A new cold war: hackers target fridges across the globe

toggle caption i Fred Tanneau/AFP via Getty Images

It was a May morning in Israel when employees at a large food production plant watched in horror as the office printers started spontaneously spitting out reams of threatening messages.

Then, employees found malicious code on corporate computers designed to wipe away internal data.

Finally, an engineer smelled smoke coming out of the industrial freezers, only to find broken compressors and badly spoiled food inside.

The company's operations ground to a halt for over a week while engineers waited for new parts to arrive from abroad.

It was all the result of a targeted, multi-pronged cyberattack.

Sponsor Message

"I do a lot of cyber incidents, but this is the kind of incident that I know will leave a mark on the people in charge," said Omri Segev Moyal, head of an Israeli incident response firm called Profero, which responded to the attack.

Based on forensic data and direct claims from the culprits, Moyal is confident Iranian military hackers who currently go by the name Cyber Isnaad Front, the same group linked to influence campaigns targeting U.S. elections in 2024, are behind the attack on the refrigeration systems. It was a destructive digital strike that took place during the waning days of a ceasefire between Iran and Israel when tensions were ratcheting up.

In the months since, it appears to have become a trend.

Still unidentified hackers have targeted refrigeration controllers around the world. They have spoiled fresh produce and cost businesses time and money. These attacks have taken place on U.S. military bases in August, French supermarkets in October, and at food stores from small markets to big box stores like IKEA in countries including Sweden, Estonia, Ireland, Luxembourg, the Netherlands, and Belgium in early November.

"We're observing targeted attacks gradually built and practiced against Israel, tested in Europe and the U.S., and unleashed [now]," Moyal said in an interview with NPR.

Sponsor Message

Across the globe, bad actors with access to AI are breaking into and taking control of the aging machines that run global critical infrastructure, from water pumps to cooling systems. That should put pressure on governments and companies to find solutions to long-standing security challenges before things get even worse, cybersecurity experts say.

"With great connectivity comes great responsibility," said Josh Corman, a former cybersecurity official with the Cybersecurity and Infrastructure Security Agency who specializes in public safety. "As we connect industrial refrigeration to the Internet, we expose it to accidents and adversaries," Corman continued. "While these [attacks] hit food," he said, the next ones could go after "temperature sensitive drugs and laboratory materials."

Origins in Israel

As early as March, hackers appear to have targeted a small chain of kosher grocery stores in Israel, according to avideo posted to social media. In the video, a customer is touching previously frozen food including soft, squishy packages of meat that have clearly spoiled. The company did not immediately respond to a request for comment about the incident.

A couple months later, hackers went after a bigger target in the food production plant and its associated businesses, the incident Profero was called in to respond to. Moyal declined to share the name of the company due to client confidentiality, but described further details about the incident to NPR.

The hackers broke into the industrial controllers that helped manage and monitor the freezers. They also adjusted the safety limits, opened the gas pressure valves, changed the credentials, disabled alerts, and destroyed forensic evidence in the middle of the night. They took advantage of the vulnerable devices as well as the laws of thermodynamics to render the compressors "eliminated," Moyal said. "They were blown up … not like C4 exploding, but they got overused and there was smoke. They were not repairable."

Sponsor Message

The technical sophistication of these attacks is advancing, in part thanks to AI, Moyal added.

"What we were able to see is they very rapidly were able to, almost like magic, go from initially playing with the system to fully understanding how the configuration works," Moyal said. "They tried the simple things … and then they started to bombard the system with different types of configurations until they destroyed the compressor. It wasn't human, the amount of configurations they were able to try in a short time span."

Replacing parts and recovering from the attack were costly, in time and money, Moyal added.

But the hackers didn't stop there.

A propaganda video about the Israeli grocery store hack was released in October. While it was largely wiped from the internet, it was shared with NPR on the condition that the identity of Moyal's client wouldn't be revealed. NPR is choosing not to publish it for that reason and not to aid in the spread of propaganda. That video suggests stoking fear was part of the hackers' motivation.

