Two supermarkets in Alsace reported combined losses of €270,000. Multiply that across the roughly 700 French stores named by the finance minister and the question of who pays becomes larger than the technical response.
Security teams are increasingly asked to supply evidence for those conversations. What was known, when, and what was done.

What good evidence looks like

A defensible record has four properties. It is timestamped, reproducible, attributable to a named query, and separated from interpretation.
A query result is a fact: on 21 October 2026, title="StoreView Web" returned 271 matching assets. A statement such as "our estate was safe" is an interpretation and needs separate support.

Building the record during an incident

Capture the state before remediation. If controllers are pulled offline first, the original exposure may be unrecoverable.

  • export the query string, count and timestamp for each measurement

  • keep the internal asset list as it stood on the day

  • log the containment action and its time per site

  • preserve controller logs before any factory reset, since CERT-FR notes a reset does not remove risk and does remove history

Why timing matters

CERT-FR's alert went out on 12 October and was widened on 13 October. Censys measured nearly 3,000 exposed panels on 11 October and 537 in France on 14 October. A retailer that can show it acted on 12 October is in a different position from one that cannot show when it acted at all.

The measurement is not the proof

An external count cannot demonstrate that a specific store was vulnerable or that it was not. It shows the population. Attribution of any individual compromise, as investigators have noted, remains unsettled; Reuters reported no claim of responsibility and no ransom demand at the time.
Treat measurements as one exhibit among several, and never as a substitute for the controller's own logs.

References

  • Censys, Danfoss StoreView exposure report: https://censys.com/blog/frostbitten-in-france-a-danfoss-storeview-internet-exposure-report/

  • CERT-FR alert CERTFR-2026-ALE-012: https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012/

  • Reuters, investigators find no claim of responsibility: https://www.reuters.com/legal/litigation/investigators-hunt-french-supermarket-fridge-hackers-no-claim-responsibility-2026-10-13/

  • ZoomEye query executed 21 October 2026.