French officials cite vulnerable Danfoss controllers in supermarket attacks
The report by Jenna McLaughlin, with contributions from Eleanor Beardsley and Daniel Estrin, separated the Israeli plant attack attributed by an incident-response expert from a wider series of refrigeration disruptions involving unidentified hackers. The attributed case began on a May morning in Israel at a large food-production plant and its associated businesses. Employees watched office printers spontaneously produce reams of threatening messages, then found malicious code on corporate computers designed to wipe internal data. An engineer later smelled smoke coming from industrial freezers and found broken compressors and badly spoiled food. The plant stopped operating for more than a week while engineers waited for replacement parts from abroad. The report characterized the incident as a targeted, multi-pronged cyberattack.
Profero, an Israeli incident-response firm, responded to the attack. Omri Segev Moyal said, “I do a lot of cyber incidents, but this is the kind of incident that I know will leave a mark on the people in charge.” Moyal declined to identify the client because of confidentiality. Based on forensic data and direct claims by the culprits, he was confident that Iranian military hackers using the name Cyber Isnaad Front carried out the attack. Moyal said the group also had been linked to influence campaigns targeting U.S. elections in 2024. The destructive strike occurred during the waning days of a ceasefire between Iran and Israel, as tensions were ratcheting up. The attribution concerned the Israeli plant attack; NPR described the hackers behind the wider series as still unidentified.
Ari Ben Am, co-founder of threat intelligence company Telemetry Data Labs, which tracks chatter on the social media platform Telegram, and an adjunct fellow at the Foundation for the Defense of Democracy’s Center on Cyber and Technology Innovation, had tracked the group for years. Ben Am said Cyber Isnaad Front was working on behalf of the Iranian military and described it as one of the more technically capable Iranian hacking groups he had seen. “They appear to have a higher level of investment, a higher quality of activity like actual hacking…they really do much more effective, more holistic operations,” he said.
Ben Am’s early analysis of technical details from the Israeli plant attack, shared by Profero, concluded that the hackers may have shared digital tools such as wiper malware with other Iranian groups. One such group, Cyber Av3ngers, hacked machines at U.S. water and wastewater-treatment facilities in 2023 to display propaganda messages. Ben Am also said Cyber Isnaad Front had a history of compromising surveillance cameras and promoting its activity across social media platforms. It was the only Iranian group he had seen use human actors in videos, and he said, “They’re capable of consistently compromising actual organizations that have some degree of cyber defense.”
As early as March, hackers appeared to have targeted a small chain of kosher grocery stores in Israel, according to a video posted on social media. The video showed a customer touching previously frozen food, including soft, squishy packages of meat that had clearly spoiled. The company did not immediately respond to a request for comment. A propaganda video about the Israeli grocery-store attack was released in October. Although it had largely been removed from the internet, it was shared with NPR on the condition that Moyal’s client would not be identified. NPR said it would not publish the video to protect the client and avoid amplifying propaganda. The report said the video suggested that stoking fear was part of the hackers’ motivation.
Labeled with a glowing red triangle embossed with the Cyber Isnaad Front logo, the video showed a masked man typing at a bank of digital screens before revealing hacked surveillance footage of customers across Israel in supermarkets affected by the large-scale destruction, as well as employees at the company finding printed propaganda materials. In Arabic, the hackers claimed they launched the attack on behalf of the starving children of Gaza before ending with a French-language salute to French students. NPR described the ending as likely referring to “ongoing riots in France over education,” while saying the reason for the reference was unclear. The group had previously impersonated a French far-right group and targeted the Israeli delegation to the 2024 Paris Olympics. The video came weeks before the widespread attacks on French supermarkets, but NPR said the timing could have been coincidental.
Over the following months, still-unidentified hackers targeted refrigeration controllers around the world, and NPR said the disruptions appeared to have become a trend. They spoiled fresh produce and cost businesses time and money. The attacks occurred at U.S. military bases in August, French supermarkets in October and food stores ranging from small markets to big-box stores such as IKEA in countries including Sweden, Estonia, Ireland, Luxembourg, the Netherlands and Belgium in early November. Moyal said, “We’re observing targeted attacks gradually built and practiced against Israel, tested in Europe and the U.S., and unleashed [now].”
