France Hosted Over 1,300 Danfoss Refrigeration Dashboards Pre‑Attack, Scan Shows
A weekly IPv4 scan by IPinfo found that, five days before the European supermarket ransomware attacks, France hosted 1,331 publicly reachable Danfoss StoreView refrigeration dashboards—more than the rest of the world combined—and many of them were running outdated firmware.
Why were so many Danfoss dashboards exposed in France?
France’s concentration of Danfoss refrigeration equipment stems from the country’s dense network of supermarkets, convenience stores, and cold‑chain logistics that rely on Danfoss’s StoreView platform for temperature monitoring and remote diagnostics. The platform is often deployed on commodity hardware with default web interfaces exposed to simplify remote access for service technicians.
According to the October 6‑7 scan, 2,528 unique IP addresses worldwide served a Danfoss dashboard, and 1,331 (53 %) of those were located in France. This geographic skew does not imply poorer patching practices; the same study showed that 85 % of French units ran software with known flaws, a figure comparable to the 84 % global rate.
How did the scan differentiate between modern and legacy dashboards?
The researchers used two fingerprinting techniques. The newer StoreView UI was identified by its page title, while the legacy AK‑SM 800 units were detected by a characteristic web‑server banner and the presence of a Flash loader page. Both methods also extracted the firmware generation date that the dashboard itself exposes, allowing the team to tag end‑of‑life devices.
Out of the French exposures, 527 were identified as AK‑SM 800 units that had reached end‑of‑life, meaning they no longer received security updates from Danfoss. Only 195 French dashboards were fully patched at the time of the scan, highlighting a sizable attack surface that existed despite the presence of newer, more secure versions.
What does the rapid drop in exposed units after the attack indicate?
By October 14—one week after the ransomware campaign began—the number of French dashboards visible on the public Internet fell to 316, a 76 % reduction far exceeding the typical 3‑7 % weekly churn observed in similar scans. The steep decline suggests that many organizations chose to disconnect or firewall the devices rather than apply patches, as the count of fully patched units also fell from 195 to just 54.
This behavior mirrors a common incident‑response pattern: when a high‑profile exploit is announced, operators often resort to network isolation as the quickest mitigation, even if it means losing remote monitoring capabilities. The data therefore underscores the importance of having a layered response plan that includes both patch management and network‑segmentation controls.
What steps can operators take to reduce exposure today?
1. Perform regular external scans. Use tools like GetKhojo’s IPv4 surface‑monitoring service to discover any publicly reachable industrial endpoints before attackers do.
2. Harden remote access. Replace default credentials, enforce multi‑factor authentication, and move web interfaces behind VPNs or zero‑trust gateways.
3. Patch or retire legacy firmware. Devices identified as end‑of‑life, such as the AK‑SM 800, should be upgraded to supported hardware or isolated from the internet entirely.
4. Implement network segmentation. Separate IoT control networks from corporate and internet‑facing zones, and restrict inbound traffic to only the ports and protocols required for legitimate operations.
5. Monitor for anomalous activity. Deploy intrusion‑detection signatures that flag unexpected HTTP requests to known dashboard URLs, and correlate with threat‑intel feeds that mention Danfoss or similar platforms.
What does this mean for broader IoT security?
The Danfoss case illustrates how a single vendor’s web‑based interface can become a nation‑scale exposure when default configurations are left unchanged. It also shows that public‑facing dashboards are attractive initial footholds for ransomware groups targeting supply‑chain assets.
For the wider IoT ecosystem, the lesson is clear: visibility is the first line of defense. Continuous, automated scanning—combined with rigorous patch‑management and zero‑trust networking—reduces the attack surface that threat actors can exploit.
What this means for you
If you manage refrigeration, HVAC, or any other industrial control system, treat every web‑accessible dashboard as a potential entry point. Run an external scan today, close unnecessary ports, and prioritize updating or isolating devices that still run legacy firmware. The cost of a brief exposure can quickly outweigh the inconvenience of a short‑term network restriction.
Frequently asked questions
How can I find out if my industrial devices are exposed on the internet?
Run an external IPv4 scan against the public IP ranges used by your organization, or use a service like GetKhojo that continuously monitors for open ports and known device fingerprints.
What is the difference between the AK‑SM 800 and newer Danfoss dashboards?
The AK‑SM 800 is an older refrigeration controller that relies on a Flash‑based web loader and no longer receives security updates, whereas newer StoreView dashboards use a modern HTML UI and are still supported with patches.
Why did the number of exposed dashboards drop so sharply after the attacks?
Most operators chose to disconnect the devices or block their ports as an immediate mitigation, which reduced the visible count faster than normal weekly churn.
What immediate actions should a facility manager take if they discover an exposed dashboard?
First, restrict internet access to the device using firewall rules or a VPN. Then verify the firmware version, apply any available patches, and plan to replace end‑of‑life hardware.
Are there any legal obligations for manufacturers to secure IoT dashboards?
Many jurisdictions now require reasonable security measures for connected devices, and regulators are increasingly focusing on supply‑chain risk, so manufacturers are expected to provide timely updates and secure default configurations.
