A passive, aggregate census of cold-chain and building controllers — Danfoss, Dixell, Carel and RDM — that respond on a public IP address across sixteen European national markets. It counts reachable devices. It does not test, touch or log in to any of them.
distinct public IP addresses running a refrigeration or cold-chain controller that is potentially exposed to the open internet.
Country shading shows the census count. Marker size follows the selected count, maker or per-million view. Click a country to pin its figures.
Belgium is third by count and first by density: 38.1 hosts per million against Germany’s 3.0, a factor of 12.6. France moves from first to second; the United Kingdom falls from sixth to fifteenth. Media coverage counts hosts; density shows where they are concentrated.
Population denominators: Eurostat tps00001, 1 January 2026 (several figures provisional); ONS mid-2025 for the United Kingdom; the Federal Statistical Office for Switzerland; Statistics Norway for Norway.
27 advisories, research papers and press reports, 2016 to 2026. 20 of them land in the last five weeks. Pick one to see the maker and the market it touches.
RDM Intuitive 650 TDB Controller v2.1 and earlier: privilege escalation (CVE-2016-4505) and cross-site request forgery (CVE-2016-4506). Fixed in v2.1.24.
Thousands of internet-exposed Resource Data Management temperature controllers reachable with default credentials (Shodan-based exposure research).
Carel pCOWeb before B1.2.4: plaintext credential storage (CVE-2019-11369) and stored cross-site scripting (CVE-2019-11370).
Unauthenticated directory traversal in logdownload.cgi on Carel pCOWeb HVAC BACnet Gateway (firmware A2.1.0 to B2.1.0). CVSS 7.5.
Original release 2025-05-20; Update A on 2025-08-26 added the command-injection and denial-of-service CVEs. Fixes in R4.2 and R4.3.1.
Copeland/Dixell XWEB 300D/500B/500D PRO, v1.12.1 and earlier. 23 CVEs; the critical one is an unauthenticated OS command-injection path to remote code execution (CVE-2026-24663).
Three Danfoss AK-SM 800A issues: authentication bypass (CVE-2025-41450), command injection (CVE-2025-41451) and denial of service (CVE-2025-41452). Fixed in firmware R4.3.1.
CERT-FR alert on compromises of internet-exposed refrigeration controllers (Danfoss AK-SM/AK-SC, Copeland and Dixell XWEB). Advises removing internet exposure and restricting to VPN.
More than 800 UK internet-exposed refrigeration and building-management controllers counted, including Danfoss, Carel and Copeland systems.
English: "Coopérative U, Intermarché, E.Leclerc, Carrefour… A cyberattack hit hundreds of supermarkets' refrigeration infrastructure". Le Figaro counted 300 Intermarché and Netto stores and 80 Carrefour stores.
Attacks on Dixell-equipped stores near Bordeaux and in Tarn, with defrost and temperature settings changed remotely.
Copeland told operators to take XWEB EVO units off the public internet, check them for unauthorised access and plan migration to XWEB PRO.
Refrigeration-control sabotage across roughly 700 French supermarket sites, tied to the Danfoss and Copeland controller families covered by earlier disclosures.
1,960 XWEB EVO, 108 XWEB PRO and 589 Copeland Site Supervisor public IPs counted; Italy led both XWEB EVO and XWEB PRO exposure.
Sweden's NCSC said it was tracking incidents affecting retail refrigeration systems, and told operators to inventory and protect internet-connected OT.
CNBC reported the second wave of refrigeration failures reaching supermarkets in several European countries.
ABC News carried the Associated Press wire report on freezer failures at supermarkets in several European countries.
The Guardian reported affected retailers in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands and Sweden, including Danfoss-linked ICA stores.
The Irish Times reported that 13 SuperValu stores removed chilled and frozen products after a cyberattack affected a specific refrigerator model.
Three British meat suppliers and a produce wholesaler were reached through Copeland XWEB controllers; operators intervened before stock was lost.