According to Moyal, hackers broke into industrial controllers that helped manage and monitor the freezers. They also adjusted safety limits, opened gas pressure valves, changed credentials, disabled alerts and destroyed forensic evidence in the middle of the night. Moyal said the attackers exploited vulnerable devices and the laws of thermodynamics to render the compressors “eliminated.” “They were blown up … not like C4 exploding, but they got overused and there was smoke. They were not repairable,” he said. Replacing parts and recovering from the attack cost the client time and money.
In August, the Pentagon described a “possible refrigeration disruption” at multiple U.S. military commissaries, grocery stores owned and operated by the Defense Commissary Agency, a Pentagon wing. The exact number of affected sites was unclear, although an independent blogger cited social-media posts and independent confirmations of disruptions at at least nine locations. Very few details had emerged about how attackers might have compromised the systems. The Pentagon refused to say whether it believed hackers were responsible.
Two former officials who requested anonymity to discuss an ongoing investigation said investigators were treating the U.S. outages as a cyberattack. They said some evidence pointed toward Iran, although their confidence in that attribution was not high. The Defense Criminal Investigative Service, the criminal investigative arm of the Pentagon’s Office of Inspector General, partnered with the Army Criminal Investigation Division’s Cyber Field Office and French law enforcement following the hacks across stores in France, according to a statement shared with NPR.
NPR reported publicly available indications that the Defense Commissary Agency deployed remote-monitoring control tools for refrigeration and HVAC systems that could be vulnerable to ongoing attacks. An NPR review of public government contracting documents found that multiple U.S. Defense Commissary installations, including several with disclosed outages such as Fort Irwin and Fort Huachuca, were operating Danfoss refrigeration remote-control systems. French officials and Claroty cybersecurity experts had identified the products as vulnerable to attack.
French officials cited the same Danfoss machines as one vector in the confirmed supermarket incidents across France in October. French cybersecurity agency ANSSI was investigating the outages and communicating with supermarkets, controller manufacturers and other industrial sectors that might be affected, a press officer said in a statement to NPR. The contracting documents also showed that the Defense Commissary Agency was using several older Danfoss controller versions, including some from the mid-2000s that could no longer receive updated, secure software.
A Danfoss spokesperson, Tate, declined to discuss specific customer relationships. She told NPR the company was “aware of incidents in France affecting a limited number of refrigeration management systems” and “are in close contact with affected customers to support them in addressing their situation.” Tate explained that Danfoss advised customers to mitigate the risks by installing the latest firmware, removing the devices from the internet and operating them behind a firewall and VPN.
Social-media posts about individual incidents on U.S. bases suggested that the outages were not isolated equipment failures that might have resulted from environmental factors. Fort Huachuca, an Army base in Arizona that houses the Army’s intelligence division, shared on Facebook that the post’s commissary experienced “an overnight equipment failure” that resulted in “all freezers [going into] defrost mode.” A moderator said there had been no power outage and that the switch to defrost mode “heated up all the food.” The account added, “Trust us when we say it was ‘spoiled,’” The official social-media account for Fort Irwin, home of the Army’s National Training Center in the Mojave Desert in California, said technicians were “working around the clock” to “repair” the systems, that the outages were affecting bases around the country and that they were waiting for “temperatures [to] stabilize” before restocking.
Military spouse Ashley Upshaw, who lives on Fort Irwin, learned about the outage through social media and a spouse forum. “People were posting that all the frozen areas were blocked off, that there were no fruits, no vegetables. Like everything was cleared out. We didn’t know exactly what was going on,” she said. Upshaw said people on base, including those in town for training, were forced to drive more than 40 minutes to the nearest grocery store, buy shelf-stable foods from the base thrift store or pool resources with neighbors. “There were a lot of people helping others out,” she said.
Upshaw said she did not believe the military had issued an official announcement identifying a cyberattack, although social-media users were speculating about one, including on a popular page called “U.S. Army W.T.F! Moments.” Some commenters questioned why internet-connected refrigeration systems could be accessed on a base requiring military clearance. “You need clearance to even get on base. So why not have the same mentality for other things like refrigeration systems and stuff like that?” Upshaw said.
Following the U.S. base outages, things were quiet for weeks, and the disruptions were limited to a handful of targets. It was unclear why hackers had not compromised more of the 107 Defense Commissary stores in the United States and abroad. In October, a supermarket manager outside Dijon, France, received a four-in-the-morning call from a surveillance company reporting that temperatures were rising in the store’s refrigerators and cold rooms. He found freezers that were practically ovens.
