Iranian hackers target refrigeration systems at U.S. Military bases

A cyberattack on a large food production plant in Israel in May 2026 left employees staring at printers spewing threatening messages while industrial freezers smoked. Engineers found broken compressors and spoiled inventory inside the units. The company’s operations stopped for more than a week while workers waited for replacement parts from abroad.

Omri Segev Moyal, head of the Israeli incident response firm Profero, responded to the breach. Moyal stated that the attackers used malicious code to wipe internal data and physically damage the cooling systems. The group adjusted safety limits, opened gas pressure valves, and disabled alerts. Moyal described the compressors as "eliminated" because the hackers overused them until they failed and produced smoke.

Moyal attributes the attack to Iranian military hackers operating under the name Cyber Isnaad Front. He notes that the same group was linked to influence campaigns targeting U.S. Elections in 2024. The strike occurred during a tense period in the ceasefire between Iran and Israel. Moyal said that the technical sophistication of the attack increased rapidly, likely due to access to artificial intelligence tools.

"They tried the simple things. And then they started to bombard the system with different types of configurations until they destroyed the compressor. It wasn't human, the amount of configurations they were able to try in a short time span," Moyal said. The hackers used AI to quickly understand the system configuration and test various settings. This process allowed them to break the machines in a timeframe that human engineers could not have achieved.

The attack on the Israeli plant is part of a wider trend of hackers targeting refrigeration controllers worldwide. In August, multiple U.S. Military commissaries experienced what the Pentagon described as a possible refrigeration disruption. At least nine locations reported outages, including Fort Irwin in California and Fort Huachuca in Arizona. The Defense Commissary Agency operates these grocery stores for military personnel.

Fort Huachuca shared a Facebook post saying an overnight equipment failure sent all freezers into defrost mode. A moderator for the page clarified that there was no power outage and that the switch heated up the food. The account posted that the food was "spoiled." The Pentagon has not officially acknowledged that hackers caused the disruptions, but the Defense Criminal Investigative Service is investigating the matter alongside French law enforcement.

In October, hackers targeted French supermarkets. In early November, attacks hit food stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium. These incidents involve the same aging industrial machines that manage global critical infrastructure. Josh Corman, a former cybersecurity official, said that connecting these devices to the Internet exposes them to adversaries. He warned that future attacks could target temperature-sensitive drugs and laboratory materials.

Public government contracting documents show that several U.S. Defense Commissary installations use Danfoss refrigeration remote control systems. Some of these controllers date to the mid-2000s and can no longer receive secure software updates. French officials identified the same Danfoss machines as a vector for the attacks in Europe. A Danfoss spokesperson said the company is aware of incidents in France and is in contact with affected customers.

Ari Ben Am, co-founder of threat intelligence company Telemetry Data Labs, tracks the Cyber Isnaad Front on the social media platform Telegram. He described the group as technically capable and well-invested. Ben Am concluded that the hackers may have shared digital tools, such as wiper malware, with other Iranian groups. The group has a history of compromising surveillance cameras and using human actors in propaganda videos.

The hackers released a propaganda video in October about the Israeli grocery store hack. The video features a masked man in a room of digital screens. He claims the attack was launched on behalf of the starving children of Gaza. The video also included a salute to French students in French. Ben Am noted that the group is one of the only Iranian hacking teams he has seen use human actors in their media releases.