A series of coordinated cyberattacks targeting industrial refrigeration systems has emerged across the globe, disrupting food supply chains and prompting concerns about the vulnerability of critical infrastructure. The attacks, which have affected facilities in Israel, the United States, France, and several other European nations, appear to be part of a broader digital campaign by state-aligned hackers.
The initial incident occurred at a large food production plant in Israel. Employees discovered malicious code on corporate computers and threatening messages on office printers. An engineer later found smoke rising from industrial freezers, where broken compressors had spoiled significant amounts of inventory. Operations were halted for more than a week while replacement parts were sourced from abroad.
Omri Segev Moyal, head of the Israeli incident response firm Profero, identified the attackers as Iranian military hackers operating under the name Cyber Isnaad Front. Forensic data suggests the group, also linked to 2024 U.S. election influence campaigns, exploited vulnerable industrial controllers. They adjusted safety limits, disabled alerts, and overwhelmed the compressors, rendering them irreparable. Moyal noted that the attackers used artificial intelligence to rapidly test configurations and understand system behavior.
In August, the Pentagon reported possible refrigeration disruptions at multiple U.S. military commissaries. While the Defense Department has not officially confirmed a cyberattack, investigators from the Defense Criminal Investigative Service and the Army Criminal Investigation Division are treating the outages as such. Evidence points toward Iran, though attribution confidence remains moderate. Public contracting documents reveal that several affected bases, including Fort Irwin and Fort Huachuca, use Danfoss refrigeration controllers with outdated software versions that are no longer receiving security updates.
The campaign expanded in October to France, where hundreds of supermarkets across major chains experienced temperature spikes that ruined fresh produce. The French cybersecurity agency ANSSI is investigating the incident and has identified Danfoss systems as a primary vector. In early November, similar attacks were reported in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium, affecting stores ranging from small markets to large retailers like IKEA.
Security experts warn that the connectivity of aging industrial machines to the internet creates significant exposure. Josh Corman, a former cybersecurity official, stated that while current attacks target food, future incidents could compromise temperature-sensitive drugs and laboratory materials. The rapid advancement of AI tools allows attackers to break into and control these systems with increasing efficiency.
A propaganda video released in October by Cyber Isnaad Front featured a masked hacker claiming the attacks were launched on behalf of starving children in Gaza. The group has a history of using human actors in videos and has targeted surveillance cameras in the past. Analysts describe the group as technically capable, with operations that are more holistic and effective than those of other Iranian hacking teams.
The disruptions have caused logistical challenges for military families and consumers alike. At Fort Irwin, personnel had to travel over forty minutes to nearby grocery stores or rely on shelf-stable goods from base thrift stores. The incidents have highlighted the need for governments and companies to address long-standing security gaps in connected industrial equipment.
