Cyber Threats: Hackers Target Industrial Refrigeration Systems in U.S. and Europe

A series of targeted cyberattacks has disrupted refrigeration systems at food production facilities, supermarkets, and U.S. military commissaries since March. The incidents have resulted in spoiled food, costly downtime, and the destruction of industrial compressors. Forensic data and claims from the attackers point to an Iranian military hacking group known as Cyber Isnaad Front as the likely culprit behind the initial strikes in Israel.

In May, a large food production plant in Israel suffered a multi-pronged attack that halted operations for over a week. Employees found malicious code on corporate computers and threatening messages printed on office printers. An engineer discovered smoke and broken compressors in the industrial freezers. Omri Segev Moyal, head of the Israeli incident response firm Profero, described the attack as a destructive digital strike that occurred during a tense period in the Iran-Israel ceasefire.

The hackers manipulated industrial controllers to adjust safety limits and open gas pressure valves. They changed credentials and disabled alerts in the middle of the night. Moyal stated that the attackers used the laws of thermodynamics to render the compressors unrepairable. He noted that the speed and volume of configuration changes suggested the use of artificial intelligence tools rather than manual human effort.

Following the Israeli incidents, similar attacks appeared in Europe and the United States. Unidentified hackers targeted refrigeration controllers at French supermarkets in October and at food stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium in early November. In August, the Pentagon reported a possible refrigeration disruption at multiple U.S. military commissaries. An independent blogger identified at least nine locations with confirmed outages based on social media posts.

The Defense Commissary Agency operates the affected grocery stores. Public contracting documents show that several installations, including Fort Irwin and Fort Huachuca, use Danfoss refrigeration remote control systems. Some of these units date to the mid-2000s and can no longer receive secure software updates. French officials identified the same Danfoss machines as a vector for the attacks on French supermarkets in October.

Josh Corman, a former cybersecurity official with the Cybersecurity and Infrastructure Security Agency, warned that connecting industrial refrigeration to the Internet exposes these systems to adversaries. He noted that while current attacks have targeted food, future incidents could target temperature-sensitive drugs and laboratory materials. The Defense Criminal Investigative Service is partnering with the Army Criminal Investigation Division and French law enforcement to investigate the recent hacks.

Two former officials who requested anonymity said investigators are treating the U.S. base outages as a cyberattack. They believe some evidence points toward Iran, though confidence in that attribution is not yet high. The Pentagon has not officially acknowledged whether it believes hackers were responsible for the August disruptions.

Ari Ben Am, co-founder of Telemetry Data Labs, has tracked Cyber Isnaad Front for years and believes the group works for the Iranian military. He described the group as one of the more technically capable Iranian hacking teams he has seen. Ben Am noted that the group has a history of compromising surveillance cameras and using human actors in propaganda videos. He also suggested the group may share digital tools, such as wiper malware, with other Iranian hacking groups.

A propaganda video released in October featured a masked hacker in a room filled with digital screens. The video showed hacked surveillance footage from Israeli supermarkets and employees finding printed materials. The attackers claimed in Arabic that they launched the attack on behalf of the starving children of Gaza. The video also included a salute to French students in French, a reference that remains unclear given the group's past impersonation of a French far-right group and its targeting of the Israeli delegation to the 2024 Paris Olympics.