Unit 42 found more than 5,000 internet-exposed devices from manufacturers named in a French refrigeration security alert during November 5–6. Its new analysis provides an exposure baseline for defenders, with an explicit caveat: those devices have not all been shown to run vulnerable software.
The November 6 report also records a decline in observed French exposure, from 1,853 devices during October 1–15 to 316 during November 1–6. These are measurements of reachable equipment, rather than a count of confirmed attacks or affected shops. They extend DaySec’s earlier coverage of the European supermarket disruptions with a newer exposure snapshot.
Read exposure figures within their scope
Unit 42 says the initial access route for the reported refrigeration attacks remains unconfirmed. It also treats responsibility claims by NoName057(16) and Z-Pentest as unverified. Neither the exposure figures nor those claims establish a single explanation for every incident.
A separate November 5 Censys study counted 3,124 distinct exposed hosts across two advisory product families, down from 6,695 on October 9. Censys says its measurements cannot explain why devices disappeared from the public internet. Provider intervention and owners disconnecting equipment are possible explanations, rather than demonstrated causes.
The two studies use different descriptions of their measured populations and observation periods. Their totals should remain attached to those definitions. Combining them into a single incident count would erase the distinction between an externally visible interface, a vulnerable installation and a system known to have been altered.
Close public management paths and check settings
The underlying CERT-FR alert, first issued October 12 and updated October 16, reports numerous compromises involving Danfoss AK-SM and AK-SC controllers and Copeland/Dixell XWEB systems. This is direct official reporting of compromise, separate from the later internet-exposure surveys.
CERT-FR recommends removing public internet exposure and checking the complete configuration, especially defrost schedules. Access should return through a secure VPN or protected network. Manufacturer hardening guidance includes firmware updates and changing default passwords; emergency source-IP filtering is described as a temporary measure.
Operational coordination matters when disconnecting these systems. The agency advises checking insurance contractual conditions before interrupting internet telemetry to refrigeration service providers. It also warns that a factory reset alone is insufficient for an exposed, unpatched end-of-life device: the vulnerability can permit another compromise.
Image: AI-generated editorial illustration created for DaySec.
