Censys Finds 53% Drop in Exposed Refrigeration Controllers Amid Reported Attacks
Summary
Censys measured a 53% decline in Internet-exposed Danfoss StoreView and Copeland/Dixell XWEB controllers from Oct. 9 to Nov. 5, amid reported attacks in France and other European countries. The data does not establish why devices went offline.
Key points
- Censys counted 6,695 exposed hosts on October 9 and 3,124 on November 5 across the two controller families, a 53% decline.
- Danfoss StoreView exposure fell 76%, from 3,004 to 708 hosts; Copeland/Dixell XWEB fell 35%, from 3,708 to 2,420.
- The first sharp decline was concentrated in France: exposed Danfoss StoreView hosts fell from 1,841 to 497 on October 13–15, then to 209 by November 5.
- A broader decline began November 2, coinciding with reports of attacks in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden. The article says no group claimed responsibility and it is unconfirmed whether the same actor was involved in both waves.
- Reports described October attacks that put French supermarket refrigeration units into defrost mode and November attacks that remotely raised case temperatures.
- The article cites CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452; it says Claroty Team82 research showed CVE-2025-41450 and CVE-2025-41451 could be chained for remote code execution.
- Censys cautions that its measurements cannot explain why hosts went offline or distinguish provider action from owners disconnecting devices.
Article Details
- Publisher
- Censys
- Report Period
- 2026-10-09 to 2026-11-05
- Scope
- Internet exposure of Copeland/Dixell XWEB and Danfoss StoreView refrigeration controllers, including reported attacks in France and a second wave across several European countries.
- Sample Size
- Distinct exposed hosts across the two advisory product families; 6,695 on October 9 and 3,124 on November 5, 2026.
- Key Statistics
- Combined observed exposure fell 53%, from 6,695 to 3,124 distinct hosts, between October 9 and November 5, 2026.
- Danfoss StoreView exposure fell 76%, from 3,004 to 708 hosts; Copeland/Dixell XWEB fell 35%, from 3,708 to 2,420.
- In France, Danfoss StoreView exposure fell from 1,841 hosts to 497 over October 13–15, then to 209 by November 5.
- After November 2, Danfoss StoreView exposure fell 30% across 32 countries and Copeland/Dixell XWEB fell 29% across 36 countries.
- The report says exposure measurements do not establish why controllers went offline or prove that reported attacks caused the declines.
- Recommendations
- CERT-FR called for the affected refrigeration controllers to be removed from the Internet.
CVE
CVE-2025-41450Danfoss · AK-SM 8xxA SeriesPublic research by Claroty Team82 has shown that disclosed Danfoss vulnerabilities, including CVE-2025-41450 (a date-based administrator login), can be chained for remote code execution.CVE-2025-41451Danfoss · AK-SM8xxA Seriesin March 2025, an unauthenticated administrator login derived from the current date, followed by CVE-2025-41451 and CVE-2025-41452 in August 2025, which allow authenticated command execution and disruption of theCVE-2025-41452Danfoss · AK-SM8xxA Seriesan unauthenticated administrator login derived from the current date, followed by CVE-2025-41451 and CVE-2025-41452 in August 2025, which allow authenticated command execution and disruption of the management
Vendors
CopelandAcross the two advisory product families, Copeland/Dixell XWEB and Danfoss StoreView, observed global exposure fell 53%, from 6,695 to 3,124 distinct hosts, between October 9 and November 5, 2026.DanfossAcross the two advisory product families, Copeland/Dixell XWEB and Danfoss StoreView, observed global exposure fell 53%, from 6,695 to 3,124 distinct hosts, between October 9 and November 5, 2026.DixellAcross the two advisory product families, Copeland/Dixell XWEB and Danfoss StoreView, observed global exposure fell 53%, from 6,695 to 3,124 distinct hosts, between October 9 and November 5, 2026.
Products
Copeland/Dixell XWEBAcross the two advisory product families, Copeland/Dixell XWEB and Danfoss StoreView, observed global exposure fell 53%, from 6,695 to 3,124 distinct hosts, between October 9 and November 5, 2026.Danfoss StoreViewAcross the two advisory product families, Copeland/Dixell XWEB and Danfoss StoreView, observed global exposure fell 53%, from 6,695 to 3,124 distinct hosts, between October 9 and November 5, 2026.
Countries
Belgium30% across 32 countries; Copeland down 29% across 36 countries), coinciding with reported attacks in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden.Estonia32 countries; Copeland down 29% across 36 countries), coinciding with reported attacks in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden.FranceFollowing coordinated cyberattacks on supermarket refrigeration systems in France on October 10-11, 2026, and a second wave across several European countries on November 2, 2026, Censys has tracked a sustained declineIrelandcountries; Copeland down 29% across 36 countries), coinciding with reported attacks in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden.LuxembourgCopeland down 29% across 36 countries), coinciding with reported attacks in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden.Netherlandsacross 36 countries), coinciding with reported attacks in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden.Swedencoinciding with reported attacks in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden.