Imagine opening a supermarket on Monday morning and finding freezers full of food that can no longer be sold. The refrigeration equipment is still there. The power is still on. But someone changed the instructions that tell the system when to cool and when to defrost.
That was the scene reported across France after cyberattacks on refrigeration controllers. The Associated Press reported disruption at hundreds of stores. The French Finance Minister put the affected figure at about 700 supermarkets. Retailers reported spoiled stock, while authorities investigated reports of fires. French reporting described defrost settings raised to 50°C and extended defrost periods.
The story widened within a day. CERT-FR’s October 13 alert names compromised Danfoss AK-SM and AK-SC controllers and Copeland xweb and Dixell xweb systems. This is a cyber incident with physical consequences, and it crosses product families. For a defender, the immediate questions are practical: Where else are these systems reachable? Which observations belong to us or our suppliers? What can we change without interrupting the cooling process?
We used SecurityScorecard’s Driftnet internet intelligence engine to investigate the external footprint and followed the evidence from a narrow Danfoss search into other controller families and lower-confidence leads. We used OpenAI’s Daybreak Blue to help reason through those pivots and the response decisions. We use this data to show defenders where to look and how to verify what they find.
The First Search Was Only the Beginning
We started where an analyst might start: Driftnet’s internet scan index and the exact page title “Danfoss – StoreView Web.” That search returned 470 records. Had we stopped there, we would have missed most of the observable surface.
We expanded to a legacy StoreView title, the distinctive “aksm-auth” HTTP response header, and hostname-based observations. After deduplicating by public IP and port, the October 13 collection contained 5,282 StoreView observations across 4,642 public IPs. France contributed 2,606 observations, followed by Portugal, Belgium, Spain, and Poland; the full set carried 75 country labels.
Figure 1. Driftnet’s country label describes the public IP. Map boundaries: Natural Earth.
The map gives defenders a way to understand reachability and prioritize owner lookups. It does not show where the French campaign spread. Nor is each IP necessarily one controller: a public address can front several services. A web title alone cannot establish model, firmware, vulnerability, or compromise. StoreView Web can connect to both AK-SM 800A and older AK-SM 800 systems, which is why a site must verify the actual unit before choosing a fix.
The extra pivots also change the confidence of the result. Of the 5,282 observations, 3,687 carried both a StoreView title and the “aksm-auth” header, 1,581 had a matching title alone, and 14 were header-only leads. Hostname scans added 15 IP:port pairs beyond the IP-based results. Only 46.6% used port 80 or 443. More than half appeared on other ports, where a narrow web check would miss them. The title and header combination is a stronger candidate for asset matching. A header alone calls for more review.
Figure 2. A title, a response header, a hostname, and a port each reveal part of the surface.
An Exposed Human-Machine Interface (HMI) Is a Route Toward the Physical Process
Traditional cybersecurity asset lists often focus on servers, laptops, applications, and databases. Refrigeration asks a different question: which connected system can change the temperature of something people depend on?
These web pages are human-machine interfaces, or HMIs, for supervisory refrigeration controllers. They let a remote operator monitor alarms and change settings. The supervisory controller in turn talks to field controllers that read sensors and operate fans, compressors, and defrost heaters. Claroty’s description of XWEB Pro architecture shows why an exposed HMI sits on a path to real equipment. The exact privileges and control path differ by installation. A login page alone does not prove an outsider can change a setpoint.
That distinction does not make exposure harmless. Our web observations included 3,612 StoreView interfaces over HTTP, with 1,670 over HTTPS. An HTTP web session has no transport encryption. We did not observe credentials in transit, and a public banner cannot tell us whether a factory password was retained. But an internet-visible HMI is enough to trigger a focused owner check: Is remote access protected? Are accounts and passwords managed? Is the web session encrypted where supported? What route leads from this HMI to the controller?
Legacy systems make the response harder. Danfoss says the AK-SM 800 reached end of life and lists AK-SC 255/355 among end-of-service products. An end-of-service unit may have no vendor patch path, so isolation and planned replacement become the practical response. Supported AK-SM 800A systems have a different update path. The exact model and its support status determine whether to patch, isolate, or replace.
Now add the contractor. A retailer may own the food, while a refrigeration specialist installed the controller, maintains the equipment, and uses remote access for service. The site may not have that HMI in its IT inventory. Alarm feeds, maintenance contracts, and after-hours service can all depend on the connection. The person accountable for the product and the operator who can safely change controller access need to be in the same response conversation. This is where external visibility becomes a third-party asset inventory problem, not simply a firewall finding.
The Advisory Crossed Vendors, So the Investigation Had to Follow
The follow-on reporting about Dixell was not merely a similar-looking story. CERT-FR added Copeland xweb and Dixell xweb to the affected product list. Dixell Electronics is now part of Copeland, so we treated XWEB as one title family rather than adding two brand names as if they were separate inventories.
