Topic starter
06/11/2026 6:36 pm
TL;DR: Remotely attacked refrigeration controllers in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden were raised to 50 degrees Celsius, spoiling food in dozens of stores, while just over 1,000 Danfoss StoreView instances remain exposed globally, according to Censys research. Internet-exposed industrial controllers turn routine building systems into operational attack surfaces that need asset visibility, patching and segmentation.
Editorial analysis by NHI Mgmt Group, based on content published by Censys: “European refrigerator controller redux: A new wave of refrigeration attacks”.
By the numbers:
- Censys observes just over 1,000 Danfoss StoreView instances exposed globally.
- France had 220 total exposures of Danfoss StoreView at the time of analysis.
- 41% of StoreView instances in France appear to be running a patched firmware version.
Key questions
Q: How do teams secure internet-exposed industrial controllers?
A: Teams secure internet-exposed industrial controllers by removing direct exposure where possible, placing them behind VPNs, jump hosts or industrial DMZs, and restricting management to allowlisted source addresses.
Q: Why do exposed OT devices create such high operational risk?
A: Exposed OT devices create high risk because control systems are designed to be stable, trusted, and continuously reachable.
Q: What is the difference between an exposed asset inventory and real exposure management?
A: An exposed asset inventory lists what exists on the perimeter.
Practitioner guidance
- Map every internet-facing refrigeration controller Create an inventory that records external reachability, firmware version, business location and administrative owner for each controller.
- Block public access to management interfaces Move controller administration behind VPN, jump hosts or private network paths so remote adjustment is not possible from the open internet.
- Separate patched from vulnerable builds Prioritise remediation for devices still on older firmware and track them separately from units already running a patched version.
Bottom line: Internet-reachable refrigeration controllers can be manipulated directly, which makes them a business continuity risk as well as a technical one.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Internet-exposed building controls are now a retail resilience problem, not a niche OT issue. These controllers sit outside the usual IAM conversation, but their exposure profile still determines whether an outsider can influence core operations. When the attack surface is a management interface, operational continuity depends on asset visibility, segmentation and disciplined patching. Practitioners should treat facility controllers as production-critical digital assets, not passive equipment.
A question worth separating out:
Q: What should teams do first when an operational controller is internet-exposed?
A: The first step is to treat the controller as an exposed asset and immediately limit reachable services, users and source networks. Teams should isolate it from the public internet, disable unsafe remote administration paths, rotate any credentials that may already be exposed, and verify whether the controller has been tampered with before restoring normal access.
👉 Read our full editorial: Exposed refrigeration controllers created a food spoilage risk across Europe