Some insights on the recent hacking attack in the Netherlands and France, from Tiago Henriques, Chief Underwriting Officer at Coalition;
Overnight between October 11 and 12, a cyberattack disrupted the refrigeration systems of several hundred supermarkets in France. Threat actors remotely manipulated industrial systems designed to maintain the cold chain, leading to immediate operational repercussions: food removed from shelves, notable financial losses, and emergency mobilization of teams to help limit the damage.
What makes this incident particularly striking is the timeline. These disruptions occurred two months after Claroty’s Team82 published their research in August 2026. Their work identified multiple vulnerabilities affecting the web-accessible admin panels embedded in Danfoss AK-SM 800A refrigeration controllers. The research notably revealed critical flaws, such as hidden authentication mechanisms (CVE-2025-41450) and command injection vulnerabilities (CVE-2025-41451), that can allow attackers to bypass standard authentication to execute code remotely. Following a coordinated disclosure, Danfoss released a firmware update (R4.3.1) designed to help mitigate the exploitation of these vulnerabilities.
Yet, despite the availability of these patches, Coalition’s scanning identified critical exposure to these threats continuing well into the fall. Between September 7 and October 6, 2026 – weeks after the vulnerabilities were disclosed and fixed – our sensors identified 1,506 unique IP addresses still publicly exposing a Danfoss StoreView web-accessible admin panel. Among them, 820 (or 54%) were associated with French networks. Of these, 89% serve a web interface built before 2026—an indicator of potential obsolescence, rather than a definitive confirmation of the production version. Our scans counted at least 2,624 refrigeration controllers from the named brands with a login page open to the internet: 1,506 Danfoss StoreView and 1,119 XWEB (one IP runs both types).
These findings establish neither prior compromise of these specific devices nor that the identified addresses belong to the affected stores. Our scanning process remains strictly external: it executed no intrusion tests nor attempted any authentication. The initial access vector for this attack remains unconfirmed at this time.
Nevertheless, an unpatched device featuring a web-accessible admin panel can act as a major entry point. When an exposed device is detected within a policyholder’s environment, this visibility aims to trigger a proactive alert. We empower organizations to restrict their remote access without delay, control their security configurations, and apply the necessary patches.
This approach is at the core of our Active Cyber Insurance methodology: observing the web with the same techniques used by cyber attackers. By cross-referencing exposed surface analysis with other signals, including actively exploited vulnerabilities, compromised credentials, or detections from our honeypots, we help businesses anticipate the most likely weaknesses to help prevent digital risk before an incident occurs.
For brokers and their clients, the takeaway is clear: digital risk extends far beyond workstations and email servers. Operational technologies (OT) and connected devices driving daily operations represent critical links that benefit from continuous monitoring. Identifying these exposed access points before they are targeted can directly contribute to preserving business continuity.
Coalition scan data collected from September 7 to October 6, 2026. HTTP response timestamps serve as an indirect indicator and do not substitute for a local verification of the firmware version.
Be the first to comment