We searched Driftnet for the exact page titles “XWEB,” “XWEB EVO,” and “XWEB PRO.” Deduplicated by public IP and port, the collection yielded 6,340 XWEB-family HMI observations across 5,643 public IPs. 4,816 of those web observations used HTTP and 1,524 used HTTPS. These are a second population of internet-facing HMI signals. They are not 6,340 confirmed vulnerable controllers, and we have not attributed their public IPs to the French victims.
Figure 3. A vendor-specific pivot finds another public HMI population. The two counts are not an additive count of unique physical devices or affected stores.
The operational risk crosses sectors. Refrigeration protects distribution centers, laboratories, healthcare inventory, and biopharma products. WHO says almost all vaccines used in immunization programs are licensed for a traditional 2-8°C cold chain. A short excursion can force a product-specific assessment of temperature, duration, and recorded conditions; for some products, lost assurance is itself consequential. Food security and patient safety therefore belong in the risk discussion alongside network exposure.
There is also a trust problem with telemetry. In a controlled XWEB Pro demonstration, researchers manipulated the temperature displayed by a field controller and disabled cooling while the operator view appeared normal. That lab result does not show that the French attackers used the same technique. It does show why a response plan needs an independent calibrated logger or physical measurement, plus sensor and alarm checks. If the HMI display is part of the suspected control path, it cannot be the sole source of truth about the product.
Where Daybreak Blue Changed the Pace of the Investigation
How the attackers got in remains unknown, and no evidence at this time ties artificial intelligence (AI) to this campaign (the entry point in the reported compromises has not been established publicly, so we cannot assign an exploit or an AI workflow to the attackers). But AI is changing the threat landscape by compressing time. AI gives attackers speed — AI is making parts of cyber reconnaissance and exploitation easier to use — and defenders have to match it.
The UK National Cyber Security Centre assessed that threat actors are using AI to make reconnaissance, vulnerability research, exploit development, and social engineering more efficient. A defender should expect less time between an exposed interface becoming interesting and someone trying to use it.
The defender’s answer cannot be an automatic severity score. A model has to understand the advisory, the OT workflow, and the limits of the scan data at the same time. Through our use of Daybreak Blue, an access level in OpenAI’s Trusted Access for Cyber program, we worked through the evidence that Driftnet returned: titles, response headers, ports, certificates, country metadata, and observation times. Daybreak Blue is designed for approved defensive work, including investigation, vulnerability triage, incident response, and patch validation. In this case, it helped shape the next questions and organize the answers. It did not authenticate to, test, or operate an observed controller.
We kept the questions narrow, so every answer led to an action: which signature is strong enough to enter an owner lookup, and which belongs in a lower-confidence queue? Which controller families did the first search miss after CERT-FR expanded the alert? Does a repeated certificate indicate a likely related system, a gateway, or copied configuration? What is the safe branch for supported equipment versus an end-of-service controller? What independent temperature evidence is needed before anyone closes the incident? The model could keep these threads connected while an analyst checks each claim against vendor documentation and the observed data.
This is why capable defensive models matter at this scale. Thousands of scan observations, changing advisories, multiple product families, and site-specific OT constraints exceed what a person can reconcile quickly by reading banners one by one. A model can propose pivots, expose contradictions, and draft a traceable review queue fast enough to be useful during a live incident. Its output still needs evidence and an accountable human decision. Speed without that discipline would merely automate misattribution.
The important gain is time between a credible external signal and a reviewed, owned action. The refrigeration operator still must verify the physical system and approve the change.
Internet Intelligence Must Lead to an Accountable Queue
A defender could be handed a large list of IPs and still not know what to do on Monday morning. Internet intelligence becomes useful when the analyst preserves the evidence behind each lead, chooses the right owner, and keeps a search hit separate from a verified device. It also gives the team a way to look beyond the obvious title search without claiming that every new lead is another controller.
Our certificate pivot illustrates both the opportunity and the danger. We searched for TLS certificates with “DanfossSM800A” in the subject while excluding a Danfoss web title. It returned 874 reports; 10 IP:port pairs were already in our StoreView inventory, leaving 864 additional certificate leads. 669 appeared on TCP port 1041 with the same self-signed certificate. Of those, 599 shared a public IP with a StoreView observation, while 70 appeared on public IPs absent from that inventory. Across all 864 leads, 221 public IPs were new to the original baseline.
Some certificate results displayed a different web product title. A certificate can be reused or copied, and a gateway can front several services. Danfoss documentation mentions UDP port 1041 for controller communications, while these observations were TLS over TCP 1041. We cannot infer that the documented UDP service was exposed. The 36 leads with another web title stay in a separate review queue until the network owner explains them.
Figure 4. Certificate reuse and shared public addresses make this a review queue. They do not establish 864 additional Danfoss controllers.
Freshness is part of triage. In the StoreView collection, 2,680 endpoints were last seen October 11-13, 1,205 on October 6-10, and 1,397 from September 13 through October 5. Older observations need a recheck. The Driftnet index also changed while we paginated, so the count reflects a dated, deduplicated collection, rather than a frozen global census.
