Cyber Isnaad Front hits global refrigeration systems

A wave of cyberattacks targeting industrial refrigeration systems has disrupted operations in food plants, military bases, and retail stores across three continents.

The attacks began in March 2026 when hackers hit a small chain of kosher grocery stores in Israel, leaving customers with spoiled meat. In May, a targeted strike on a large Israeli food production plant halted its operations for more than a week. Engineers found broken compressors and internal data wiped after malicious code was introduced to the corporate network. The attacker, identified as the Cyber Isnaad Front, adjusted safety limits and disabled alerts to destroy the cooling equipment.

The pattern expanded internationally in August, affecting at least nine U.S. military commissaries, including those at Fort Irwin and Fort Huachuca. Base officials reported freezers entering defrost mode without a power outage, resulting in significant food spoilage. In October, French supermarkets experienced similar disruptions. By early November, the attacks reached food stores in Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium, including an IKEA location. The Pentagon has not officially confirmed the cyber nature of the U.S. incidents, though the Defense Criminal Investigative Service is collaborating with French law enforcement and the Army Criminal Investigation Division.

Investigators are treating the events as a coordinated cyberattack with evidence pointing toward Iran, although confidence in this attribution remains moderate. Ari Ben Am, a threat intelligence analyst, describes the Cyber Isnaad Front as a technically capable group working for the Iranian military. He notes the group has a history of compromising surveillance cameras and sharing propaganda videos. A video released in October showed a masked hacker saluting French students and claiming the attacks were launched for the children of Gaza.

The attacks exploit aging infrastructure. Public contracting documents show the U.S. Defense Commissary Agency uses Danfoss refrigeration controllers, some dating to the mid-2000s. French officials and cybersecurity firm Claroty identified these specific models as vulnerable. Danfoss advised customers to install the latest firmware and isolate the devices from the internet. Omri Segev Moyal, head of incident response firm Profero, stated that the attackers used AI to rapidly test system configurations until the compressors failed.

Josh Corman, a former cybersecurity official, warned that while current attacks target food, future strikes could aim at temperature-sensitive drugs and laboratory materials. The Defense Commissary Agency continues to operate the affected remote monitoring tools, with some systems running software that can no longer be updated with new security patches.