Cold Room Check: exposed refrigeration controllers for small grocers

I didn't find any product that combines refrigeration-controller fingerprinting, plain-English fix steps for a small grocer, and a branded weekly monitor that refrigeration contractors resell per site. The pieces exist separately. Shodan Monitor and generic attack-surface tools like SOCRadar and Vijilan already do exposure alerting. Vijilan and similar MSP tools show the white-label resale model works, but only for IT providers. Claroty, Zscaler and Cyber Defence own the research and the enterprise end. Nobody I found sells to HVAC-R contractors. That channel is the real gap: these contractors set up the remote access in the first place and know which E2, XWEB, AK-SM or Carel units sit at which store. Timing is unusually strong and urgent. On October 11–12, 2026, hundreds of French supermarkets had Danfoss AK-SM800 and AK-SC355 controllers hijacked into nonstop defrost, and trade press is already warning US grocers. Demand will spike now, but so will copycats. Cyber Defence or a Shodan or Censys reseller could ship a "check your store" page within weeks. The free IP check is the weakest moat. It is mostly a thin wrapper over Shodan or Censys data, and you would be competing with free vendor pages. The durable value is in the contractor tier: multi-site dashboards, resellable reports, controller-model hardening guides (default credentials like Copeland's daily "ONEDAY" password, remote-defrost lockout, firmware status), and possibly fixing the problem by replacing port-forwarding with secure remote access. Risks: 1. Many small grocers sit behind changing IPs or carrier NAT, which makes per-IP monitoring less reliable. 2. Danfoss and Copeland could add exposure warnings to their own cloud services. 3. Redistributing Shodan or Censys data commercially needs proper API licensing. Sources: https://techcrunch.com/2019/02/08/industrial-refrigerators-defrost-flaw/ , https://claroty.com/team82/research/chilling-discoveries-unpacking-vulnerabilities-in-copeland-xweb-pro-controllers , https://www.techspot.com/news/109310-copeland-refrigeration-controllers-hit-critical-flaws-threatening-supermarkets.html , https://www.helpnetsecurity.com/2026/10/12/france-cyberattack-supermarket-freezers/ , https://www.insurancebusinessmag.com/us/news/cyber/fires-as-hundreds-of-french-supermarkets-hacked--us-grocers-on-notice-593192.aspx , https://www.nordiskpost.com/2026/10/13/danfoss-french-supermarket-cyberattack/

• Cyber Defence (cyber-defence.io) UK exposure report

  This is the closest match I found. A UK threat-intel firm scanned for internet-exposed refrigeration and building controllers (Danfoss, Carel, Copeland and others) and published counts, including for France. It is research and reporting, not a self-serve per-IP check or a contractor monitoring product, but it could easily add one.

• Shodan Monitor

  Shodan's own feature emails you when devices on your IP ranges show up exposed. It is generic, and the 2019 coverage I found said it came with a $49 membership and covered 16 IPs. It already does the technical part of a weekly recheck, but it has no refrigeration-specific explanation, no fix steps and no contractor branding.

• Claroty Team82 / Claroty xDome

  Claroty found the Danfoss AK-SM 800A and Copeland XWEB Pro vulnerabilities and is publishing about exposed supermarket refrigeration right after the French attacks. Its products are enterprise OT security platforms aimed at large chains, not small grocers or contractors.

• Zscaler

  Zscaler published Shodan counts of exposed Danfoss controllers (about 3,726 in August 2026) and pitches its zero-trust remote access as the fix. It is an enterprise competitor for the hardening and VPN-replacement angle, not for a cheap check.

• SOCRadar free External Attack Surface tool

  A free scan that maps a domain's IPs, open ports, products and known vulnerabilities, with a PDF report and ongoing alerts. It is generic and works from a domain, so it would not obviously identify a refrigeration controller at a small store's IP.

• Vijilan ThreatAssess

  A free external scan that MSPs can present to prospects as their own. This is the white-label resale model the contractor tier would use, but it is sold to IT MSPs, not refrigeration contractors, and it is not specific to refrigeration.

• OTWarden

  A commercial OT advisory tracker that also shows Shodan exposure counts. It is aimed at OT security teams, not grocers or refrigeration contractors.

Checked 2026-10-13