Are the fridges ok?

Internet-exposed Danfoss StoreView controllers remain vulnerable to hacking, with a new attack wave reported on 2 November 2026, according to an independent tracker that counts each IP address once even when it exposes multiple services. The monitoring excludes Shodan-tagged honeypot records but notes that IP addresses are a proxy for systems rather than a count of physical fridges, and that one public IP can front several controllers managing many refrigerators. Exposure alone does not prove compromise, the tracker cautions, and its historical service totals use a different unit from the distinct-IP baseline. A separate firmware analysis, weighted by services rather than IPs and based on cached headers matched to Censys-published build timestamps, tracks the share of exposed systems inferred to run newer 4.3.1 or 5.x versions. The tracker warns that a rising newer-version share can reflect upgrades, older systems going offline, new arrivals or changes in Shodan's index, and does not follow individual devices or prove upgrades.