The manager’s store was one of hundreds whose fresh food was spoiled that day. The French attacks hit hundreds of supermarkets across chains including Intermarché, Coopérative U and Carrefour, although the affected systems represented a small fraction of the stores and devices in those companies’ portfolios. Similar attacks later hit supermarkets in at least six more European countries, and NPR said the trend appeared to be continuing to escalate. Officials in Sweden and Estonia said the impact was more limited because of warnings following the French incidents, but the full extent of the new wave remained unfolding. Officials continued to investigate the separate outages while governments and industries checked whether vulnerable devices remained in use.
Moyal said the technical sophistication of the attacks was advancing in part because of AI. “What we were able to see is they very rapidly were able to, almost like magic, go from initially playing with the system to fully understanding how the configuration works,” he said. “They tried the simple things … and then they started to bombard the system with different types of configurations until they destroyed the compressor. It wasn’t human, the amount of configurations they were able to try in a short time span.”
NPR also reported that bad actors with access to AI were breaking into and taking control of aging machinery that runs global critical infrastructure, from water pumps to cooling systems. Cybersecurity experts said the attacks should pressure governments and companies to find solutions to long-standing security challenges before conditions worsen. Josh Corman, a former Cybersecurity and Infrastructure Security Agency official who specializes in public safety, said, “With great connectivity comes great responsibility.” He added, “As we connect industrial refrigeration to the Internet, we expose it to accidents and adversaries.” “While these [attacks] hit food,” Corman said, the next ones could go after “temperature sensitive drugs and laboratory materials.”
NPR placed the refrigeration attacks within a wider geopolitical context, describing such attacks as “increasingly becoming a normal part of geopolitical conflict.” The report cited Russian hackers shutting off power in Ukraine and Chinese hackers burrowing into U.S. critical infrastructure to provide a foothold that could cause damage in a potential future conflict such as a Chinese invasion of Taiwan. NPR also reported that experts had linked disruptive attacks on U.S. water-treatment plants in August to Iran, within weeks of the Defense Commissary outages.
Separately, NPR said that after a brief interlude years ago when some criminal hackers claimed they would not target sensitive systems such as those used in hospitals, many had since done so. NPR said this was likely because the opportunity to make money by holding critical systems hostage was too lucrative to ignore, drawing a comparison with the ransomware attack on Colonial Pipeline in 2021. That explanation concerned the potential financial incentive for such attacks; the report did not establish it as the motive for every incident.
Operational technology refers to digital machines that control physical processes, and experts said securing it presented a uniquely difficult challenge that had troubled cybersecurity specialists for years and was worsening. Michael Garcia, policy director of the Operational Technology Cybersecurity Coalition, a coalition of government and industry partners working to improve cybersecurity and resilience for critical infrastructure, said, “This has always been an issue… We know the threat is there, and it’s just a matter of time before a bad actor compromises something.”
It was difficult to estimate the full extent of exposed devices, ranging from remote-monitoring systems to programmable logic controllers, or the reasons they were vulnerable. Cybersecurity firms had nevertheless identified thousands of refrigeration systems alone still exposed to basic attacks after the widely publicized French incidents.
In recent years, there has been a trend toward greater connectivity between devices, allowing individuals to remotely manage massive networks of machines from a central location. NPR said the model made sense for major corporations dealing with complex machines that on-site staff could not adequately manage, unlike a household refrigerator. But many operational systems were not originally designed for internet connectivity or security. Many others were aging and could no longer be patched because their manufacturers had moved to newer versions. NPR reported that officials and executives running operational technology often had limited or no visibility into which devices they operated, which devices were vulnerable or what protections were installed, and that some of those people had not invested in securing the systems as they should.
Claroty first published a report on refrigeration-technology vulnerabilities in August. Claroty CTO Amir Preminger said, “Internet exposed devices were always the soft underbelly of operational technology.” Preminger said, “Devices can be vulnerable to [bugs] that were discovered and nobody fixed them,” and, “They can be known vulnerabilities and nobody patched. And there can just be the fact that there’s no security measures. If you leave that door open, anyone can come in and do whatever he wants.” The broader attackers remained unidentified, and officials continued to investigate the outages separately.