Iran-linked hackers sabotage refrigeration controllers across Israel, the US and Europe
NPR reports that a group calling itself Cyber Isnaad Front, which Israeli incident responders attribute to Iranian military hackers, has sabotaged industrial refrigeration systems from a food plant in Israel to roughly 300 French supermarkets and, in early November, retailers across six more European countries. Internet-exposed Danfoss controllers were a common entry point.
The cyber front of the Iran war has reached the cold chain. NPR reported on 7 November that hackers apparently linked to Iran have sabotaged industrial refrigeration controllers in Israel, the United States, France and several other European countries, in a campaign that has escalated through the autumn. Experts quoted warn that the same techniques could next be turned on temperature-sensitive drugs and laboratory materials.
The most forensically detailed incident is an Israeli food-production plant whose freezers were attacked in May, during the waning days of a ceasefire. Attackers broke into industrial controllers, changed safety limits and credentials, disabled alerts, opened gas-pressure valves and destroyed forensic evidence; compressors were wrecked and operations halted for over a week, while office printers churned out threats and corporate PCs were hit with wiper malware. Omri Segev Moyal of Profero, the responding firm, says forensic data and the attackers' own claims make him confident Iranian military hackers were responsible.
The group currently styles itself Cyber Isnaad Front and is the same actor linked to 2024 US election influence operations, according to Ari Ben Am of Telemetry Data Labs, who says it works on behalf of the Iranian military and may have shared wiper tools with Cyber Av3ngers. In August the Pentagon described a "possible refrigeration disruption" at multiple Defense Commissary Agency stores; US investigators reportedly suspect Iran with low confidence. On 12 October attacks hit Intermarché, Coopérative U and Carrefour in France, affecting several hundred stores, and in early November supermarkets in Sweden, Estonia, Ireland, Luxembourg, the Netherlands and Belgium, including IKEA food outlets, were struck.
The common weakness is mundane: internet-exposed remote refrigeration controllers, with Danfoss units named by French officials and Claroty as one vector. Some installations date to the mid-2000s and can no longer receive secure updates. Danfoss has told customers to patch, remove devices from the public internet and use firewalls and VPNs; Forescout says thousands of refrigeration systems remain exposed to basic attacks. The campaign fits a pattern US agencies have warned about since April, when CISA, the FBI and NSA detailed Iranian-affiliated actors manipulating Rockwell, Schneider and Siemens programmable logic controllers in US water and energy utilities.
Why it matters
This is operational-technology sabotage against civilian commercial targets, chosen for visibility rather than strategic value and executed through the cheapest possible entry points. It demonstrates that the war's cyber dimension is global, that attribution is fast but confirmation slow, and that the attack surface is every unpatched controller with a public IP address.
Indicops view
Indian enterprises in food, pharma, logistics and healthcare should assume the same controllers and the same exposure exist in their estates, and run an inventory of internet-reachable OT devices this month. For government, the lesson is that critical-infrastructure protection must extend beyond power and water to cold chains and building systems. Where we deploy AI monitoring over OT telemetry, the first value is simply detecting a setpoint that has been changed by someone who should not have been there.
More in AI News
Back to the newsroomJensen Huang steps down as Nvidia CEO; CFO Colette Kress becomes interim chief
Nvidia's founder resigned as chief executive on 12 November after a board meeting, with CFO Colette Kress taking over on an interim basis while a search begins. The shares fell as much as 13 per cent, and quarterly results are due on 17 November.
Google adds TPU 8tx and 8i Max, taking its eighth-generation TPU family to four chips
Google has expanded its eighth-generation TPU line with TPU 8tx, for confidential inference and small-scale training, and TPU 8i Max, a dual-chip package for long-context inference. It also open-sourced TorchTPU and TPU Sync. Availability dates for the new chips were not given.
HSBC warns India's data-centre build-out could add $105 billion to the import bill
HSBC Global Research estimates that India's planned jump from roughly 1.5 GW to 6.5 GW of data-centre capacity will require about $105 billion of imported equipment, close to 2.5 per cent of GDP. Chips account for the bulk of it, and the bank urges a staggered expansion funded by foreign capital.