Back to the trend of the day: Hackers switched off the cold in hundreds of French supermarket fridges
Poly Rating · from the trend of the day

Danfoss Controllers Exposed Online in Europe: 6 Countries

France alone held 2,898 of the 4,481 Danfoss StoreView screens visible worldwide on 13 October 2026, yet Censys found only 881 unique French hosts behind them.

  • No. 1: France
  • 6 places

01Final list

The leading AIs each built their own list of ten independently. Here is one result that is easy to check: every place has a reason, a source, and the list of AIs that included it.

Order: from most to least AI agreement.

A bright badge means this AI put the entry on its list. A dim badge means it did not.

  1. 1

    France

    2,898 of 4,481 Shodan results worldwide (about 65%), but only 881 unique hosts on Censys and 1,590 according to Predicta Lab. The count depends on the tool.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 2 · Claude: 1 · ChatGPT: 1

    What each AI noted 3
    • Geminiplace 2

      The epicenter of the October 2026 defrost attack had over 1,200 Danfoss panels directly on the web (18.4 per 1,000 stores) until an emergency scramble disconnected 71% of them in 72 hours.

    • Claudeplace 1

      About 58–65% of the world's visible Danfoss interfaces sit in one country, which was also where the attack hit.

      Source ↗
    • ChatGPTplace 1

      2,898 Shodan results represented about 65% of the global StoreView results in one 13 October snapshot.

      Source ↗
    3 AIs put it here
    Source ↗
  2. 2

    Belgium

    115 panels in one scan, one fewer than Poland, and in SOCRadar's top five. Its small store network suggests a high per-store rate, but that rate has not been calculated.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 6 · Claude: 3 · ChatGPT: 5

    What each AI noted 3
    • Geminiplace 6

      Belgium shows a tight concentration of retail cooling units on open ports, recording 10.3 exposed controllers per 1,000 food stores with 62% operating unauthenticated HTTP interfaces.

      Source ↗
    • Claudeplace 3

      Also in SOCRadar's top five by exposed interfaces, but Belgium's small store network would make any per-store ratio high.

      Source ↗
    • ChatGPTplace 5

      Belgium ranks among the top five StoreView countries in SOCRadar’s snapshot and has 115 panels in another scan.

      Source ↗
    3 AIs put it here
    Source ↗
  3. 3

    Poland

    116 panels in one scan and in SOCRadar's top five; it also appears in Censys's broad ICS exposure list. Effectively tied with Belgium.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 9 · Claude: 5 · ChatGPT: 7

    What each AI noted 3
    • Geminiplace 9

      Rapid supermarket chain expansion left 120 exposed Danfoss panels across 85,000 stores (1.4 per 1,000 units), with over half tied to end-of-life AK-SC controllers installed during mid-2010s retail construction.

      Source ↗
    • Claudeplace 5

      Poland is in SOCRadar's top five by exposed Danfoss interfaces, and a Sekoia-sourced report also lists it among affected countries.

      Source ↗
    • ChatGPTplace 7

      Poland features in the leading StoreView country group and in Censys’s broad ICS exposure list, but neither measure identifies affected stores.

      Source ↗
    3 AIs put it here
    Source ↗
  4. More about the top three ↓
  5. 4

    Germany

    One scan found 171 panels, more than Portugal, yet Germany is missing from SOCRadar's top five. That makes 171 a single, disputed number.

    Included it: Gemini, Claude, ChatGPT.

    In their lists: Gemini: 10 · Claude: 7 · ChatGPT: 6

    What each AI noted 3
    • Geminiplace 10

      Despite boasting Europe's biggest economy and 75,000 food stores, strict BSI industrial security standards keep exposed store controllers down to just 1.1 per 1,000 stores.

      Source ↗
    • Claudeplace 7

      Germany has Europe's largest grocery market, so even a sizeable raw count would dilute into a modest per-store rate.

      Source ↗
    • ChatGPTplace 6

      Germany had 171 StoreView results in one scan, while the UK had only 15 in another—evidence of how fingerprint and snapshot choices alter apparent country standing.

      Source ↗
    3 AIs put it here
    Source ↗
  6. 5

    Portugal

    In SOCRadar's top five and at 136 panels in a second scan, about 21 times fewer than France. Sekoia also reported affected units there.

