Hacked fridges: three IP addresses account for 45% of the Shodan results we checked

Overnight on October 11–12, 2026, attackers took remote control of fridges in French supermarkets. Thierry Cotillard, who heads Groupement Mousquetaires (the Intermarché and Netto chains), told French news channel BFMTV that the attackers had switched the refrigerated display cases to defrost mode and pushed the temperature up to 50°C (122°F) (AFP, in French). On October 13, Reuters reported at least 350 stores hit by the cyberattack and at least 4,500 Danfoss interfaces visible on Shodan, a search engine that lists whatever answers on the internet.

That second number made us wonder: how many fridges is that? We took another look at the count, then went through the data in Profundis, our own search engine, to see what these setups look like. The name we come across most often belongs to a NAS, a networked hard drive.

A single controller can run all the refrigeration at a site, from the display cases to the walk-in coolers. A refrigeration contractor can access it remotely through a web page. That page is what the search engines find. CERT-FR, the French government’s incident response team, says in an alert (in French) that many Danfoss (AK-SM, AK-SC) and XWEB (Copeland, Dixell) controllers have been compromised.

4,500 interfaces: how many controllers is that?

On Shodan, we estimate that these results represent fewer than 2,500 IP addresses. That still doesn’t tell us how many controllers there are.

A Shodan result is the latest response from one address on one port, received within the past 30 days. So a controller reachable on three ports counts three times, and a connection that gets a new IP address during the month can show up several times too. Shodan’s documentation says so, but it’s not what comes to mind when you read “4,500.”

We checked which addresses account for the most results in Shodan’s public charts. On October 13, Shodan showed 4,625 results for the Danfoss controller’s home page. Just three addresses account for about 2,070 of them, or 45%. In those results, the interface appears on hundreds of ports at each of those addresses.

Shodan results for the Danfoss controller’s home page, read off Shodan’s public charts on October 13, 2026. The upper bound is estimated from the ten addresses with the most results.

What’s behind those three addresses? We didn’t contact them, so we don’t know. Maybe a router or a firewall that forwards its whole port range to the same page, maybe a honeypot set up to watch the attackers. Either way, it’s very unlikely to be one controller per port.

Removing duplicate results from the ten addresses with the most results gives an estimated upper bound of about 2,440 IP addresses on Shodan. That’s in the same ballpark as other counts: Shadowserver sees about 1,800 interfaces a day, roughly a thousand of them in France, and a Censys screenshot published by Claroty in August showed 2,765 addresses. Pages titled XWEB, a broader search, show the same pattern: about 7,100 results, 60% of them from just five addresses.

These figures don’t tell us how many stores there are.

What about our own data?

Profundis works mainly from domain names and visits what responds at their IP addresses. This lets us find the names associated with an address where a controller responds. We took a look at 163 addresses in our index, seen between July 15 and October 12, 2026, without sending them a single new request. We only used what our indexing robot had already recorded.

We had to deduplicate our data too: 379 results, recorded under 215 names and 4 bare IP addresses. After setting aside entries behind a relay or without a recorded address, we are left with 163 IP addresses. Several names can lead to the same address and port, with the same server software and favicon. They may refer to a single controller. Pivot, our graph tool, helps find names that have pointed to the same address at some point.

Which name leads to the fridges?

Almost never through a name that suggests refrigeration: only 18 of the 219 entries have a name that appears to refer to the controller. Most of the others suggest different equipment or services.

What the 219 entries appear to refer to: 215 names and 4 bare IP addresses. Orange: a company’s own domain. Blue: a name provided by a manufacturer, an ISP or a dynamic DNS service. Gray: the rest.

Names associated with NAS devices are the most common: 90, of which 83 are Synology names. Next come 81 names under a company’s domain, either the site’s own or a service provider’s, and most of those belong to something else too: the mail server, the VPN, the scheduling tool, the cameras. Then 15 router names and 14 phone system (PBX) names.

For 114 of the 163 addresses, or seven in ten, we don’t have a single name under a company domain. All we have is the name of the NAS, the router, the phone system or the internet connection.

This suggests a simple setup: the controller could be on the site’s network, sharing a public IP address with other equipment, with a port forwarded to it so the refrigeration contractor can connect. That’s an educated guess. We didn’t check anything on site.

Why a NAS?

Because a NAS can have a public name, and Profundis works from names. A NAS can get a name from its manufacturer for remote access and request a Let’s Encrypt TLS certificate. Let’s Encrypt submits every certificate it issues to public logs that anyone can read. Our robot can pick up the name there, visit the address and try different ports. On one of them, it may find the fridge controller. That probably explains some of these names; we didn’t check each one.

Are these controllers protected? Were they attacked?

On 122 of the 163 addresses, or three in four, we only ever saw the controller over plain, unencrypted HTTP in those three months. We didn’t try any credentials, but unless the interface adds its own encryption, a password typed into that page goes over the network in the clear. And on 115 addresses, we didn’t see it on either of the two usual web ports, 80 and 443. That didn’t stop it from being found.

