Hackers Target Industrial Refrigeration Systems in US and Europe
A group linked to Iran is disrupting food supplies by attacking aging controllers in military bases and retail stores.
By Rosa Wojcik ·
A coordinated series of cyberattacks has disrupted refrigeration systems at food production facilities, military commissaries, and retail stores across multiple continents.
The attacks, attributed by experts to an Iranian military hacking group known as Cyber Isnaad Front, exploit vulnerabilities in older industrial controllers. In Israel, the group targeted a large food production plant in May, causing compressors to fail and spoiling inventory. The operation forced the company to halt production for more than a week while awaiting replacement parts from abroad.
The group’s tactics have expanded beyond Israel. In August, U.S. military commissaries experienced refrigeration outages that left food in defrost mode. At least nine locations reported disruptions, including Fort Irwin and Fort Huachuca. A social media post from Fort Huachuca confirmed that freezers entered defrost mode overnight without a power outage, heating up the food until it was spoiled.
In October and early November, similar incidents occurred in Europe. French supermarkets and food stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium reported issues. Security firms identified Danfoss remote control systems as a common vector for these breaches. Public contracting documents show that the U.S. Defense Commissary Agency uses several older versions of these controllers, some dating to the mid-2000s, which can no longer receive security updates.
Omri Segev Moyal, head of the Israeli incident response firm Profero, stated that the attackers adjusted safety limits, opened gas pressure valves, and disabled alerts to destroy the machinery. He noted that the use of AI allowed the hackers to test numerous configurations rapidly, a pace he described as not human. A propaganda video released in October features a masked man displaying hacked surveillance footage and claims the attack was launched for the benefit of children in Gaza.
Josh Corman, a former official with the Cybersecurity and Infrastructure Security Agency, warned that connecting industrial equipment to the internet exposes it to adversaries. He noted that while current attacks target food, future strikes could affect temperature sensitive drugs and laboratory materials. Ari Ben Am of Telemetry Data Labs described Cyber Isnaad Front as a technically capable group with a history of compromising organizations with established cyber defenses.
The Defense Criminal Investigative Service is working with the Army Criminal Investigation Division and French law enforcement to investigate the incidents. Two former officials said investigators are treating the outages as cyberattacks and believe evidence points to Iran, though confidence in that attribution is not yet high. The Pentagon has not officially confirmed the cause of the disruptions.