In the video, labeled with a glowing red triangle embossed with the "Cyber Isnaad Front" logo, a masked man sits in a room full of digital screens, typing away on a keyboard before revealing hacked surveillance footage of customers across Israel in supermarkets that were affected by the large-scale destruction, as well as employees at the company finding the printed propaganda materials.

In Arabic, the hackers claim to have launched the attack on behalf of the starving children of Gaza, closing out with the hacker saluting French students in French, likely a reference to ongoing riots in France over education. It's unclear why the video references French students, though the group has impersonated a French far-right group in the past and targeted the Israeli delegation to the 2024 Paris Olympics. The video was also released just weeks before the widespread digital attacks against French supermarkets, but it's unclear if that timing is coincidental.

Sponsor Message

Ari Ben Am, the co-founder of a threat intelligence company called Telemetry Data Labs that tracks chatter on the social media platform Telegram, has been tracking this group for years. He says it's working on behalf of the Iranian military.

Ben Am, an adjunct fellow at the Foundation for the Defense of Democracy's Center on Cyber and Technology Innovation, says it's one of the more technically capable Iranian hacking groups he has seen.

"They appear to have a higher level of investment, a higher quality of activity like actual hacking…they really do much more effective, more holistic operations," he said.

Ben Am conducted an early analysis of the technical details of the hack of the Israeli food plant shared by Profero. He concluded that it's possible that these hackers may have shared some digital tools like wiper malware with other Iranian hacking groups like the Cyber Av3ngers. That group hacked machines in water and wastewater treatment facilities in the U.S. in 2023 to display propaganda messages.

Cyber Isnaad Front, Ben Am says, has a history of hacking into surveillance cameras and promoting their activities across a range of social media platforms, and it's the only Iranian group he has seen use human actors in videos.

"They're capable of consistently compromising actual organizations that have some degree of cyber defense," he concluded.

The military fridges

In August,there was what the Pentagon described as a "possible refrigeration disruption" at multiple U.S. military commissaries, grocery stores owned and operated by the Defense Commissary Agency, a wing of the Pentagon. It's unclear exactly how many experienced outages, though an independent bloggercited social media posts and independent confirmations of disruptions for at least nine locations. Very few details have emerged about how bad actors might have compromised those systems.

The Pentagon has so far refused to officially acknowledge whether or not it believes hackers were responsible for the refrigeration disruptions.

Sponsor Message

However, the Defense Criminal Investigative Service, the criminal investigative arm of the Pentagon's Office of Inspector General, has partnered with the Army Criminal Investigation Division's Cyber Field Office and French law enforcement following the hacks across stores in France, according to a statement shared with NPR.

According to two former officials who requested anonymity to discuss an ongoing investigation, investigators are treating the outages as a cyberattack and believe some evidence points towards Iran as the culprit, though there's not high confidence in that attribution yet.

While many questions remain about the incidents at the commissaries, there are clues across the internet about vulnerabilities that may have exposed these systems to compromise.

Publicly, there are indications that the Defense Commissary agency deploys remote monitoring control tools for their refrigeration and HVAC systems that could be vulnerable to ongoing attacks.

According to a review of public government contracting documents by NPR, multiple U.S. Defense Commissary installations, including several which have disclosed outages like Fort Irwin and Fort Huachuca, are operating Danfoss refrigeration remote control systems, products that have been identified by French officials and cybersecurity experts from a firm called Claroty as being vulnerable to attack.

French officials have cited those same Danfoss machines as one of the vectors of the confirmed incidents across French supermarkets in October.

According to those same contracting documents, the U.S. Defense Commissary agency is using several older versions of the Danfoss controllers, including some from the mid-2000s that can no longer be updated with new, secure software.

While a spokesperson for Danfoss declined to comment on specific customer relationships, she told NPR that the company is "aware of incidents in France affecting a limited number of refrigeration management systems" and "are in close contact with affected customers to support them in addressing their situation."

Sponsor Message

Danfoss has advised customers to mitigate the risks by installing the latest firmware, removing the devices from the internet, and operating behind a firewall and VPN, Tate explained.

