Refrigeration Hacks: Iranian Group Targets Global Food Supply

Cyberattackers linked to the Iranian military have begun targeting industrial refrigeration systems around the world, causing physical damage to compressors and spoiling food. The campaign appears to have started in Israel and has since spread to Europe and the United States.

In Israel, hackers attacked a large food production plant in May. They manipulated industrial controllers, adjusted safety limits, and disabled alerts. The resulting strain caused the compressors to fail, leaving the facility without cooling for over a week. Omri Segev Moyal, head of the incident response firm Profero, said the hackers used artificial intelligence to rapidly test different configurations until the machines failed.

Moyal believes the group behind the attack is the Cyber Isnaad Front, which was also linked to influence campaigns targeting U.S. elections in 2024. He noted that the attackers are testing their methods in Europe and the U.S. before unleashing them on a larger scale.

Recent incidents include disruptions at U.S. military bases in August and French supermarkets in October. In early November, attacks were reported at stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium. Ari Ben Am, co-founder of Telemetry Data Labs, described the group as one of the more technically capable Iranian hacking teams he has seen.

Public contracting documents show that the U.S. Defense Commissary Agency uses Danfoss refrigeration remote control systems at multiple installations, including Fort Irwin and Fort Huachuca. Some of these controllers date to the mid-2000s and can no longer receive security updates. French officials identified the same Danfoss systems as a vector for the October attacks in Europe.

The Pentagon has not officially confirmed a cyberattack at its commissaries, though investigators from the Defense Criminal Investigative Service and the Army Criminal Investigation Division are collaborating with French law enforcement. Two former officials said investigators are treating the outages as a cyberattack with evidence pointing toward Iran.

Danfoss has advised customers to update firmware, remove devices from the internet, and operate behind firewalls to mitigate risks. A spokesperson for the company said the firm is in close contact with affected customers to support them in addressing the situation.