Days since the last major attack
—
Latest wave: 2 November 2026
Based on incident dates in news reports ↗ A refrigeration security watch
Are the fridges ok?
No.
Supermarket refrigeration systems are still being hacked. Internet-exposed Danfoss controllers are part of the problem.
How we got hereCOLD CHAIN / OPEN CONNECTION
The internet is a bad place to leave the door open.
News reviewed 2 Nov 2026Independent tracker · Sources linked throughout
Some data could not be loaded. Please reload this page. Displayed fallback content was last reviewed on 2 November 2026.
Some indexed services are honeypots: decoys rather than working refrigeration controls. Our baseline excludes services Shodan flags as honeypots; untagged decoys may remain.
Baseline · tagged honeypots excluded
—*
Internet-exposed StoreView services · worldwide
Loading measurement…Loading total including tagged honeypots…
One controller.
Many fridges.
Shodan counts exposed services, not physical fridges. Exposure alone does not prove a device is vulnerable or hacked.
What we're measuring ↗01 / Exposure over time
Still out in the open.
Historical Shodan totals, including tagged honeypots. These unfiltered observations provide context for the filtered baseline above; they do not count compromised fridges.
Daily collection Published snapshot
These totals include tagged honeypots. Historical sources did not provide a honeypot breakdown. Published observations may use different search details and collection times. Gaps are unmeasured; points are not interpolated.
View observations & sources
| Observed | Services | Source | Type |
|---|
02 / Firmware over time
Is the exposed fleet getting newer?
Daily inferred firmware mix across internet-exposed Danfoss StoreView services worldwide. Versions come from cached HTTP headers; no controllers are contacted.
Loading firmware observations…
—share inferred as 4.3.1 or 5.x
—matching services in this view
—services tagged as honeypots
A rising share of newer versions can reflect upgrades, older systems going offline, new arrivals, or changes in Shodan's index. This chart does not follow individual devices or prove upgrades. Multiple ports can still inflate counts, and untagged honeypots may remain.
Latest version breakdown & methodology
| Inferred firmware | Services | Share |
|---|
Exact cached Last-Modified fingerprints are matched to the firmware-build timestamps published by Censys. Shared fingerprints remain ambiguous; unmatched banners remain unknown. The chart uses the same StoreView query as the headline count, with an optional honeypot exclusion. Newer StoreView Web titles were present in this query during our baseline census; this is still not a complete inventory of all Danfoss products.
Counts are collected from Shodan's existing index, not from a live vulnerability test. The queries run sequentially and are not a single atomic snapshot. The headline baseline and its small-print total use this same firmware snapshot. Unfiltered exposure-history totals may differ because Shodan answers those API requests separately. The collector rejects changing population totals or inconsistent sums and preserves the last valid observation. “4.3.1 or 5.x” is a version grouping, not an assurance that equipment is secure. Download full measurement history ↗
03 / The 2026 attacks
A pattern, not a one-off.
From suspected attacks at military bases to repeated disruption in European supermarkets.
The problem predates 2026. Danfoss also documented attacks on supermarket refrigeration in Russia and Israel in 2022. Danfoss newsletter, page 9 ↗
04 / Read the fine print
Cold facts.
Clear limitations.
A quiet news cycle is not an all-clear.
What does “No” mean?
This is an editorial assessment of the reported attacks and continuing exposure, not a live test of every fridge. It does not automatically turn to “Yes” after a quiet stretch.
What resets the counter?
A reviewed, substantial attack wave that disrupts refrigeration at multiple sites. We use the incident date, not the date of a later article. Suspected incidents are labeled; a new headline about an old incident does not reset the clock. Days use UTC calendar dates.
What does the Shodan number measure?
The prominent baseline excludes services tagged by Shodan as honeypots; the small-print total includes them. The exposure history retains unfiltered historical totals, while the firmware chart excludes tagged honeypots by default. All counts are matching internet service banners, worldwide, for http.title:"Danfoss StoreView". It is a narrow fingerprint, not all Danfoss products. Multiple ports can inflate the total; one controller can serve many fridges. Shodan's index also lags real-world changes. API methodology ↗
How does this stay up to date?
GitHub Actions requests aggregate Shodan exposure and firmware counts daily at 11:17 UTC and saves their dated history. News is reviewed separately each day by a scheduled Codex task; its last completed review is shown above. Failed collections preserve prior data and show its age. Historical published snapshots remain separate from our own samples.
How can operators reduce exposure?
Follow the manufacturer's and your national CERT's guidance: restrict access to management interfaces, use protected remote access, and apply supported updates. Internet exposure does not by itself identify an exploited vulnerability. Read CERT-FR's advisory ↗