need to review that.
- If you run a mobile or fixed network: You are the only party who can map an exposed address to a customer. Consider starting a notification program, it really adds value to your organization.
The cold truth
The good news is real: there are fewer of these controllers on the internet than three weeks ago, and in some countries far fewer. The bad news is that six in ten long-lived controllers in the attacked countries were still reachable on the night of the second wave. More bad news is that freezers control much more than your ice cream temperature and attackers know this. Counting exposure is necessary, but it is not sufficient. This was widely announced, it was all over the international news, and remediation still lagged. We need to act faster, there is still a lot to fix.
