Hackers Target Industrial Refrigeration Systems Worldwide, Spoiling Food and Disrupting Military Commissaries
Cyber attacks on refrigeration controllers have damaged food supplies at facilities in Israel, the United States, France and other European countries, with investigators linking the activity to Iranian-linked groups.
A series of coordinated cyber attacks on industrial refrigeration controllers has caused food spoilage and operational shutdowns at a food production plant in Israel, U.S. military commissaries, and supermarkets across Europe. The attacks involved malicious code that altered safety limits, opened gas pressure valves and disabled alerts, leading to broken compressors and spoiled inventory.
"I do a lot of cyber incidents, but this is the kind of incident that I know will leave a mark on the people in charge," said Omri Segev Moyal, head of the Israeli incident response firm Profero, which investigated the Israeli plant breach.
Forensic evidence and claims from the attackers point to the Iranian-linked group Cyber Isnaad Front, which has previously been associated with influence campaigns targeting the 2024 U.S. elections. The group released a propaganda video in October that claimed the attacks were carried out on behalf of starving children in Gaza.
Similar disruptions were reported in August at several U.S. Defense Commissary Agency grocery stores, where freezers entered defrost mode and food spoiled. The Pentagon has not confirmed a cyber attribution, but investigators are treating the outages as a possible attack and have coordinated with French law-enforcement agencies.
In October, French supermarkets experienced widespread temperature spikes that ruined fresh produce in hundreds of stores. French cybersecurity agency ANSSI is investigating the incidents, which appear to involve the same Iranian-linked actors.
Cybersecurity experts warn that the growing connectivity of operational-technology devices, many of which run outdated firmware, creates a vulnerable attack surface. "With great connectivity comes great responsibility," said Josh Corman, a former official with the Cybersecurity and Infrastructure Security Agency. He cautioned that while current attacks have targeted food, future incidents could affect temperature-sensitive medicines and laboratory materials.
Manufacturers such as Danfoss have advised customers to install the latest firmware, isolate devices from the internet and use firewalls and VPNs to mitigate risk. The ongoing wave of attacks underscores the challenge of securing aging industrial control systems that were not designed for internet exposure.