Refrigeration Systems: Iranian Hackers Target Global Food Supply

Iranian military hackers known as Cyber Isnaad Front are targeting industrial refrigeration systems across multiple continents. The group has compromised controllers in U.S. military commissaries, French supermarkets, and retail stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium. These attacks have resulted in spoiled food, operational delays, and significant financial losses for affected businesses.

The current wave of attacks follows an initial strike on a large food production plant in Israel in May. Engineers at the facility discovered smoke rising from industrial freezers and found broken compressors inside. The hackers had previously adjusted safety limits, opened gas pressure valves, and disabled alerts overnight. The plant’s operations halted for more than a week while new parts were shipped from abroad.

Omri Segev Moyal, head of the Israeli incident response firm Profero, identified the attackers based on forensic data and claims from the hackers. Moyal notes that the group, also linked to influence campaigns during the 2024 U.S. elections, used artificial intelligence to rapidly test system configurations. The attackers overwhelmed the compressors until they failed, a process Moyal described as too fast and precise for a human operator.

In October, the group released a propaganda video showing masked hackers and footage of spoiled produce in Israeli grocery stores. The video, labeled with the Cyber Isnaad Front logo, included Arabic text claiming the attack was launched for the children of Gaza. It also featured a French salute to students, a reference that may connect to ongoing unrest in France. Ari Ben Am, a threat intelligence researcher, states the group is one of the more technically capable Iranian units he has tracked.

U.S. military installations experienced disruptions in August. The Pentagon described the events as a possible refrigeration disruption but has not officially confirmed a cyberattack. However, two former officials said investigators treat the outages as cyber incidents with evidence pointing toward Iran. The Defense Criminal Investigative Service is coordinating with French law enforcement and the Army Criminal Investigation Division to trace the source.

Public contracting documents show that several U.S. Defense Commissary installations, including Fort Irwin and Fort Huachuca, operate Danfoss remote control systems. Some of these controllers date to the mid-2000s and lack current security updates. French officials identified the same Danfoss models as the entry point for attacks on French supermarkets in October. Danfoss has advised customers to update firmware and isolate devices from the internet to mitigate risks.

At Fort Huachuca in Arizona, a Facebook post confirmed that freezers switched to defrost mode without a power outage, heating the food until it spoiled. Fort Irwin in California shared similar reports of equipment failures. The Pentagon’s refusal to officially acknowledge the cyber nature of the August outages leaves questions about the extent of the vulnerability in U.S. critical infrastructure.

Cybersecurity experts warn that as industrial systems become more connected, they face greater exposure to adversaries. Josh Corman, a former official with the Cybersecurity and Infrastructure Security Agency, noted that while current attacks target food, future strikes could aim at temperature-sensitive drugs and laboratory materials. The group’s use of AI to bypass traditional defenses suggests a shift toward more sophisticated, automated attacks on physical infrastructure.