Following coordinated cyberattacks on supermarket refrigeration systems in France on October 10-11, 2026, and a second wave across several European countries on November 2, 2026, Censys has tracked a sustained decline in Internet-exposed refrigeration controllers named in CERT-FR emergency alert CERTFR-2026-ALE-012. Across the two advisory product families, Copeland/Dixell XWEB and Danfoss StoreView, observed global exposure fell 53%, from 6,695 to 3,124 distinct hosts, between October 9 and November 5, 2026.
Executive Summary
- Total Internet-exposed refrigeration controllers in the two advisory families fell 53% (6,695 to 3,124 distinct hosts) between October 9 and November 5, 2026.
- Danfoss StoreView exposure dropped 76% (3,004 to 708); Copeland/Dixell XWEB dropped 35% (3,708 to 2,420).
- The first, sharp decline was almost entirely France, where Danfoss StoreView exposure fell from 1,841 hosts to 497 over October 13-15, then eased to 209 by November 5, following the French attacks reported around October 11.
- A second, broad decline began November 2 and affected both vendors (Danfoss down 30% across 32 countries; Copeland down 29% across 36 countries), coinciding with reported attacks in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden.
| Metric | Change | Hosts (Oct 9 → Nov 5) |
| Total exposure | -53% | 6,695 → 3,124 |
| Danfoss StoreView | -76% | 3,004 → 708 |
| Copeland/Dixell XWEB | -35% | 3,708 → 2,420 |
Background: Two Reported Attack Waves
On the night of October 11, 2026, attackers switched refrigeration units at hundreds of French supermarkets into defrost mode, spoiling food and, in some cases, causing fires. The targeted systems were Danfoss StoreView controllers with Internet-exposed management interfaces. French authorities issued emergency alert CERTFR-2026-ALE-012, calling for these controllers to be removed from the Internet. Public research by Claroty Team82 has shown that disclosed Danfoss vulnerabilities, including CVE-2025-41450 (a date-based administrator login), can be chained for remote code execution.
Overnight on November 2, 2026, grocers and small shops in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, and Sweden reported a second wave, with attackers remotely raising case temperatures. No group has claimed responsibility, and it is not confirmed that the same actor was behind both waves.
Advisory and Vulnerabilities
Danfoss disclosed CVE-2025-41450 in March 2025, an unauthenticated administrator login derived from the current date, followed by CVE-2025-41451 and CVE-2025-41452 in August 2025, which allow authenticated command execution and disruption of the management interface. Public research by Claroty Team82 later showed the first two could be chained for remote code execution. CERT-FR emergency alert CERTFR-2026-ALE-012 calls for these controllers to be removed from the Internet.
Danfoss StoreView: Concentration
As of November 5, 2026, Danfoss StoreView exposure remains concentrated in France (209 hosts) and Belgium. France alone accounted for the bulk of the vendor’s global total before the October attacks and still leads the European distribution after a 76% fall.
Copeland/Dixell XWEB: A Long Tail
Copeland/Dixell XWEB exposure is distributed across a long tail of mid-sized countries, led by Italy (366) and Greece (209), unlike the France-centric Danfoss picture. Most of Copeland’s decline came after November 2: its exposure was roughly flat through late October, then fell about 29% across 36 countries in the final days of the window.
Censys Assessment
Between October 9 and November 5, 2026, Internet-exposed hosts in the two advisory families fell 53% (6,695 to 3,124). The decline came in two distinct moves. The first was almost entirely France, where Danfoss StoreView exposure fell from 1,841 hosts to 497 over October 13-15, then eased to 209 by November 5, following the French attacks reported around October 11. The second began on November 2 and was broad: Danfoss fell 30% across 32 countries and Copeland/Dixell XWEB fell 29% across 36 countries over the final days of the window. The data does not show why the controllers went offline. A fall in exposure is consistent with provider action or owners disconnecting devices, and these measurements do not distinguish among them.
