Danfoss end-of-life controllers exposed without VPNs enabled remote access across 5 EU countries

The incident began when attackers reached internet-facing Danfoss controllers at supermarket sites. Affected operators had left the devices on public IP space, used default or known credentials, and omitted VPN or IP allow-list controls. Pen Test Partners stated that standard network segmentation and patching would have blocked the entry vector entirely. Claroty researchers had published identical exposure findings on similar building-automation controllers in October 2025.

CISA’s February advisory documented the same class of remote-access failures in industrial control devices and listed default-credential exploitation as the dominant initial vector. No CVE has been assigned to the specific discontinued Danfoss generation because the firmware branch reached end-of-life status prior to disclosure. Fire-starting sequences observed in store logs match actuator commands issued after credential reuse rather than sophisticated zero-day exploitation.

Financial pressure to defer replacement of working controllers explains the continued presence of unsupported units. Post-incident remediation now requires documented ownership of every third-party device, mandatory VPN termination, and replacement timelines measured in months rather than years. Operators that treat refrigeration controls as ordinary IT endpoints repeat the identical exposure pattern seen in prior building-management incidents.

Retailers in the remaining EU member states face identical exposure until they complete inventory and network isolation of all legacy controllers; no regulatory filing yet mandates public disclosure of affected sites.