Are the fridges ok?

News reviewed 2 Nov 2026Independent tracker · Sources linked throughout Our baseline counts each IP once, even when it exposes several StoreView services. Shodan-tagged honeypot records are excluded, but an IP with both tagged and untagged records can remain. IP addresses are a proxy for systems, not a count of physical fridges. Days since the last major attack—Latest wave: 2 November 2026Based on incident dates in news reports ↗ Baseline · distinct IP addresses—*Indexed StoreView IPs · tagged service records excludedLoading measurement…Loading total including tagged honeypots… Daily monitoringOne IP.Many fridges.One public IP can front several controllers, and each controller can manage many fridges. Exposure alone does not prove compromise.What we're measuring ↗ 01 / Exposure over timeStill out in the open. Historical service totals before IP deduplication and honeypot filtering. These use a different unit from the distinct-IP baseline above; they do not count compromised fridges. Daily collection Published snapshot These totals include tagged honeypots. Historical sources did not provide a honeypot breakdown. Published observations may use different search details and collection times.

Gaps are unmeasured; points are not interpolated.

Daily inferred firmware mix across indexed Danfoss StoreView services worldwide.

This chart is weighted by services, so one IP can contribute multiple ports; the headline baseline counts distinct IPs. These daily versions come from cached headers. Exclude Shodan-tagged honeypots Loading firmware observations… —share inferred as 4.3.1 or 5.x—matching services in this view—services tagged as honeypots A rising share of newer versions can reflect upgrades, older systems going offline, new arrivals, or changes in Shodan's index. This chart does not follow individual devices or prove upgrades. Multiple ports can still inflate counts, and untagged honeypots may remain. Latest version breakdown & methodology Latest inferred firmware distributionInferred firmwareServicesShare Exact cached Last-Modified fingerprints are matched to the firmware-build timestamps published by Censys. Shared fingerprints remain ambiguous; unmatched banners remain unknown. The chart uses the same StoreView query as the headline count, with an optional honeypot exclusion. Newer StoreView Web titles were present in this query during our baseline census; this is still not a complete inventory of all Danfoss products. Counts are collected from Shodan's existing index, not from a live vulnerability test. The queries run sequentially and are not a single atomic snapshot. The headline uses a separate distinct-IP snapshot; this chart counts services. Exposure and firmware totals may differ because Shodan answers those API requests separately. The collector rejects changing population totals or inconsistent sums and preserves the last valid observation. “4.3.1 or 5.x” is a version grouping, not an assurance that equipment is secure.

The problem predates 2026. Danfoss also documented attacks on supermarket refrigeration in Russia and Israel in 2022.

Danfoss newsletter, page 9 ↗ 04 / Read the fine printCold facts.Clear limitations.A quiet news cycle is not an all-clear.

What does “No” mean?This is an editorial assessment of the reported attacks and continuing exposure, not a live test of every fridge. It does not automatically turn to “Yes” after a quiet stretch. What resets the counter?A reviewed, substantial attack wave that disrupts refrigeration at multiple sites. We use the incident date, not the date of a later article. Suspected incidents are labeled; a new headline about an old incident does not reset the clock.

Days use UTC calendar dates.

What does the Shodan number measure?The prominent baseline counts distinct IP addresses with at least one matching service not tagged by Shodan as a honeypot; the small-print totals include tagged service records. An IP with both tagged and untagged records remains eligible. The exposure history retains unfiltered historical totals, while the firmware chart excludes tagged honeypots by default.

All counts are matching internet service banners, worldwide, for http.title:"Danfoss StoreView".

It is a narrow fingerprint, not all Danfoss products. Multiple ports can inflate the total; one controller can serve many fridges. Shodan's index also lags real-world changes. Download distinct-IP history ↗ · API methodology ↗ What did the one-off landing-page measurement find?On 3 November 2026, a separately authorized active measurement made one ordinary unauthenticated request to / at one cached endpoint for each of 2,050 eligible IPs. It recognized 212 StoreView landing pages; 1,409 requests timed out and 332 had TLS failures. The remaining 97 produced other pages, responses or errors. Another 51 IPs had no eligible cached endpoint. There were no retries, redirect following, logins, scripts or controller changes.This is a conservative observation, not a complete live-device count: timeouts and TLS failures do not establish that equipment is offline. Among recognized pages, 205 retained the cached firmware inference and seven differed or became unknown; this does not establish seven upgrades. Visible UI versions are not controller firmware. A later code audit reproduced an undercount risk: the original reader could receive a valid title, then time out waiting for more body data. The number of affected timeouts cannot be recovered, so 212 is only the number recognized by that checker. The checker has since been corrected and tested locally; this measurement has not been rerun.A later cached Shodan query found 106 IPs with honeypot-tagged StoreView records. The original filter excluded tagged records, rather than every IP with any tagged record. The overlap between those IPs and the 212 recognized pages is unknown because no IP-to-outcome linkage was retained. Download the cached honeypot audit ↗.

Only aggregate results are retained.

Daily updates continue to use cached Shodan data; this active measurement is not scheduled. Download the aggregate report ↗ How does this stay up to date?GitHub Actions requests aggregate Shodan IP, service and firmware counts daily at 11:17 UTC and saves their dated history. News is reviewed separately each day by a scheduled Codex task; its last completed review is shown above. Failed collections preserve prior data and show its age. Historical published snapshots remain separate from our own samples. How can operators reduce exposure?Follow the manufacturer's and your national CERT's guidance: restrict access to management interfaces, use protected remote access, and apply supported updates. Internet exposure does not by itself identify an exploited vulnerability.

Read CERT-FR's advisory ↗