Censys Report Finds Persistent Exposure of Internet-Facing ICS
Summary
Censys’ 2026 report estimates about 134,000 internet-exposed ICS hosts globally, up 4% since 2024. It identifies mobile-network hosting, expanded attack surfaces, weak configurations, and network concentration as factors sustaining exposure.
Key points
- Censys estimates global ICS exposure at about 134,000 hosts, roughly 4% higher than in 2024.
- About 70% of hosts running ICS devices and services are on consumer or mobile networks, complicating asset ownership and remediation.
- The report says 31–99% of hosts running an ICS protocol also run at least one non-ICS service, such as HTTP, SSH, or FTP.
- Exposed HMIs may be reachable through VNC, RDP, HTTP, or specialized protocols, sometimes with default credentials or no authentication.
- Danfoss said most controllers affected in the reported refrigerator hacks were unsupported older models or ran outdated firmware; patches for several relevant vulnerabilities had been available for over a year.
- The report describes substantial concentration of exposed ICS hosts on individual mobile networks in several countries, creating potential single points of entry or connectivity disruption.
Article Details
- Publisher
- Censys
- Report Period
- 2026 report; ICS exposure observed over two and a half years. The Danfoss StoreView count is as of November 2; the year is not specified.
- Scope
- Global exposure of internet-facing ICS and critical infrastructure, including refrigeration controllers, non-ICS services, and mobile-network concentration.
- Key Statistics
- Censys observed just over 1,000 exposed Danfoss StoreView instances globally as of November 2; the year is not specified.
- Global ICS exposure was around 134,000, approximately 4% higher than in 2024.
- Roughly 70% of hosts running ICS devices and services sit on consumer and mobile networks.
- Between 31% and 99% of hosts running an ICS protocol also run at least one non-ICS IT service.
- Observed ICS hosts included 81% on Turkcell in Turkey and 71% on Korea Telecom in South Korea; around one-third were on a single mobile network in each of the United States, China, and Canada.
- Recommendations
- Change default passwords, as included in CISA recommendations for the 2023 Municipal Water Authority of Aliquippa incident.
Vendors
DanfossReports suggest that Danfoss StoreView refrigeration controllers were exploited; as of November 2, Censys observed just over 1,000 Danfoss StoreView instances exposed globally.Korea TelecomTurkcell accounts for 81% of observed ICS hosts in Turkey; Korea Telecom accounts for 71% in South Korea.TurkcellTurkcell accounts for 81% of observed ICS hosts in Turkey; Korea Telecom accounts for 71% in South Korea.
Products
Danfoss StoreViewReports suggest that Danfoss StoreView refrigeration controllers were exploited; as of November 2, Censys observed just over 1,000 Danfoss StoreView instances exposed globally.Unitronics controllerA 2023 attack on the Municipal Water Authority of Aliquippa involved a Unitronics controller.
Countries
CanadaIn the United States, China, and Canada, around one-third of observed exposed ICS hosts sit on a single mobile network in each country.ChinaIn the United States, China, and Canada, around one-third of observed exposed ICS hosts sit on a single mobile network in each country.South KoreaTurkcell accounts for 81% of observed ICS hosts in Turkey; Korea Telecom accounts for 71% in South Korea.TurkeyTurkcell accounts for 81% of observed ICS hosts in Turkey; Korea Telecom accounts for 71% in South Korea.United StatesIn the United States, China, and Canada, around one-third of observed exposed ICS hosts sit on a single mobile network in each country.
Industries
Critical infrastructureThis brings to light a problem that has remained unresolved for years: perpetually exposed industrial control systems (ICS) and critical infrastructure (CI).TelecommunicationsThe WHOIS and other host metadata on mobile-hosted ICS infrastructure typically point to the telecommunications provider, not the operator.