Recently, waves of hacks on refrigerators across Europe have resulted in spoiled food, fires, and millions of euros in inventory losses.
Read Censys ARC’s sitrep on the recent refrigeration hacks →
Reports suggest that Danfoss StoreView refrigeration controllers were exploited; as of November 2, Censys observed just over 1,000 Danfoss StoreView instances exposed globally.
This brings to light a problem that has remained unresolved for years: perpetually exposed industrial control systems (ICS) and critical infrastructure (CI).
ICS Exposure Has Not Fallen
Global ICS exposure has risen about 4% since 2024, despite sustained pressure to remove industrial equipment from the public Internet. It currently sits at around 134,000 globally.
Censys’ 2026 State of the Internet Report observed ICS exposure over two and a half years, and the picture has remained broadly stable, apart from geographic shifts. North America accounts for roughly 38% of global ICS exposure. Asia’s share grew from 22% in 2024 to 25% in 2026, while Europe’s fell from 36.5% to 32%. However, these shifts have not produced an overall decline.
While exposure numbers are high, they’re hardly surprising: ICS exposure is a problem that’s been reported on and warned about for years. It poses a critical risk to the public as gatekeepers to the world’s critical infrastructure. The refrigeration attacks across Europe are just the latest example; other recent incidents targeting critical infrastructure include attacks on gas station tank gauges, air raid systems, and water towers.
If the risks are so high and widely known, why hasn’t anything changed?
Censys’ 2026 State of the Internet Report offers new insights as to why the problem perpetuates.
4 Reasons ICS Exposure Persists
1. Mobile Hosting Obscures Ownership
Industrial equipment often falls outside the assumptions behind conventional IT asset management, and finding an exposed system does not guarantee anyone can get it secured.
Roughly 70% of hosts running ICS devices and services sit on consumer and mobile networks. Operators who only consider their corporate IP space when conducting asset inventory can miss their industrial devices connected to mobile networks.
For third parties, whether benign or malicious, finding these systems isn’t difficult. The difficulty lies in identifying ownership. The WHOIS and other host metadata on mobile-hosted ICS infrastructure typically point to the telecommunications provider, not the operator. So when researchers and other third parties discover exposed ICS infrastructure, it’s nearly impossible for them to identify or notify the owner.
The result is continually exposed ICS infrastructure that’s easy for attackers to find and difficult for owners to track and secure.
2. ICS Attack Surfaces Are Growing
The majority of exposed ICS infrastructure has an attack surface that extends well beyond its industrial protocols. This offers attackers more entry points to exploit.
Non-ICS Protocols
Historically, ICS protocols have not been frequently exploited on their own: few malware variants are known to target ICS protocols, in part because doing so requires specialized knowledge of both the protocol and the physical equipment it controls.
However, in addition to these industrial protocols, 31-99% of hosts running an ICS protocol also run at least one non-ICS IT service like HTTP, SSH, or FTP. These services are well-known and non-specialized, and they expand the attack surface with more easily exploitable entry points.
HMIs
ICS infrastructure frequently runs Human-machine interfaces (HMIs), which are graphical interfaces that allow operators to remotely monitor and interact with industrial systems. Unlike attacks targeting ICS protocols themselves, HMI attacks require no system-specific expertise. They can be accessible through VNC, RDP, HTTP, or specialized protocols such as CMORE, sometimes with default credentials or no authentication.
3. Configuration and Updates Aren’t Always Optimized
The difficulty in tracking and managing ICS assets can make it hard to configure them properly and keep them up to date.
In the case of the refrigerator hacks, Danfoss said most affected controllers were unsupported older models or ran outdated firmware. Patches for several relevant vulnerabilities had been available for more than a year.
Similarly, systems are sometimes deployed with their default configurations, which are not always secure. A 2023 attack on the Municipal Water Authority of Aliquippa involved a Unitronics controller. CISA’s recommendations included changing the default password, “1111.”
4. Network Concentration Compounds Risk
A substantial share of exposed industrial equipment depends on a single mobile network in several countries. Turkcell accounts for 81% of observed ICS hosts in Turkey; Korea Telecom accounts for 71% in South Korea. In the United States, China, and Canada, around one-third of observed exposed ICS hosts sit on a single mobile network in each country.
Network concentration narrows the search area for attackers and offers a single point of entry to a large portion of the nation’s ICS infrastructure. An outage or attack affecting the provider could also disrupt connectivity to a substantial share of those systems at once.
Examining the Gaps That Keep ICS Exposed
Censys’ 2026 State of the Internet Report’s findings offer insights into why awareness alone has not been enough to reduce ICS exposure. Operators can miss equipment outside their corporate address space, researchers can struggle to reach its owners, and ordinary IT weaknesses can expose industrial controls to attack.
Download the 2026 State of the Internet Report for the full ICS analysis, including regional trends, HMI exposure data, and network concentration findings. For the refrigeration case study, read Censys ARC’s full Danfoss StoreView analysis.
Get the 2026 State of the Internet Report
Download for the latest insights into ICS exposures, threat intelligence, exposed AI infrastructure, and more.