A normal asset database may identify a purchased controller but miss the contractor’s public Network Address Translation (NAT) rule. Internet intelligence may reveal a reachable HMI but cannot prove who owns it. The useful join is concrete: public IP and port → verified network owner → store or facility → refrigeration contractor → exact controller and firmware → person authorized to change access. This is the bridge between awareness and remediation. Until that join is made, geography and a recognizable domain remain clues.
From Exposure to a Safe Remediation Plan
The response starts with the physical process and the accountable operator. The internet signal identifies what deserves a site check. CERT-FR recommends removing public exposure, checking the complete configuration and defrost periods, and restoring remote access through a protected network or secure VPN. It also calls for changed default passwords, appropriate security settings, and updates where the vendor supports them. For a compromised end-of-life device, CERT-FR warns that a factory reset alone leaves it exposed to compromise again.
Figure 5. The loop ends with a verified change in exposure and a physical process check.
Each candidate needs answers to five questions from the site and its service provider:
1. Is it ours? Match the observed IP:port and hostname to verified address ranges, DNS, store or plant records, and the refrigeration contractor roster. Resolve shared IPs before assigning a device. Include the StoreView, XWEB, and lower-confidence certificate queues, each with its evidence level.
2. Is the process safe now? Have the operator compare the HMI display with an independent temperature logger or calibrated measurement. Check actual product temperatures, setpoints, defrost schedules, alarms, and sensor integrity. Preserve logs and configuration evidence if compromise is suspected.
3. Can we remove public reachability without breaking operations? Coordinate the access change with the contractor and store. Keep required monitoring and alarms working through a protected route. Recheck the public IP and port from the outside after the change. Use a fresh Driftnet observation when it becomes available, and record the time of the last observation.
4. What exact model and firmware are behind the HMI? Use authenticated maintenance records. Danfoss publishes current AK-SM 800A software for supported systems. Copeland says XWEB Pro 1.13 contains security improvements and still advises against direct internet exposure. For Danfoss end-of-service models, plan isolation and replacement.
5. What did we miss? Reconcile privately addressed controllers, other AK-SC and XWEB models, contractor managed units, and facilities without a public HMI. Repeat the internet search as advisories and signatures change. The external scan tests one part of the inventory, while site and contractor records must account for the rest.
What We Learn From the Cold Chain
Cybersecurity is bound to the physical systems that keep food, medicine, and production viable. The French incidents show the cost of losing control of refrigeration. The Copeland and Dixell additions show how quickly an investigation can move beyond the first vendor named in a headline. The Driftnet observations show how much of this HMI surface can be found without touching a controller.
The combined workflow is the defensible one: use internet intelligence for rapid awareness, broader discovery, and a dated external baseline. Use Daybreak Blue to reason across sources, propose and scrutinize pivots, and build a queue that preserves confidence and uncertainty. Use internal records and the OT operator to verify ownership and choose the safe fix. Then, revisit the external footprint to check whether exposure changed. Neither a model nor a scan can substitute for the site’s knowledge of its process. Together, they can make that knowledge actionable sooner.
The measure of progress is how quickly each credible HMI lead gains an owner, a verified model, a safe access decision, and evidence that the exposure changed. For supported equipment, that may include an update. For end-of-life equipment, it means isolation and replacement. In either case, independent temperature evidence matters as much as the web banner. That is the practical lesson: know the connected cold chain well enough to protect both the network path and the product it controls.
Methodology and limits. On October 13, 2026, we collected Driftnet protocol and domain scan observations from September 13 onward. StoreView searches used the exact “Danfoss – StoreView Web” title, a legacy StoreView title, the “aksm-auth” response header, and hostname pivots. XWEB searches used exact “XWEB,” “XWEB EVO,” and “XWEB PRO” titles. We deduplicated each family by public IP and port. The Danfoss certificate query is a separate, lower-confidence set; broad XWEB certificate and header queries matched unrelated services and were excluded from the XWEB count. HTTP and HTTPS counts reflect observed web URLs, not credential behavior. The index changed during collection. We did not interact with live controllers, test credentials, or attempt exploitation. We have not independently confirmed ownership, model, firmware, default passwords, vulnerability, compromise, or remediation for individual observations. Source material for the incident is linked in the article. Driftnet’s API documentation describes the scan data.
Driftnet indexes 40% more internet-exposed hosts than any other intelligence provider. See what’s exposed, then detect and investigate it with Driftnet, internet-wide attack surface intelligence from SecurityScorecard.
This article reflects the opinions and independent analysis of SecurityScorecard and its authors as of the publication date above. It is provided for general informational purposes only and does not constitute legal, compliance, engineering, safety, or other professional advice, and nothing in it should be relied upon as a complete or exhaustive set of steps, controls, or recommendations for addressing the risks, vulnerabilities, or incidents described; organizations should consult their own qualified professionals and vendors before taking any action. References to third-party products, services, vendors, or sources are for informational purposes only and do not constitute an endorsement or verification by SecurityScorecard, nor an endorsement of SecurityScorecard by them.
