Hackers Targeting Industrial Fridges Cause Spoiled Food and Military Disruptions

More than a week of operational downtime defined the cost of a recent cyberattack on a large Israeli food production plant, where engineers discovered broken compressors and spoiled inventory after the facility’s systems failed. The incident, which included malicious code on corporate computers and spontaneous printer output of threatening messages, forced the company to halt operations while awaiting replacement parts from abroad.

The timeline of these digital strikes began in March when hackers targeted a small chain of kosher grocery stores in Israel. A video circulating on social media showed customers handling soft, spoiled meat packages that had previously been frozen. By May, the attacks had escalated to the larger food production plant. Omri Segev Moyal, head of the incident response firm Profero, described the destruction of the industrial freezers as a event that would leave a mark on management.

Moyal attributes the attacks to the Iranian military hacking group known as Cyber Isnaad Front. The group is linked to influence campaigns targeting U.S. elections in 2024. Moyal stated that the hackers used artificial intelligence to rapidly test system configurations, a speed he noted was not achievable by human operators alone. They adjusted safety limits, opened gas pressure valves, and disabled alerts to destroy the compressors.

The attacks have since spread globally. In August, the Pentagon reported possible refrigeration disruptions at multiple U.S. military commissaries. An independent blogger cited social media posts confirming outages at at least nine locations, including Fort Huachuca in Arizona and Fort Irwin in California. The Defense Commissary Agency has not officially confirmed whether hackers were responsible, though the Defense Criminal Investigative Service is investigating the incidents alongside the Army Criminal Investigation Division and French law enforcement.

Two former officials said investigators are treating the outages as a cyberattack and believe evidence points toward Iran, though confidence in that attribution is not yet high. The vulnerability appears linked to Danfoss refrigeration remote control systems. Public contracting documents show that several U.S. installations use older versions of these controllers, some dating to the mid-2000s, which can no longer receive secure software updates. French officials identified the same Danfoss machines as the vector for attacks on supermarkets in October.

In early November, similar attacks hit food stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium. Josh Corman, a former cybersecurity official with the Cybersecurity and Infrastructure Security Agency, warned that connecting industrial refrigeration to the Internet exposes these systems to adversaries. He noted that while current attacks target food, future strikes could aim at temperature sensitive drugs and laboratory materials.

Ari Ben Am, co-founder of Telemetry Data Labs, has tracked Cyber Isnaad Front for years. He described the group as one of the more technically capable Iranian hacking units he has seen. Ben Am concluded that the hackers appear to have shared digital tools, such as wiper malware, with other Iranian groups like the Cyber Av3ngers, which targeted water treatment facilities in the United States in 2023. The group has a history of compromising surveillance cameras and releasing propaganda videos of its activities.