A refrigeration safety watch
No.
Supermarket refrigeration systems are motionless being hacked. Internet-exposed Danfoss controllers are part of the problem.
COLD CHAIN / OPEN CONNECTION
The net is a bad location to depart the entrance open.
News reviewed 2 Nov 2026Independent tracker · Sources connected throughout
Our baseline counts all IP once, equal whenever it exposes multiple StoreView services. Shodan-tagged honeypot records are excluded, but an IP alongside the two tagged and untagged records can remain. IP addresses are a proxy for systems, not a figure of bodily fridges.
Days since the final important attack
—
Latest wave: 2 November 2026
Based on event dates in news reports ↗Baseline · distinct IP addresses
Indexed StoreView IPs · tagged assistance records excluded
Loading measurement…Loading total including tagged honeypots…
Daily monitoringOne IP.
Many fridges.
One community IP can forefront multiple controllers, and all controller can oversee many fridges. Exposure solitary does not demonstrate compromise.
What we're measuring ↗01 / Exposure complete time
Still out in the open.
Historical assistance totals before IP deduplication and honeypot filtering. These use a distinct component from the distinct-IP baseline above; they do not figure compromised fridges.
Daily gathering Published snapshot
These totals contain tagged honeypots. Historical sources did not provision a honeypot breakdown. Published observations may use distinct hunt particulars and gathering times. Gaps are unmeasured; points are not interpolated.
View observations & sources| Observed | Services | Source | Type |
|---|
02 / Firmware complete time
Is the exposed fleet getting newer?
Daily inferred firmware mix throughout indexed Danfoss StoreView services worldwide. This diagram is valued by services, so one IP can contribute multiple ports; the header baseline counts distinct IPs. These regular versions arrive from cached headers.
Exclude Shodan-tagged honeypots
Loading firmware observations…
—share inferred as 4.3.1 or 5.x
—matching services in this view
—services tagged as honeypots
A rising portion of newer versions can indicate upgrades, older systems going offline, new arrivals, or changes in Shodan's index. This diagram does not prosecute idiosyncratic devices or demonstrate upgrades. Multiple ports can motionless inflate counts, and untagged honeypots may remain.
Latest type breakdown & methodology| Inferred firmware | Services | Share |
|---|
Exact cached Last-Modified fingerprints are matched to the firmware-build timestamps published by Censys. Shared fingerprints remain ambiguous; unmatched banners remain unknown. The diagram uses the identical StoreView query as the header count, alongside an optional honeypot exclusion. Newer StoreView Web titles were current in this query during our baseline census; this is motionless not a complete inventory of all Danfoss products.
Counts are collected from Shodan's existing index, not from a live exposure test. The queries run sequentially and are not a sole nuclear snapshot. The header uses a distinct distinct-IP snapshot; this diagram counts services. Exposure and firmware totals may differ since Shodan answers those API requests separately. The collector rejects changing community totals or inconsistent sums and preserves the final valid observation. “4.3.1 or 5.x” is a type grouping, not an assurance that equipment is secure. Download complete measure former ↗
03 / The 2026 attacks
A pattern, not a one-off.
AUGUST → NOVEMBER 2026
From suspected attacks at armed forces bases to repeated disruption in European supermarkets.
The issue predates 2026. Danfoss additionally documented attacks on supermarket refrigeration in Russia and Israel in 2022. Danfoss newsletter, leaf 9 ↗
04 / Read the fine print
Cold facts.
Clear limitations.
A quiescent news sequence is not an all-clear.
This is an editorial appraisal of the reported attacks and continuing exposure, not a live test of all fridge. It does not automatically rotate to “Yes” following a quiescent stretch.
What resets the counter?A reviewed, significant assault motion that disrupts refrigeration at multiple sites. We use the event date, not the date of a afterward article. Suspected incidents are labeled; a new header concerning an old event does not reset the clock. Days use UTC calendar dates.
What does the Shodan figure measure?The notable baseline counts distinct IP addresses alongside at smallest one matching assistance not tagged by Shodan as a honeypot; the small-print totals contain tagged assistance records. An IP alongside the two tagged and untagged records remains eligible. The visibility former retains unfiltered historic totals, during the firmware diagram excludes tagged honeypots by default. All counts are matching net assistance banners, worldwide, for http.title:"Danfoss StoreView". It is a narrow fingerprint, not all Danfoss products. Multiple ports can inflate the total; one controller can assist many fridges. Shodan's indicator additionally lags real-world changes. Download distinct-IP former ↗ · API methodology ↗
What did the one-off landing-page measure find?On 3 November 2026, a separately authorized energetic measure made one average unauthenticated petition to / at one cached endpoint for all of 2,050 eligible IPs. It recognized 212 StoreView landing pages; 1,409 requests timed out and 332 had TLS failures. The remaining 97 produced another pages, responses or errors. Another 51 IPs had no eligible cached endpoint. There were no retries, redirect following, logins, scripts or controller changes.
This is a traditional observation, not a complete live-device count: timeouts and TLS failures do not established that equipment is offline. Among recognized pages, 205 retained the cached firmware conclusion and seven differed or became unknown; this does not established seven upgrades. Visible UI versions are not controller firmware. A afterward code audit reproduced an undercount risk: the first audience could obtain a valid title, afterward period out waiting for additional build data. The figure of affected timeouts cannot be recovered, so 212 is lone the figure recognized by that checker. The checker has since been corrected and tested locally; this measure has not been rerun.
A afterward cached Shodan query established 106 IPs alongside honeypot-tagged StoreView records. The first display excluded tagged records, fairly than all IP alongside any tagged record. The overlap between those IPs and the 212 recognized pages is unidentified since no IP-to-outcome linkage was retained. Download the cached honeypot audit ↗. Only total results are retained. Daily updates continue to use cached Shodan data; this energetic measure is not scheduled. Download the total study ↗
How does this remain up to date?GitHub Actions requests total Shodan IP, assistance and firmware counts regular at 11:17 UTC and saves their dated history. News is reviewed separately all day by a scheduled Codex task; its final completed assessment is shown above. Failed collections maintain previous data and display its age. Historical published snapshots remain distinct from our own samples.
How can operators decrease exposure?Follow the manufacturer's and your national CERT's guidance: restrict admission to administration interfaces, use protected distant access, and use supported updates. Internet visibility does not by itself acknowledge an exploited vulnerability. Read CERT-FR's advisory ↗
.png)