We don’t know which ones were attacked. As of October 13, no official statement had explained how the attackers got in, and our data doesn’t show which software version is running. Danfoss says that most of its affected devices are end-of-life models that no longer get updates (article in French). Our dates are the last time we got a response. When we extracted the data on October 12, that response was more than 30 days old for 121 of the 163 addresses, and some controllers may have been unplugged since.

What if you run a store?

Ask your refrigeration contractor how they connect remotely to the refrigeration controller. Is it directly reachable from the internet, or do they have to connect to a VPN first? Danfoss advises against making its devices directly reachable from the internet.

In its October 13 alert, CERT-FR warns that attacks are probably still ongoing and recommends removing the units’ internet exposure. The next steps depend on the controller’s condition: check its settings, especially the defrost schedules, if it has not been compromised; restore and reconfigure it if it has; then use a secure VPN or a protected network for access. Ask the contractor to follow the full procedure in the alert, including the manufacturer’s recommendations for restoring service.

Also look at what else is reachable on the same connection. Hiding the NAS’s name wouldn’t fix anything, because the controller would still be reachable at its IP address. In our data, though, names associated with NAS devices are the most common.

Method and data

We took the Shodan numbers from its public charts on October 13, 2026, at about 16:10 UTC, searching on the title of the Danfoss home page (the same search SOCRadar uses). Those charts only show the top ten values, and we read them off the bars, give or take a few: about 2,070 results for the top three addresses, about 2,195 for the top ten, out of 4,625. The total moves fast: it was 4,501 three hours earlier. The estimated upper bound (4,625 − 2,195 + 10 = 2,440) assumes a single response for each of the other addresses. This upper bound applies to distinct IP addresses in Shodan’s 30-day results, not to the number of exposed controllers. For XWEB, we added up the results for three page titles (about 7,140 results, 4,315 of them from five addresses).

For Shadowserver, we took the median of its daily count over a month. Onyphe counts 6,212 addresses for the Danfoss interface, but that’s cumulative over several days (less than a week; article in French). SOCRadar had noted the same gap for France: 2,898 results on Shodan, 881 addresses on Censys.

We extracted the data from our index on October 12, 2026. We kept the records where our robot recognized the Danfoss (AK-SM, StoreView) or XWEB (Copeland, Dixell) interface, with a last response between July 15 and October 12, 2026. The manufacturer’s name alone isn’t enough for a match, and we left out its online portal. Of the 163 addresses, 45 were only identified from weaker clues than the interface’s full title. Those matches are plausible, but we didn’t check them one by one.

Profundis works mainly from domain names: the ones in publicly logged TLS certificates, the ones under the domains our users explore, and variants of known names. It also picks some addresses at random, without trying to cover them all, and 4 of the 163 addresses came from that. For each name, the robot queries DNS, then tests about 140 ports on the address it gets. If at least five respond, it tests all ports. On web ports, it requests the home page with a regular browser’s headers, without logging in or submitting any forms. It follows redirects, downloads the favicon and can run the page’s JavaScript. On the other ports (SSH, SNMP, databases), it reads banners and sends a few unauthenticated queries. That means a controller sitting alone on an unusual port can slip past it.

To count IP addresses, we set aside 18 of the 219 entries: 17 go through a tunnel or a CDN, where the address we see is the tunnel’s or the CDN’s, and 1 has no recorded address. These names fall into several chart categories: the chart groups names by what they refer to, not by how they are reached. The remaining 201 entries correspond to the 163 addresses: 66 with a Danfoss interface and 100 with an XWEB one, 3 of them with both. Twelve addresses respond on several ports. None of these figures is a count of fridges or stores.

The port where we see the controller most often is 8080 (42 addresses), ahead of 80 (37) and 443 (15). For Danfoss, on 33 of the 66 addresses, we didn’t see it on any of those three ports, and Onyphe found something similar: fewer than half of the interfaces are on a standard web port.

Countries are based on the IP address, not necessarily where the site is. For an address with both interfaces, the country may come from a record for either family. For Danfoss, 27 of the 66 addresses are in France, 9 in Belgium and 5 in the Netherlands. For XWEB, Germany and Italy lead (12 addresses each out of 100) and France has 4. That doesn’t mean XWEB controllers are rare in France: Shadowserver sees about 140.

The index keeps one record per name, address and port, updated when the port responds. Some fields may date from an earlier visit, and nothing guarantees how often the robot comes back to an address. If we go all the way back to the oldest record (August 2024), we get 615 addresses.

An earlier version of this study, in French and dated October 12, counted 199 names. We now count IP addresses as well as names. We also corrected how we identify controllers: 23 XWEB names added, 3 removed (2 from the manufacturer, 1 block page).

The data files: Shodan duplicates, origin of the names, countries and measurements. File names, JSON keys and some row labels are in French. We don’t publish any names, addresses or fingerprints here.