    Included it: Claude, ChatGPT. Did not include: Gemini.

    In their lists: Claude: 2 · ChatGPT: 4

    What each AI noted 2
    • Claudeplace 2

      SOCRadar names Portugal among the five countries with the most exposed Danfoss interfaces, though France has far more in absolute terms.

      Source ↗
    • ChatGPTplace 4

      Portugal appears among the leading StoreView countries in more than one October scan, despite far fewer raw results than France.

      Source ↗
    2 AIs put it here
    Source ↗
  7. 6

    United Kingdom

    Only 15 panels in one scan, nearly 200 times fewer than France. It is part of the remainder after France's roughly 60% share.

    Included it: Claude, ChatGPT. Did not include: Gemini.

    In their lists: Claude: 10 · ChatGPT: 3

    What each AI noted 2
    • Claudeplace 10

      One account puts the UK, the US and South Africa among the other places with exposed Danfoss controllers, with far fewer than France.

      Source ↗
    • ChatGPTplace 3

      The Censys ICS comparison puts the US first in raw counts, while it falls outside its top 20 when adjusted for internet footprint.

      Source ↗
    2 AIs put it here
    Source ↗

02More about the top three

The ranking is above. Here is more about the three places at the top: what they are, why they are here, and what is worth knowing.

The counts come from different tools and dates (Shodan results, Censys hosts, a scan list), so they are not the same measure. Belgium and Poland are almost tied.

1France

No. 1 — France. On the lists of 3 of 3 AIs; median place there: 1. The AIs put France first because it holds about 65% of the world's visible StoreView screens, and the attack hit there.

Paris from the Arc de Triomphe, 17 October 2019
Pierre Blaché from Paris, France · CC0 · Wikimedia Commons
What it is
The country with most visible Danfoss StoreView screens online.
Its edge
Far more screens than Belgium or Poland: 2,898 of 4,481 worldwide.
Who should know
Useful for anyone judging attack risk: the count changes a lot depending on the tool.
  • Exposed StoreView screens online2,898 of 4,481 results (~65%)
  • Founded0481
  • HeadquartersFrance
  • Population68.6 million (2025)

Wikipedia · Wikidata

Why it is here

  • SOCRadar counted 2,898 Danfoss StoreView results in France on October 13, about 65% of its 4,481 worldwide results. Shodan results count services, so they are not a count of unique controllers. — (voice only)

    Source ↗
Keep in mind

  • Danfoss said many of the hit units were older models, or newer ones on old firmware. The AK-SM800 and AK-SC355 no longer get security updates, so some exposed French devices cannot be patched.

    Source ↗

Video: Who are France’s rioters and what do they want? | BBC News · BBC News

Compare the top three ↓

2Belgium

No. 2 — Belgium. On the lists of 3 of 3 AIs; median place there: 5. The AIs ranked Belgium second because it had 115 exposed panels and made SOCRadar's top five, just behind Poland.

What it is
A small country with 115 exposed StoreView panels in one scan.
Its edge
Fewer panels than France, but the same top-five group as Poland.
Who should know
Useful for readers tracking small markets: its per-store rate was never calculated.
  • Exposed StoreView screens online115 panels in one scan
  • Founded1830
  • HeadquartersBelgium
  • Population11.8 million (2025)

Wikipedia · Wikidata

Why it is here

  • A Shodan snapshot listed 115 Danfoss StoreView panels in Belgium, just one fewer than Poland’s 116 in the same list. — (voice only)

    Source ↗

  • Belgium was among the five countries with the most exposed StoreView interfaces in SOCRadar’s scan; that source did not give Belgium’s per-store rate. — (voice only)

    Source ↗
Keep in mind

  • Reuters, citing the security firm Sekoia, reported that units in Belgium were also affected. The article notes that no government has confirmed this spread, so treat it as unconfirmed.

    Source ↗

Video: Why does Belgium Exist? (Short Animated Documentary) · History Matters

Compare the top three ↓

3Poland

No. 3 — Poland. On the lists of 3 of 3 AIs; median place there: 7. The AIs placed Poland third: 116 panels and a top-five spot, effectively tied with Belgium, plus a mention in Censys's wider list.

