12,976 exposed refrigeration services found in 99 countries

Forescout’s Vedere Labs ran a Shodan-based sweep on October 26, 2026 and logged 12,976 service observations linked to refrigeration management interfaces. The scan spanned 6,017 public IP addresses across 99 countries and territories, indicating that a single IP can host multiple interfaces or downstream systems.

Vendor-specific exposure counts

The most common product families identified were:

  • Copeland/Dixell XWEB: 7,075 services
  • Danfoss StoreView: 4,697 services
  • Copeland Site Supervisor: 551 services
  • Carel pCOWeb: 513 services
  • Other systems: 140 services

Forescout noted that 80% of the Danfoss StoreView instances ran firmware versions older than 4.3.1, leaving them susceptible to two CVEs disclosed by Danfoss in August 2025.

CVE-2025-41451 and CVE-2025-41452

CVE-2025-41451 permits remote code execution via command injection in the web interface of AK-SM 8xxA systems. CVE-2025-41452 causes a denial-of-service condition through configuration changes. Both require authentication but expose a path for attackers to manipulate temperature settings or crash the interface.

Recent attack activity

Since January 2026, Forescout logged more than 20 claimed attacks on refrigeration systems. Pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) have claimed the majority of these incidents. On April 26 alone, Z-Pentest announced 10 attacks targeting wineries, fruit storage facilities, supermarkets and food-processing sites across Europe.

In October 2026, CERT-FR confirmed compromises of Danfoss AK-SM and AK-SC systems, as well as Copeland and Dixell XWEB equipment, in more than 700 French supermarkets. The attackers altered temperatures and defrost settings, causing significant food losses.

Implications for temperature-sensitive sectors

Supermarkets, hospitals, agricultural facilities and pharmaceutical supply chains all rely on precise temperature control. A single misconfigured or maliciously altered interface can spoil vaccines, medicines, or perishable inventory without leaving a malware footprint.

Forescout warned that attacks on these systems can have “physical and financial consequences” even when attackers use legitimate control functions. No confirmed hospital attacks have been reported, but the risk profile is identical.

Immediate protective actions

  1. Inventory exposed interfaces – Use Shodan or internal scans to locate exposed refrigeration services.
  2. Verify firmware versions – Cross-check against vendor advisories; patch any systems below the latest stable release.
  3. Restrict network access – Move management interfaces behind VPNs or internal firewalls; disable public exposure.
  4. Implement authentication hardening – Enforce strong, unique credentials and consider multi-factor authentication where supported.
  5. Monitor for anomalous changes – Log temperature setpoints and defrost cycles; alert on deviations beyond normal ranges.

Where to find live crypto prices

For those tracking market exposure, the live crypto prices can provide context on how supply chain disruptions might ripple into token valuations.

Next steps for operators

  • Review vendor advisories for Danfoss, Copeland, and Carel.
  • Conduct a rapid audit of exposed services in your network.
  • Apply patches or reconfigure interfaces to eliminate public exposure.

The available evidence does not show confirmed hospital attacks, but the similarity of the attack surface suggests that the same vectors could be used against medical facilities if mitigation steps are not taken promptly.

Explore more on this topic