Refrigeration controller exposure fell 53% between 9 October and 5 November 2026, according to Censys. The drop followed two waves of attacks on European refrigeration systems, the second overnight on 2 November. If you run Danfoss StoreView or Copeland/Dixell XWEB controllers, the steps for owners are below.
What Does the Censys Data Show About Refrigeration Controller Exposure?
Censys counts distinct Internet-exposed hosts in the two product families named in CERT-FR emergency alert CERTFR-2026-ALE-012. The figures are exposure measurements. They are not counts of attacked devices.
| Product family | Hosts on 9 October | Hosts on 5 November | Change |
|---|---|---|---|
| Danfoss StoreView | 3,004 | 708 | -76% |
| Copeland/Dixell XWEB | 3,708 | 2,420 | -35% |
| Both families | 6,695 | 3,124 | -53% |
The first decline was almost entirely France. Danfoss StoreView exposure there fell from 1,841 hosts to 497 over 13 to 15 October, then eased to 209 by 5 November. The second decline began on 2 November and touched both vendors: Danfoss fell 30% across 32 countries and Copeland fell 29% across 36 countries.
What Happened in the Two Attack Waves?
Censys describes the French attacks of the night of 11 October. Attackers switched refrigeration units at hundreds of supermarkets into defrost mode, which spoiled food and in some cases caused fires. The targeted systems were Danfoss StoreView controllers with Internet-exposed management interfaces.
On the night of 2 November, grocers and small shops in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden reported a second wave. Censys says attackers remotely raised case temperatures. It adds that no group has claimed responsibility and that it is not confirmed that one actor was behind both waves. Our earlier refrigeration attack playbook covers the first reports.
Why Did Exposure Fall, and Is the Risk Gone?
Censys states that its data does not show why the controllers went offline. A fall in exposure is consistent with provider action or with owners disconnecting devices, and the measurements do not tell the two apart. On 5 November Censys still counted 3,124 exposed hosts, with Copeland/Dixell XWEB led by Italy (366) and Greece (209).
Censys also lists the Danfoss flaws it describes. CVE-2025-41450, disclosed in March 2025, is an unauthenticated administrator login derived from the current date. CVE-2025-41451 and CVE-2025-41452, disclosed in August 2025, allow authenticated command execution and disruption of the management interface. Censys notes that public research by Claroty Team82 showed the first two can be chained for remote code execution.
What Should Owners of These Controllers Do Now?
Step 2 follows the CERT-FR alert as Censys reports it. Steps 1, 3, 4 and 5 are our advice, because the Censys post gives no fixed versions or owner checklist.
- Find your controllersList every Danfoss StoreView and Copeland/Dixell XWEB unit at every site. Ask your refrigeration contractor which ones answer from the Internet.
- Take the management interface off the InternetCERT-FR calls for removing these controllers from the Internet. Allow remote access only through a VPN or from a short list of known addresses.
- Apply the vendor fixesRead Danfoss’s advisories for CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452 and apply the firmware they name. Ask your Copeland installer for current guidance.
- Check what changedReview controller logs for logins, setpoint changes and defrost commands since 10 October. Compare today’s setpoints with your commissioning sheet.
- Add an independent alarmFit a temperature alarm that does not rely on the controller, and set a manual check routine for nights and weekends.
Our entry on network segmentation explains how to keep building systems off the open Internet. For an earlier case of exposed industrial controllers under attack, see our page on the Unitronics PLC attacks.