Hackers have been remotely taking over refrigeration controllers and spoiling food at U.S. military commissaries, French supermarkets and stores in six other European countries. An Israeli incident responder ties an earlier, destructive attack on an Israeli food plant to Iranian military hackers.
That May attack shut down a large Israeli food production plant for more than a week. Printers spat out threatening messages, data-wiping malware turned up on company computers, and freezer compressors were destroyed. Omri Segev Moyal, head of the response firm Profero, said forensic data and the attackers' own claims point to an Iranian military group calling itself Cyber Isnaad Front.
The intruders broke into the controllers that managed the freezers, changed safety limits, opened gas pressure valves, swapped credentials, disabled alerts and erased evidence overnight. Moyal said AI let them cycle through configurations at a pace no human could match until the compressors burned out.
It wasn't human, the amount of configurations they were able to try in a short time span.
Omri Segev Moyal, head of Profero
A campaign spreads across continents
Since then, attacks by still-unidentified hackers have struck U.S. military bases in August, French supermarkets in October and, in early November, food stores ranging from small markets to IKEA in Sweden, Estonia, Ireland, Luxembourg, the Netherlands and Belgium.
In France, hundreds of supermarkets across chains including Intermarché, Coopérative U and Carrefour lost fresh food, though that was a small share of their stores. The national cybersecurity agency, ANSSI, is investigating and has contacted other industrial sectors that could be affected. French officials have named Danfoss refrigeration control systems as one way the attackers got in.
Questions at U.S. commissaries
The Pentagon has described a possible refrigeration disruption at multiple commissaries but has not said whether hackers caused it. The Defense Criminal Investigative Service is working with the Army's Cyber Field Office and French law enforcement. Two former officials said investigators are treating the outages as a cyberattack, with some evidence pointing to Iran, though not with high confidence.
Public contracting documents show commissaries including Fort Irwin and Fort Huachuca, both of which disclosed outages, run Danfoss remote controls, some dating to the mid-2000s and no longer able to receive secure updates. Danfoss has advised customers to install the latest firmware and take the devices off the internet.
As we connect industrial refrigeration to the Internet, we expose it to accidents and adversaries
Josh Corman, former CISA cybersecurity official
At Fort Huachuca in Arizona, an overnight failure pushed every freezer into defrost mode without any power outage, spoiling the food. At Fort Irwin in California, one military spouse said residents drove more than 40 minutes to the nearest grocery store.
Who may be behind it
Ari Ben Am, co-founder of Telemetry Data Labs, said Cyber Isnaad Front works for the Iranian military and ranks among the more technically capable Iranian groups. He said it may have shared wiper malware with Cyber Av3ngers, which hacked U.S. water facilities in 2023.
Josh Corman, a former official at the Cybersecurity and Infrastructure Security Agency, warned that future attacks could target temperature-sensitive drugs and lab materials. Officials in Sweden and Estonia said warnings from France helped limit the damage there.
