Hackers Spoil Food At Bases And Stores
Iranian-linked actors are targeting aging refrigeration systems in the U.S. and Europe, causing widespread food loss and operational delays.
By Adriana Abebe ·
Employees at a major Israeli food plant discovered broken compressors and spoiled inventory in May after a targeted cyberattack halted operations for more than a week. The attackers adjusted safety limits and opened gas pressure valves, effectively destroying the industrial freezers. Omri Segev Moyal, head of the incident response firm Profero, confirmed the group is Cyber Isnaad Front, an Iranian military hacking team also linked to 2024 U.S. election influence campaigns.
The attack has become a template for a global campaign targeting refrigeration controllers. Unidentified hackers have hit U.S. military bases in August, French supermarkets in October, and retail locations in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium in early November. Moyal described the pattern as a gradual build-up, with tests in Europe and the United States preceding a larger offensive.
Technical analysis suggests the attackers leveraged AI to rapidly test configurations and overwhelm aging hardware. Moyal noted the volume of attempts was too high for human operators alone. The group claims to have targeted the Israeli plant on behalf of starving children in Gaza, a message included in a propaganda video released in October. The video features a masked actor and surveillance footage from affected stores, though the connection to French student riots mentioned in the clip remains unclear.
U.S. Defense Commissary Agency installations, including Fort Irwin and Fort Huachuca, experienced outages that left freezers in defrost mode. Public contracting documents show these bases use Danfoss remote control systems, some dating to the mid-2000s, that are no longer receiving security updates. French officials identified the same Danfoss equipment as a vector in their supermarket incidents. The Pentagon has not officially confirmed a cyber origin but is treating the outages as such in its investigation.
Former officials said investigators believe evidence points toward Iran, though confidence in the attribution is not yet high. The Defense Criminal Investigative Service is coordinating with the Army Criminal Investigation Division and French law enforcement. Danfoss advised customers to remove vulnerable devices from the internet and update firmware to mitigate risks.
Ari Ben Am of Telemetry Data Labs, who tracks the group on Telegram, described Cyber Isnaad Front as technically capable and well-funded. He noted the group shares tools with other Iranian actors and uses human actors in videos to spread fear. The group has a history of compromising organizations with basic cyber defenses and using surveillance cameras to publicize their strikes.
