Iranian Hackers Spoil Food at Military Bases and Global Retailers

Cybersecurity analysts are tracking a coordinated campaign of digital attacks that has disrupted food supply chains across multiple continents. The incidents have resulted in spoiled inventory, operational downtime, and significant repair costs for businesses and government facilities. The pattern of strikes has shifted from isolated tests to widespread operational targets.

The campaign traces its origins to a targeted strike on a large Israeli food production plant in May. Iranian military hackers operating under the alias Cyber Isnaad Front compromised industrial controllers during a tense ceasefire. The attackers adjusted safety limits, opened gas pressure valves, and disabled alerts to force compressors to fail. The plant ceased operations for over a week while engineers awaited replacement parts from abroad.

In the months following the Israeli incident, unidentified hackers have targeted refrigeration systems in various countries. Confirmed strikes have hit U.S. military bases in August, French supermarkets in October, and retail stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium in early November. The attacks have spoiled fresh produce and forced businesses to halt operations while they assessed the damage to their aging equipment.

The U.S. Defense Commissary Agency, which manages grocery stores for military personnel, has experienced multiple outages. At least nine locations reported disruptions, including Fort Irwin in California and Fort Huachuca in Arizona. The Pentagon has not officially confirmed that hackers caused the outages, but investigators are treating them as cyberattacks. Public contracting documents reveal that these bases use Danfoss remote control systems, some dating to the mid-2000s, which lack the latest security updates.

French officials identified the same Danfoss controllers as the entry point for the October strikes on local supermarkets. The Defense Criminal Investigative Service has partnered with the Army Criminal Investigation Division and French law enforcement to examine the technical evidence. Two former officials who reviewed the ongoing investigation believe some data points toward Iran, though they note that confidence in that attribution is not yet high. The agency uses older versions of the software that can no longer receive secure updates.

Ari Ben Am, a threat intelligence researcher who has tracked the group for years, describes Cyber Isnaad Front as one of the more technically capable Iranian hacking groups. He notes that the group has a history of compromising surveillance cameras and using human actors in propaganda videos. Ben Am concluded that the hackers may have shared wiper malware tools with other Iranian groups, including the Cyber Av3ngers, which previously targeted water treatment facilities in the United States. The group appears to have a higher level of investment and executes more holistic operations than many other state-aligned actors.

Omri Segev Moyal, head of the Israeli incident response firm Profero, stated that the technical sophistication of these attacks is advancing rapidly due to access to artificial intelligence. He explained that the hackers were able to test numerous system configurations in a short time span to destroy the compressors. The speed of their actions suggests they are not relying on manual, human-paced trials. A propaganda video released in October showed a masked hacker typing on a keyboard, claiming the attack was launched on behalf of children in Gaza. The video also featured a salute to French students, a reference that preceded the confirmed strikes on French supermarkets by several weeks.

Josh Corman, a former cybersecurity official with the Cybersecurity and Infrastructure Security Agency, warned that connecting industrial refrigeration to the internet exposes critical infrastructure to adversaries. He noted that while current attacks target food, future strikes could aim at temperature-sensitive drugs and laboratory materials. Companies and governments must address long-standing security challenges to prevent further disruptions to essential services.