Danfoss Refrigeration Systems Hit by Global Cyber Campaign

Nine U.S. military commissaries experienced confirmed refrigeration disruptions this summer, according to independent tracking of social media posts. The outages forced the Defense Commissary Agency to halt operations at several locations, including Fort Irwin and Fort Huachuca. Employees at these bases reported that freezers switched into defrost mode without a power cut, heating the inventory until it spoiled.

The attacks are part of a wider campaign targeting industrial refrigeration controllers worldwide. In early November, food stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium reported similar incidents. French supermarkets faced confirmed hacks in October. These strikes follow an initial wave of attacks in Israel, where a large food production plant suffered a multi-pronged cyberattack in May.

Omri Segev Moyal, head of the Israeli incident response firm Profero, responded to the Israeli plant attack. He said hackers accessed industrial controllers, adjusted safety limits, and opened gas pressure valves. The engineers found broken compressors and spoiled food inside the units. The company lost operations for more than a week while waiting for replacement parts.

Moyal attributes the Israeli attacks to the Cyber Isnaad Front, a group of Iranian military hackers. He notes the same group influenced U.S. election campaigns in 2024. The attacks occurred during a fragile ceasefire between Iran and Israel. Moyal describes the operation as a destructive digital strike that tested the group's capabilities before expanding globally.

Josh Corman, a former official with the Cybersecurity and Infrastructure Security Agency, warns that connecting industrial machines to the internet exposes them to adversaries. He notes that while current attacks hit food supplies, future strikes could target temperature-sensitive drugs and laboratory materials. Corman emphasizes that connectivity increases the surface area for potential breaches.

Public government contracting documents show the Defense Commissary Agency operates Danfoss refrigeration remote control systems at multiple installations. Some of these units date to the mid-2000s and can no longer receive secure software updates. French officials identified the same Danfoss machines as a vector for the October supermarket hacks. A Danfoss spokesperson confirmed the company is in close contact with affected customers to address the situation.

Ari Ben Am, co-founder of threat intelligence company Telemetry Data Labs, has tracked the Cyber Isnaad Front for years. He describes the group as one of the more technically capable Iranian hacking teams. Ben Am suggests the hackers may share digital tools, such as wiper malware, with other Iranian groups like the Cyber Av3ngers. That group hacked water treatment facilities in the U.S. in 2023.

The Pentagon has not officially confirmed that hackers caused the U.S. base outages. However, the Defense Criminal Investigative Service is partnering with the Army Criminal Investigation Division and French law enforcement. Two former officials who discussed the ongoing investigation said investigators are treating the outages as a cyberattack. They believe evidence points toward Iran, though confidence in that attribution remains low.

The Defense Commissary Agency is using remote monitoring tools that cybersecurity experts say are vulnerable. The agency is advised to install the latest firmware and remove devices from the internet where possible. Fort Huachuca posted on Facebook that its commissary experienced an overnight equipment failure. The account moderator clarified that there was no power outage and that the defrost mode heated up all the food.