France had more Internet-exposed Danfoss refrigeration dashboards than the rest of the world combined before the supermarket attacks (weekly IPv4 scan data)
IPinfo conducted a scan of the IPv4 internet revealing vulnerabilities in Danfoss StoreView dashboards. Five days before an undisclosed attack, 2,528 addresses hosting the dashboard were identified in 73 countries. France had the largest concentration with 1,331 addresses, representing 53% of the total. A significant portion, 85% of French dashboards, ran software with known flaws, including 527 end-of-life AK-SM 800 units. Only 195 French units had every necessary fix.Following the attack, a scan on October 14 showed a sharp decrease in active French addresses, with 316 remaining online. This represented a 76% drop, much higher than the usual weekly loss of 3-7%. The number of fully patched units also declined from 195 to 54. Investigators believe this indicates disconnection rather than successful patching efforts. The method for identifying dashboards involved matching page titles and specific web server elements. The exact entry point for the attackers remains unknown, and mere exposure does not confirm a breach.
