A cyberattack on an Israeli food production plant damaged industrial freezers, spoiled food and halted operations for more than a week, according to incident responders who investigated the breach. The case is part of a wider series of attacks targeting refrigeration systems at military stores and supermarkets in the United States, France and other European countries.
At the Israeli plant, attackers accessed controllers used to manage and monitor freezers. They changed safety settings, opened gas pressure valves, altered login credentials, disabled alerts and removed forensic evidence, said Omri Segev Moyal, head of the response firm Profero. The resulting damage left compressors beyond repair, he told NPR.
Moyal attributed the attack to the Iranian-linked Cyber Isnaad Front, citing forensic findings and claims by the attackers. That attribution has not been independently confirmed in the material provided. The group’s October propaganda video showed footage linked to the Israeli incidents, though NPR did not publish it.
Refrigeration disruptions were reported at U.S. military commissaries in August. The Pentagon described them as a “possible refrigeration disruption” but has not officially confirmed that hackers were responsible. Two former officials told NPR that investigators are treating the outages as a cyberattack and that some evidence points to Iran, though confidence in that attribution remains low.
In October, refrigeration failures affected hundreds of French supermarkets across several chains, including Intermarché, Coopérative U and Carrefour. French cybersecurity agency ANSSI is investigating. In early November, further attacks were reported at food stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands and Belgium; the full extent of the impact was still being assessed.
NPR’s review of public contracting documents found that some U.S. Defense Commissary Agency locations use Danfoss remote-control systems for refrigeration and heating. French officials and cybersecurity firm Claroty have identified Danfoss controllers as a potential attack vector in incidents in France. Some U.S. installations reportedly use older versions that can no longer receive updated secure software. Danfoss said it was supporting affected customers and advised users to install the latest firmware, disconnect devices from the internet, and use a firewall and VPN.
The incidents highlight the risks of connecting operational technology—the equipment that controls physical processes—to the internet. Cybersecurity experts say outdated or exposed systems can be vulnerable to attacks that cause real-world disruption. They also warn that similar weaknesses could affect systems managing temperature-sensitive medicines and laboratory materials, not only food refrigeration.
Sources: NPR News.