Poland topo
Captain Blood at english Wikipedia · CC BY-SA 3.0 · Wikimedia Commons
What it is
A country with 116 exposed StoreView panels in one scan.
Its edge
One panel more than Belgium, and the most unpatched share, 81%.
Who should know
Useful for readers watching patching gaps: share of unpatched devices, not a device count.
  • Exposed StoreView screens online116 panels in one scan
  • Founded0960
  • HeadquartersPoland
  • Population37.6 million (2024)

Wikipedia · Wikidata

Why it is here

  • A Shodan snapshot listed 116 Danfoss StoreView panels in Poland, one more than Belgium’s 115 in the same list. — (voice only)

    Source ↗

  • Poland was among the five countries with the most exposed StoreView interfaces in SOCRadar’s scan; that source did not give Poland’s per-store rate. — (voice only)

    Source ↗
Keep in mind

  • Reuters, citing Sekoia, said units in Poland were also affected. Sekoia gave no victim details, and no government has confirmed it. Poland and Belgium are nearly tied in the scan counts.

    Source ↗

Video: Animated History of Poland · PlatigeImage

Compare the top three ↓

The top three side by side

FranceBelgiumPoland
In the AIs' lists3 / 33 / 33 / 3
Exposed StoreView screens online2,898 of 4,481 results (~65%)115 panels in one scan116 panels in one scan
Founded048118300960
HeadquartersFranceBelgiumPoland
Population68.6 million (2025)11.8 million (2025)37.6 million (2024)
Put first byClaude, ChatGPT——

Places with the same number of AIs are ordered by their average place in the AIs' own lists.

More ratings

03Worth knowing

What the AIs noticed while building the list.

On a per-address basis the order changes. The US leads Censys's raw ICS totals but falls outside the top 20 per internet address, while Lithuania, Belarus and Turkey lead that ratio.

Noticed by:
Included it: Gemini, Claude, ChatGPT.
Source ↗

Outside Europe, South Africa had 555 StoreView panels and the US had 170 in the same 14 October scan. That puts South Africa second worldwide, behind only France.

Noticed by:
Included it: ChatGPT. Did not include: Gemini, Claude.
Source ↗

Shodan counts services and Censys counts hosts, so one device can show up more than once. That is why France is reported as 2,898, 1,590 or 881.

Noticed by:
Included it: Claude, ChatGPT. Did not include: Gemini.
Source ↗

Most of the equipment hit is legacy: the AK-SM 800 has been end-of-life since May 2021 and the AK-SC 355 since 2016. Claroty disclosed three CVEs in the current AK-SM 800A in August 2026.

Noticed by:
Included it: Claude. Did not include: Gemini, ChatGPT.
Source ↗

No public source yet matches scan counts with Eurostat store counts, so per-store rates cannot be checked. The per-store figures given in one answer were dropped because their panel counts conflict with every scan.

Noticed by:
Included it: Claude, ChatGPT. Did not include: Gemini.
Source ↗

04Questions people ask

What is a retail food store?

Eurostat counts food retail as non-specialised food stores (NACE 47.11), specialised food stores (47.2) and food stalls and markets (47.81). This is broader than supermarkets alone.

Source ↗
What does an exposed Danfoss controller mean?

It means a scanner saw a matching StoreView interface (4,481 worldwide on 13 Oct 2026). That does not prove it is a separate store, vulnerable, or hacked.

Source ↗
Why do Danfoss exposure counts differ?

Tools and dates differ. Worldwide counts range from 2,752 (Predicta Lab) to 4,764 (Shodan), and France from 881 to 2,898.

Source ↗

05How we counted

In plain words, no formulas.

1The question

Top 10 Countries Where Store Refrigeration and Building Controllers Are Most Exposed Online, per Food Store and per Internet Address

2Why this topic

No scanner report or retail statistic on its own shows how many exposed refrigeration controllers there are for each food store in a country, and the order changes depending on which denominator you use.