English: "Retail: hacker attacks on supermarket refrigeration systems in Germany". Handelsblatt named affected Rewe, Edeka and CAP stores in four German towns.
English: "Why the second wave of supermarket fridge hacks warns of the risks to come". El País reported attackers targeting internet-connected commercial refrigeration controllers and supervisors.
English: "Hacker alert in the food supply chain, checks on two Tuscan companies". Rai reported a confirmed attack on SIAF cold rooms, checks at Valpizza's Prato plant and four affected Coop stores in Sicily.
Al Jazeera reviewed both waves of refrigeration incidents and reported that no culprit had been established.
Refrigeration systems in several EU member states affected from 11 October, with a further wave of incidents on 1-2 November.
English: "Cybersecurity Centre confirms: store refrigeration failures were caused by a cyberattack". Yle reported that a few K-group stores were affected and that 30 exposed devices were found in Finland.
Exposed Danfoss StoreView and Copeland/Dixell XWEB hosts fell 53%, from 6,695 on 9 October to 3,124 on 5 November.
How to read the map. Every figure is aggregated to a national market. A marker is not a pin on any individual host — it is the country total, drawn near the centre so the eye can find it. No addresses, hostnames, operators, certificate names or banners appear on this site. Countries with no marker are not yet surveyed.
Shares of the 4,853 distinct hosts. The four figures add up to more than the headline because a single host can answer with more than one maker's fingerprint.
Of the top 20 networks by host count, 19 are carrier networks: fixed broadband, mixed fixed and mobile, business ISP, or M2M and IoT SIM networks. Exactly one is a datacentre network, AS63949, Akamai Connected Cloud / Linode. The prevailing pattern is a controller behind a retail router in a shop backroom or supermarket plant room, or on a cellular SIM. These are not hardened datacentre arrangements, and nothing here resembles coordinated national infrastructure. Orange’s AS3215 alone holds 1,091 hosts, or 22.5% of the census.
This is the one breakdown that sums exactly to the headline. Each host announces from one network, so 41 listed networks with 3,676 hosts plus 408 tail networks with 1,177 hosts equals 4,853. Country × maker cells and ports count distinct IPs within each cell, so one IP can appear under two makers or two ports and those columns sum above 4,853. Networks below 20 hosts appear only in the tail figure.
Port 80 leads with 1,584 hosts, which means the usual way in is a plain, unencrypted web interface. The 35 listed ports account for 4,509 of 9,486 port observations.
Tail: 2,843 further ports, each answered by fewer than 20 hosts.
4,565 of 4,853 hosts, or 94.1%, answer on exactly one port. The bars show host count by number of answering ports.
The widest single host answers on 1,144 ports. A host answering on a thousand ports is almost certainly a NAT front-end or a honeypot rather than one controller. This is why the port column sums above the headline.
A precise count needs precise boundaries. These six limits are part of the result.
Passive fingerprint matches across 28 country × maker cells. The raw haystack, before any de-duplication.
The same host counted more than once — a second port, a second maker fingerprint, a repeat survey. Collapsed to one host.
What remains after de-duplication: the unique hosts behind the headline.
Sixteen European countries are covered. The rest of the continent is not yet surveyed — unmeasured, not clear.
In 20 of the 28 cells the query hit a result ceiling, so the true count is higher than shown.
Aggregate country and maker totals only. Per-host data is held privately so it can reach the national CERTs and the makers who can act on it.
Three things push the real number above 4,853. Coverage stops at sixteen national markets, so every unsurveyed country adds hosts this census never saw. In most cells the data source capped how many results it would return, truncating the count before it finished. And passive fingerprinting only recognises devices that answer in a way we already have a signature for — anything behind a reverse proxy, on a non-standard port, or newly modelled slips past.
Widening coverage from seven markets to sixteen raised the count 57.7% in two days. The number tracks how far we have looked, not how much is out there.
The published snapshot is open to everyone. Below that line, what gets released depends on who is asking and what they intend to do with it.
Say which layer you want and who you are writing for. Operator and CERT requests go to the front of the queue.