Recent incidents reported on November 2, 2026, underscore the ongoing cyber threats directed at commercial refrigeration infrastructure. Internet scanning data from Shodan confirms that Danfoss StoreView services are still reachable online, though internet visibility represents potential exposure rather than confirmed compromise. Tracking relies on cached headers and build timestamps from Censys to monitor firmware versions like the 4.3.1 or 5.x groupings. However, changes in version distribution do not verify individual device upgrades, and quiet periods do not signal an all-clear.
Key points
Visibility on the public internet indicates exposed surface area rather than confirmed sy…: Visibility on the public internet indicates exposed surface area rather than confirmed system compromise.
Tracked device totals exclude tagged honeypots where possible to maintain an accurate dis…: Tracked device totals exclude tagged honeypots where possible to maintain an accurate distinct-IP baseline.
Shifts in firmware version shares do not verify individual upgrades or guarantee that sys…: Shifts in firmware version shares do not verify individual upgrades or guarantee that systems are secure.
Sources checked by our analysis pipeline: 1
Latest wave: 2 November 2026
Based on incident dates in news reports ↗Are the fridges ok?
Supermarket refrigeration systems are still being hacked. Internet-exposed Danfoss controllers are part of the problem.
How we got hereOur baseline counts each IP once, even when it exposes several StoreView services. Shodan-tagged honeypot records are excluded, but an IP with both tagged and untagged records can remain. IP addresses are a proxy for systems, not a count of physical fridges.
Indexed StoreView IPs · tagged service records excluded
Loading measurement…Loading total including tagged honeypots…
One IP.
Many fridges.
One public IP can front several controllers, and each controller can manage many fridges. Exposure alone does not prove compromise.
What we're measuring ↗Still out in the open.
Historical service totals before IP deduplication and honeypot filtering. These use a different unit from the distinct-IP baseline above; they do not count compromised fridges.
These totals include tagged honeypots. Historical sources did not provide a honeypot breakdown. Published observations may use different search details and collection times. Gaps are unmeasured; points are not interpolated.
Scrutiny is mounting over the deployment of face-scanning tools across high-profile entertainment properties following reports detailing how patrons are tracked and categorized. The issue has prompted backing for local legislative measures that would prohibit the collection of biometric information in public areas throughout the city. This push aims to address ongoing privacy and civil liberty concerns stemming from corporate surveillance practices.
Grocery retailers across the continent are prioritizing critical infrastructure defense to prevent future disruptions to their operations. The response follows a coordinated cyber incident that directly compromised temperature-control systems across multiple facilities. Technical teams are currently focused on fortifying connected cooling networks against additional unauthorized tampering.
Digital asset security faces severe challenges from sophisticated social engineering efforts targeted at unsuspecting professionals. Cryptocurrency exchange Binance disclosed the findings, revealing how attackers leveraged trusted professional platforms and commercial outreach to compromise their targets. The operation highlights the extensive reach and massive financial toll inflicted by state-sponsored cyber operations on the digital finance ecosystem.