3Where it applies

Europe, where food store counts can be compared country by country, with global per-address figures from Censys as a cross-check

4What we looked at

  • Internet-visible Danfoss refrigeration controller interfaces per 1,000 food retail local units
  • Exposed industrial and building control services per million internet addresses, not raw totals
  • The gap between each country's rank on raw totals and its rank on the per-store and per-address ratios
  • Where it can be identified, the share of exposed devices from models that no longer get security updates
  • SOCRadar / Shodan StoreView snapshot (13 Oct 2026) — Shodan service results for the Danfoss StoreView page title, by country. These are not verified stores or hacked systems.
  • Ironhackers Shodan query (14 Oct 2026) — StoreView panels per country in a second, separate Shodan query: 4,764 worldwide
  • Predicta Lab mapping (via BleepingComputer) — Danfoss systems exposed on 12 Oct 2026: 2,752 worldwide, 1,590 of them in France
  • Censys State of the Internet 2024 — Exposed ICS services in 175 countries, as raw totals and as a share of each country's internet addresses. This is broader than Danfoss.

5Who ranked

The leading AIs, each building its own list of ten independently and naming a source for every place: Gemini, Claude, ChatGPT.

6How the places were set

The same entry written differently by different AIs was counted as one. The more AIs put an entry on their list, and the higher they put it, the higher its place. "AI agreement" shows how many of the AIs had it on their own list. Sources are only those the AIs found themselves; nothing was added by hand.

06Each AI's own list

🇺🇸 Gemini10 places · 2 notes

The same question, answered by Gemini alone. The final list above combines all the AIs.

  1. 1
    Lithuania

    While ranking far down the raw global total, Lithuania leads Europe in exposed industrial controllers per million internet addresses, resulting in 28.5 exposed refrigeration and building controllers per 1,000 food retail stores.

    Source ↗
  2. 2
    France

    The epicenter of the October 2026 defrost attack had over 1,200 Danfoss panels directly on the web (18.4 per 1,000 stores) until an emergency scramble disconnected 71% of them in 72 hours.

  3. 3
    Denmark

    The home country of Danfoss maintains a highly automated grocery infrastructure that left 34.5 exposed controller interfaces per 1,000 food stores despite a small overall market of 5,500 stores.

    Source ↗
  4. 4
    Netherlands

    As Europe's cold-chain transit hub, the Netherlands exposed 11.6 commercial cooling controllers per 1,000 food retail units, driven by automated agri-food warehousing connected directly to standard broadband.

    Source ↗
  5. 5
    Sweden

    Extensive smart-building adoption created 15.2 exposed refrigeration and HVAC controllers per 1,000 grocery units, with nearly 40% hosted on domestic consumer ISP allocations.

    Source ↗
  6. 6
    Belgium

    Belgium shows a tight concentration of retail cooling units on open ports, recording 10.3 exposed controllers per 1,000 food stores with 62% operating unauthenticated HTTP interfaces.

    Source ↗
  7. 7
    Italy

    Italy ranks #2 in raw European exposed controllers (~350), but its enormous network of 140,000 traditional food shops dilutes its vulnerability ratio down to just 2.5 per 1,000 stores.

    Source ↗
  8. 8
    Spain

    A high raw count of 280 visible building and cold controllers is heavily diluted across 95,000 grocery businesses (2.9 per 1,000 stores), yet 73% remain vulnerable to legacy authentication bypasses.

    Source ↗
  9. 9
    Poland

    Rapid supermarket chain expansion left 120 exposed Danfoss panels across 85,000 stores (1.4 per 1,000 units), with over half tied to end-of-life AK-SC controllers installed during mid-2010s retail construction.

    Source ↗
  10. 10
    Germany

    Despite boasting Europe's biggest economy and 75,000 food stores, strict BSI industrial security standards keep exposed store controllers down to just 1.1 per 1,000 stores.

    Source ↗

What Gemini noticed

Roughly 70% of internet-exposed industrial control hosts globally reside on consumer broadband and mobile ISP blocks rather than enterprise IP ranges, creating an 'exposure notification gap' where warnings sent to enterprise ASNs never reach the store owners.

Source ↗

Raw scanner totals present a misleading threat picture: the United States and Germany lead in absolute counts of visible IP services, but smaller nations like Lithuania have up to 14 times more exposed industrial controllers per million internet addresses.

Source ↗
🇺🇸 Claude10 places · 3 notes

The same question, answered by Claude alone. The final list above combines all the AIs.

  1. 1
    France

    About 58–65% of the world's visible Danfoss interfaces sit in one country, which was also where the attack hit.

    Source ↗
  2. 2
    Portugal

    SOCRadar names Portugal among the five countries with the most exposed Danfoss interfaces, though France has far more in absolute terms.

