Danfoss Refrigeration Hack Update – 4,980 Hosts Found Exposed to Internet

France accounts for more than half of the internet-facing hosts found in a Shodan search for Danfoss web pages, following a cyberattack that disrupted supermarket refrigeration systems.

An update from International Cyber Digest on October 13 reports a total of 4,980 hosts identified, with 2,911 located in France and 517 in South Africa. These findings raise new concerns about exposed cooling controls; however, they do not confirm that every listed host has been hacked.

According to Shodan, Germany ranks third with 171 results, followed by Portugal with 158 and the United States with 141. Poland, Belgium, Sweden, Spain, and the Netherlands also appear among the leading countries.

France represents roughly 58% of the reported total. International Cyber Digest estimates that around eight in ten matching hosts are in Europe.

Danfoss Refrigeration Hack Update

The search looks for Danfoss references in web content, not proof that every result is a vulnerable refrigeration controller. A separate screenshot shows 4,551 results from a more filtered search. Neither image provides firmware versions, confirms successful attacks against individual hosts, or establishes how many supermarkets each controller serves.

The exposure update follows attacks overnight between October 11 and October 12. Reports describe attackers remotely triggering defrost functions at French supermarkets, leaving chilled and frozen goods spoiled.

Cybersecurity News previously covered the supermarket fridge attacks, including reports of temperatures reaching 50°C. Those temperature reports should not be treated as measurements from every affected store.

France’s CERT-FR confirmed numerous compromises involving Danfoss AK-SM and AK-SC devices in an October 12 alert. The agency instructed operators to disconnect the systems or filter access.

Danfoss told news outlets that affected refrigeration management systems were running outdated firmware and repeated its advice to update supported equipment and replace legacy systems.

International Cyber Digest also shared a claim that affected systems used the username admin and a password that changed daily to the current date. Published technical research supports a narrower explanation.

Claroty’s Team82 found a hidden, date-based authentication path in the AK-SM 800A platform that could bypass the configured administrator password.

According to Team82, the controller generates a daily authentication code using its current date. Someone who reproduces the algorithm could generate an accepted code and obtain an administrative session.

This is not the same as proving that the ordinary administrator password simply becomes the date. Investigators have not publicly established that this specific flaw enabled the supermarket attacks.

The issue is tracked as CVE-2025-41450. CISA identifies affected AK-SM 8xxA versions as those earlier than R4.2, which addressed the authentication weakness.

Its advisory also covers CVE-2025-41451, a command injection flaw in email alert settings, and CVE-2025-41452, a web server configuration weakness. Both affect versions before R4.3.1.

Team82 explains that the command injection flaw could allow code execution after authentication. The configuration weakness could let an authenticated attacker alter web traffic handling or disrupt the management interface.

These findings show possible attack paths, not a confirmed account of how the French incident unfolded. The AK-SM 800A manages multiple refrigeration devices through one web interface. Operators can adjust temperature limits, schedules, alarms, and user accounts.

That central role makes exposed management access especially risky because changes can affect physical cooling operations, rather than only digital records. Similar concerns appear in Cybersecurity News coverage of internet-exposed cooling and power controllers.

CERT-FR recommends restricting network access to service providers when compromise is suspected, then performing a factory reset, applying available security updates, changing passwords and other secrets, checking accounts, and fully reconfiguring the system. Recovery should follow a controlled process that protects store operations.

Operators should also remove direct internet exposure, separate control networks from business networks, and use protected remote access. Patching remains essential, but access restrictions are equally important while teams assess, repair, or replace affected equipment. For retailers, the immediate priority is restoring safe cooling without leaving the same access open.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Danfoss Refrigeration Hack Update – 4,980 Hosts Found Exposed to Internet appeared first on Cyber Security News.