> ## Content Index
> Fetch the complete content index at: https://thecoverwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Coalition found 1,506 exposed fridge panels before French store attack
- URL: https://thecoverwire.com/danfoss-storeview-panels-exposed-coalition-scan/
- Published: 2026-10-30T14:19:14.000Z
- Updated: 2026-11-02T11:36:06.000Z
- Description: The cyber insurer says its external scan, used to alert policyholders, does not show the devices were compromised or belonged to the stores hit.
- Author: CoverWire
- Tags: Cyber, #desk-risk

Cyber insurer Coalition, which scans the internet for exposed devices so it can alert policyholders, found 1,506 internet addresses exposing Danfoss StoreView refrigeration panels in the weeks before an attack disrupted several hundred French supermarkets, [according to commentary](https://insurance-edge.net/2026/10/16/cyber-before-the-fridges-heated-up-warning-signs-were-visible/?ref=thecoverwire.com) by Tiago Henriques, its chief underwriting officer, published on 16 October. The insurer said the scan does not show that any of those devices were compromised or that they belonged to the stores that were hit.

Of those addresses, 820, or 54%, were associated with French networks. Attackers remotely manipulated industrial systems used to maintain the cold chain overnight between 11 and 12 October, [leaving retailers facing a gap between cyber and property cover](https://thecoverwire.com/french-supermarket-fridge-hack-cyber-insurance-gap/).

Exposure is not the same as vulnerability. Claroty's Team82 had published research in August on web-accessible administration panels in Danfoss AK-SM 800A refrigeration controllers. The flaws included a hidden authentication mechanism, tracked as CVE-2025-41450, and command injection, tracked as CVE-2025-41451\. Danfoss released firmware update R4.3.1 to fix them.

Coalition scanned from 7 September to 6 October. Among the addresses associated with France, 89% served an interface built before 2026, which the insurer described as "an indicator of potential obsolescence, rather than a definitive confirmation of the production version".

Its wider count found at least 2,624 refrigeration controllers from named brands with a login page open to the internet: 1,506 Danfoss StoreView panels and 1,119 XWEB panels, with one address running both.

The scans were strictly external, with no intrusion tests or authentication attempts. "These findings establish neither prior compromise of these specific devices nor that the identified addresses belong to the affected stores," the insurer said. The attackers' initial route remains unconfirmed.

Brokers told Reuters that cyber policies typically do not cover physical losses such as those from the attack, [insurewire reported](https://insurewire.org/articles/french-supermarket-fridge-hack-cyber-cover/?ref=thecoverwire.com).

Henriques said "an unpatched device featuring a web-accessible admin panel can act as a major entry point".

*Update, 2 November 2026: the opening was revised to set out Coalition's role as an insurer and the limits of its scan earlier in the story.*

Related coverage: [French supermarket fridge hack leaves retailers facing a cover gap](https://thecoverwire.com/french-supermarket-fridge-hack-cyber-insurance-gap/); [Coalition says AI phishing kits drove a 30% rise in email fraud claims](https://thecoverwire.com/coalition-ai-phishing-kits-bec-claims-rise/).

## Sources

- [Insurance Edge, Coalition commentary, 16 Oct 2026](https://insurance-edge.net/2026/10/16/cyber-before-the-fridges-heated-up-warning-signs-were-visible/?ref=thecoverwire.com)
- [The Register, 15 Oct 2026](https://www.theregister.com/security/2026/10/15/researchers-warned-attackers-could-defrost-the-food-months-before-french-supermarkets-got-hit/5303425?ref=thecoverwire.com)
- [insurewire](https://insurewire.org/articles/french-supermarket-fridge-hack-cyber-cover/?ref=thecoverwire.com)