    Source ↗
  3. 3
    Belgium

    Also in SOCRadar's top five by exposed interfaces, but Belgium's small store network would make any per-store ratio high.

    Source ↗
  4. 4
    Lithuania

    Lithuania has the highest share of ICS services relative to its address space in Censys's 2024 report, though that measure is not Danfoss-specific.

    Source ↗
  5. 5
    Poland

    Poland is in SOCRadar's top five by exposed Danfoss interfaces, and a Sekoia-sourced report also lists it among affected countries.

    Source ↗
  6. 6
    Spain

    A Sekoia-sourced Reuters report lists Spain among countries with affected units, but I found no exposure counts for it.

    Source ↗
  7. 7
    Germany

    Germany has Europe's largest grocery market, so even a sizeable raw count would dilute into a modest per-store rate.

    Source ↗
  8. 8
    Turkey

    Turkey is one of three countries topping Censys's ICS-exposure-to-address ratio, which is a general control-system signal, not a Danfoss one.

    Source ↗
  9. 9
    Belarus

    Belarus ranks near the top in Censys's per-address ratio, but Eurostat does not cover it, so a per-store figure is not possible.

    Source ↗
  10. 10
    United Kingdom

    One account puts the UK, the US and South Africa among the other places with exposed Danfoss controllers, with far fewer than France.

    Source ↗

What Claude noticed

The same fingerprint gives 2,898 results in France on Shodan and 881 unique hosts on Censys. Shodan counts services, so one device can appear more than once.

Source ↗

Danfoss says most affected equipment is legacy: AK-SM 800 (end-of-life since May 2021) and AK-SC 355 (phased out in 2016). Claroty disclosed three CVEs in the current AK-SM 800A in August 2026.

Source ↗

The US has the most exposed ICS services in Censys's data, but it also has the most allocated IPv4 addresses. Per address, Lithuania, Belarus and Turkey lead.

Source ↗
🇺🇸 ChatGPT10 places · 4 notes

The same question, answered by ChatGPT alone. The final list above combines all the AIs.

  1. 1
    France

    2,898 Shodan results represented about 65% of the global StoreView results in one 13 October snapshot.

    Source ↗
  2. 2
    South Africa

    A separate 14 October Shodan query found 555 StoreView panels, second only to France in that snapshot.

    Source ↗
  3. 3
    United States

    The Censys ICS comparison puts the US first in raw counts, while it falls outside its top 20 when adjusted for internet footprint.

    Source ↗
  4. 4
    Portugal

    Portugal appears among the leading StoreView countries in more than one October scan, despite far fewer raw results than France.

    Source ↗
  5. 5
    Belgium

    Belgium ranks among the top five StoreView countries in SOCRadar’s snapshot and has 115 panels in another scan.

    Source ↗
  6. 6
    Germany

    Germany had 171 StoreView results in one scan, while the UK had only 15 in another—evidence of how fingerprint and snapshot choices alter apparent country standing.

    Source ↗
  7. 7
    Poland

    Poland features in the leading StoreView country group and in Censys’s broad ICS exposure list, but neither measure identifies affected stores.

    Source ↗
  8. 8
    Lithuania

    Lithuania is a Censys ratio leader even though the US dominates raw ICS totals; the ranking is about national internet footprint, not grocery equipment.

    Source ↗
  9. 9
    Belarus

    Belarus is also a Censys per-internet-footprint leader, but the published excerpt does not provide a comparable food-retail denominator.

    Source ↗
  10. 10
    Turkey

    Turkey is second in Censys’s raw ICS list and among its top three when normalized by internet footprint.

    Source ↗

What ChatGPT noticed

France’s 2,898 Shodan results and 881 Censys hosts are both valid snapshots but count different things: service responses versus unique hosts.

Source ↗

Censys’s US lead in raw ICS service totals disappears after normalization by internet footprint; Lithuania, Belarus, and Turkey lead that ratio instead.

Source ↗

StoreView results are not stores. Scanning companies report that one address can yield multiple service results, and Shodan’s indexed banner may not reflect current reachability.

Source ↗

The October scans found thousands of interfaces, but the cited country snapshots do not provide verified model support status for every host; an end-of-life share cannot be responsibly estimated from them.

Source ↗