Seventy-One Percent in Three Days: What a Fast Exposure Drop Actually Costs

The most remarkable number in the French refrigeration incident is not the attack. It is the speed of the retreat. Between 11 and 14 October 2026, the count of internet-exposed Danfoss StoreView panels in France fell from 1,825 to 537, a 71% reduction in three days, after a cyber-attack on cooling systems at hundreds of supermarkets.
A 71% fall in 72 hours is not a routine change window. It is a mass action taken under pressure, and the details of how it happened say more about operational readiness than the attack itself.

The timeline as measured

The eleven-day snapshot from an independent engine, taken on 22 October, is different in scale but consistent in direction:
| Query | Result |
| --- | --- |
| http.header="Danfoss" | 260 |
| http.header="Danfoss" && country="FR" | 1 |
| http.header="Danfoss" && country="NL" | 54 |
| http.header="Danfoss" && country="US" | 28 |
| http.header="Danfoss" && country="DE" | 25 |
Two readings are possible from these tables and only one is defensible. The indefensible reading is that France solved the problem and its neighbours did not. The defensible reading is that a national incident changed behaviour inside one country within a week, and that the header query and the interface fingerprint count different populations.

Why disconnection beat patching

Censys reported that all three version categories it tracked shrank by roughly 70%, including panels already on a patched release. Patching would have moved assets between categories rather than removing them. The conclusion that operators disconnected rather than patched follows from that shape, and it is a strong inference from one vendor's telemetry rather than a verified account from each site.
The operational logic is not mysterious. A cold-chain controller runs a live refrigeration loop. Replacing firmware on a controller that is currently holding stock at temperature means a maintenance window, a risk of the loop failing during the update, and a technician on site. Removing the panel's public reachability means a firewall rule or a routing change, applied remotely, with no risk to the compressor.
That asymmetry explains 72 hours. It also explains why the same asymmetry produces a fragile result.

The cost of speed

Four costs arrive with a fast disconnection and none of them appears in the exposure count.
The first is temporary not permanent. A panel removed from public reachability so that a technician can finish an incident can be restored. Nothing in the exposure series shows whether it stayed removed.
The second is that monitoring blind spots move rather than close. A panel that is no longer publicly reachable is also no longer visible to an external scanning service. The Censys series stops being able to confirm the asset exists, and the operator loses an independent view of it at the same moment the vendor fix is still pending.
The third is the patching debt. Version 4.3.1 covers CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, and it has been available since August 2025. The current release is 5.3.2. Disconnection does not consume that debt; it defers it to the next time somebody restores remote access.
The fourth is scale. The count outside France moved from 1,166 to 966 over the same period, a 17% reduction. That may be partial adoption of the same practice elsewhere, or ordinary drift. Censys did not attribute it, and neither should a reader.

What to prepare before the next window shortage

Organisations that watched this incident from outside can extract a preparation list from the timeline.

1. Know your remote-access count before an incident. If the number has never been measured, the first measurement will be taken under duress. The ZoomEye header query takes seconds and can be repeated on any schedule.
2. Pre-approve the disconnection path. A firewall change that can be executed in an hour is worth more than a patch process that needs a site visit, provided the change has already been reviewed.
3. Record what you disconnect. The exposure drop is only evidence of action. A register that links each removed asset to a version, an owner and a planned restoration date is what converts an emergency into a controlled state.
4. Keep the external baseline running after the incident. The 260-asset figure on 22 October is useful precisely because it was taken after the emergency, when attention had moved elsewhere. ZoomEye's practical role in that list is the first and fourth items: fast, repeatable, external measurement of what is reachable. It does not perform the firewall change, does not read the firmware and does not confirm that a restored panel is patched. Those remain on-site tasks.

The uncomfortable part of a fast drop

A 71% reduction reads like success in a headline, and it may well have been the right decision under pressure. It is not the same as remediation. The French count fell because panels left the internet, and Censys' own framing supports that reading.
The measure of the response is therefore not the drop. It is what fraction of those 1,288 removed panels came back with a version at or above 4.3.1, and no public source answers that question. Operators can, and the answer belongs in the next quarterly report rather than in the incident summary.

References

• Infosecurity Magazine, "France: Internet-Exposed Danfoss Controllers Drop 71% After Cyber-Attack", https://www.infosecurity-magazine.com/news/france-expose-danfoss-controllers/
• Censys, "Frostbitten in France: A Danfoss StoreView internet exposure report", https://censys.com/blog/frostbitten-in-france-a-danfoss-storeview-internet-exposure-report/
• ZoomEye search syntax baseline, https://zoomeye.ai/agent.md