Cold Chain, Cold Comfort: What the Danfoss Case Says About Buying Exposed Equipment

The French supermarket attack of 11 October 2026 is usually filed under incident response. It belongs equally in procurement. Every controller in the affected class was bought, installed and configured by somebody, and the configuration that put a control panel on a public address was a purchasing and commissioning decision before it was a security one.
The exposure data makes that case more sharply than any policy document.

What was purchased

Danfoss confirmed its equipment was targeted in the attack on cooling systems at hundreds of French supermarkets. Its statement separated the fleet into two groups: AK-SM800 and AK-SC355 controllers that no longer receive security updates, and AK-SM800A controllers running outdated firmware. The StoreView panel is the interface in front of those controllers.
Both groups share a property that no datasheet advertises. They can be reached on the public internet, and a portion of them were. Censys counted 2,991 exposed StoreView panels on 11 October, 1,825 of them in France, and by 14 October the French figure had fallen 71% to 537.
The version distribution describes a purchasing pattern as much as a patching pattern. On 11 October, 74% of French exposed instances ran below 4.3.1, the release covering CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452. Poland sat at 81%, Romania at 80% and Belgium at 76%. The current release is 5.3.2.
A fleet with three quarters of its exposed units behind a fix that shipped over a year earlier is not a fleet with a patching backlog. It is a fleet whose owners did not know they held a patching obligation, which is a contract problem.

The measurement that belongs in a tender

An independent engine cannot read a firmware version, but it can establish whether a class of equipment tends to face the internet. That is a question a buyer can ask before signing.
The ZoomEye header query run on 22 October 2026 is one way to obtain the evidence:
| Query | Result |
| --- | --- |
| http.header="Danfoss" | 260 |
| http.header="Danfoss" && port="80" | 120 |
| http.header="Danfoss" && port="443" | 132 |
| http.header="Danfoss" && country="NL" | 54 |
| http.header="Danfoss" && country="US" | 28 |
| http.header="Danfoss" && country="DE" | 25 |
| http.header="Danfoss" && country="FR" | 1 |
What a buyer should not do is read 260 as a quality verdict on the vendor. It is a count of assets emitting a particular header. What a buyer can do is use the technique on the class of equipment actually being considered, record the result, and ask the supplier why a device with a web management interface appears on the public internet at all.
The Netherlands figure of 54 against a French figure of 1 four days after a French incident is a useful thought experiment in that conversation. The header string does not concentrate where the incident happened; it concentrates wherever those devices were installed and configured with public reachability.

The three questions a specification should force

The incident supplies the questions, and they are not the usual security questionnaire items.

Does the device need a public address to function? A refrigeration control panel that supports remote maintenance is not the same product as one that requires a public interface. If the vendor's answer is that internet connectivity is optional, the commissioning decision becomes the operator's to defend.
What is the supported-version lifetime, in writing? Danfoss divided its fleet into models still receiving updates and models that no longer do. A buyer who does not know which side of that line a purchased controller sits on has bought an indefinite obligation with a finite vendor commitment.
Who patches it, and with what outage? The Claroty demonstration of CVE-2025-41450 and CVE-2025-41451 chained to remote code execution and falsified temperature readings describes a device whose compromise is measured in stock loss. The patch for it competes with a refrigeration loop that cannot be safely restarted at will. That trade-off belongs in the contract, not in the incident review.

Why disconnection is a purchasing signal

Censys concluded that operators disconnected panels rather than patched them, because all three version categories shrank by roughly 70%, including the ones already on patched releases. That is a rational choice for a single site under pressure. Across a market it is a signal that the equipment's maintenance model does not accommodate firmware updates.
A buyer reading that signal has three options, and only one of them is comfortable. Accept the model and budget for disconnection as a routine control. Accept the model and negotiate an update window into the maintenance contract. Or buy equipment whose update path does not require a cold-chain risk assessment.
None of this requires naming a vendor as negligent. The three CVEs were patched, the versions were published, and the vendor stated which models remain supported. The gap sits in the space between a shipped fix and a fleet that could apply it.

A practical procurement checklist

For the next refrigeration, HVAC or building-management procurement round:

Search the public internet for the equipment class before signing, using a fixed query and recording the date.
Ask for the supported-version end date of every controller model in the bid, not the product family.
Ask what the vendor's remote-access architecture requires, and whether the panel can sit behind a broker rather than on a public address.
Write a firmware update window into the maintenance contract, with an agreed outage tolerance for the refrigeration loop.
Re-run the external query after commissioning and compare it with the pre-purchase baseline. The last item is where a tool like ZoomEye earns its place in a procurement file: not as a compliance tick, but as evidence that the configuration is what the specification said it would be.

The uncomfortable takeaway

The French operators who disconnected their panels in 72 hours acted faster than their contracts had prepared them to act. The equipment worked, the fixes existed, and the mechanism to apply them did not.
That is the part of this incident worth carrying into a supplier negotiation. Exposure counts are volatile and engine-dependent. A maintenance model that expects a controller to be patched on a live refrigeration loop is a durable thing to fix.