53% of exposed Danfoss dashboards were in France. Then supermarket fridges hit 50°C
Attackers pushed refrigeration controllers in hundreds of French supermarkets into defrost mode, and stores threw away food.
IPinfo's scans found 2,528 Danfoss StoreView dashboards open to the internet on October 6-7, and France had 1,331 of them, more than the other 72 countries combined. 85% of the French ones ran software with known flaws.
After the attack, 316 French dashboards were still online on October 14, a 76% drop.
What happened
According to IPinfo's analysis, in October 2026 attackers pushed refrigeration controllers in hundreds of French supermarkets into defrost mode, with some units reaching 50°C and stores discarding food. The controllers are Danfoss units whose StoreView web dashboards were reachable from the internet by anyone who knew the address.
The scan numbers
IPinfo runs weekly IPv4 scans of common web ports and matches device fingerprints; a researcher and Censys got similar counts.
- Exposed on October 6-7: 2,528 Danfoss dashboards worldwide; France 1,331 (53%), the other 72 countries together 1,197.
- Known flaws: 85% of French dashboards. 527 used controllers Danfoss no longer supports, and only 195 had every fix.
- Stale addresses: 1,019 French dashboards had sat at the same address since March 30, and the fully patched share rose only from 14% to 24%.
- Dixell XWEB: also exposed, 70 in France and 1,611 overall.
- After the attack: 316 French Danfoss dashboards remained online on October 14, down 76%.
Response
CERT-FR told operators to disconnect the controllers or restrict access, use a VPN for contractors, update firmware, set security to Strict and change default passwords. Its October 13 alert added Dixell XWEB systems. The Paris prosecutor has opened an investigation; the attackers and their entry method remain unidentified.
The flaw was a built-in daily password, and a French firm reported it in 2023
The thread dug into the firmware. A commenter says the 2025 "login bypass" was a datetime-based password check in a function named check_code_of_the_day:
"a built-in backdoor password, like it's the 90s again" — a commenter who read the decompiled firmware function
It was also old news:
"A famous french cybersecurity firm, Synacktiv, published a report in 2023 (!) about the code-of-the-day vulnerability, but it made less noise apparently" — a commenter replying with a link to the Synacktiv PDF
On why the units were online, a commenter describing a 12-hour blackout that left a shop's freezers empty said food-safety rules where they live require temperature records. That makes CERT-FR's restrict-access-or-VPN option more realistic than unplugging.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Let's Encrypt moves to six remote validation perspectives ahead of a December deadline
Each certificate validation will now make seven requests: one from the primary datacenter and six from remote vantage points.