Social media posts about individual incidents on U.S. bases suggest these were not isolated outages that might've been caused by other environmental factors.

Fort Huachuca, an Army base in Arizona that houses the Army's intelligence division, shared on Facebook that the post's commissary experienced "an overnight equipment failure" that resulted in "all freezers [going into] defrost mode." The page's moderator clarified in the comments section of the post that there was no power outage, and that the switch to defrost mode "heated up all the food."

"Trust us when we say it was 'spoiled,'" the account posted.

The official social media account for Fort Irwin, the home of the Army's National Training Center in the Mojave Desert in California, shared that technicians were "working around the clock" to "repair" the systems, and that the outages were affecting bases around the country. They wrote that they were waiting for "temperatures [to] stabilize" before restocking.

Ashley Upshaw, a military spouse living on Fort Irwin, told NPR she found out about the outage online through social media and a spouse forum.

"People were posting that all the frozen areas were blocked off, that there were no fruits, no vegetables. Like everything was cleared out. We didn't know exactly what was going on," she said.

People on base, including those in town for training, were forced to drive more than 40 minutes to go to the nearest grocery store, buy shelf-stable foods from the base's thrift store, or pool resources with neighbors, she said. "There were a lot of people helping others out," she said.

When asked what the military told families about the incident, she said she didn't believe there was any official announcement about a cyberattack but that was what people were speculating about on social media, including on a popular page called "U.S. Army W.T.F! Moments."

Sponsor Message

Across social meda, commenters expressed frustration that the commissary refrigeration systems were connected to the internet at all.

"You need clearance to even get on base. So why not have the same mentality for other things like refrigeration systems and stuff like that?" Upshaw said.

The French connection

Following the mysterious outages at the bases, things were quiet for weeks. The disruptions were limited to a handful of targets. It's unclear why hackers didn't manage to compromise more of the 107 Defense Commissary stores in the U.S. and abroad.

Then, in October, a manager of a French supermarket outside of Dijon told NPR he got a call from a surveillance company at four in the morning telling him that temperatures were shooting up in the store's refrigerators and cold rooms before he came to find his freezers practically turned into ovens.

His store was one of hundreds whose fresh food was spoiled that day. The French cybersecurity agency ANSSI is in the middle of an ongoing investigation into what happened, and is in communication not just with the supermarkets and the companies that make the controllers, but also with other industrial sectors "which might be impacted by this incident," a press officer for the ANSSI wrote in a statement to NPR. The attacks on French supermarkets were more wide ranging, hitting hundreds of supermarkets across multiple chains including Intermarché, Coopérative U and Carrefour. Even so, the number of affected systems was actually still a small fraction of the total number of stores and devices within those company's portfolios.

Now, with attacks hitting supermarkets in at least six more European countries, the trend of compromising refrigeration technology appears to be continuing to escalate. Some officials including those in Sweden and Estonia have said impacts were more limited than they could have been, given the warnings they received from what happened in France. However, the full extent of the impacts of the new wave of attacks is still unfolding.

Sponsor Message

Officials are still investigating all these separate outages, while governments and industries are scrambling to determine whether they're still operating devices that are vulnerable.

The internet of insecure things

Hackers remotely dialing up the temperature in industrial freezers or damaging other critical devices from a world away sounds a lot like science fiction.

But it's happening. Despite a brief interlude years ago when some criminal hackers claimed that they wouldn't target sensitive systems like those used in hospitals, many hackers have since done so.

That's likely because the opportunity to make money by holding critical systems hostage is simply too lucrative to ignore, like the ransomware attack on Colonial Pipeline in 2021.

Meanwhile, these kinds of attacks are increasingly becoming a normal part of geopolitical conflict, whether that's Russian hackers shutting off the power in Ukraine, or Chinese hackers burrowing into U.S. critical infrastructure to provide a foothold to cause damage in the event of a potential future conflict like a Chinese invasion of Taiwan. Additionally, experts have linked a series of disruptive attacks on U.S. water treatment plants in August to Iran, within weeks of the Defense Commissary outages.

In reality, securing operational technology, the digital machines that control physical processes in the real world, is a uniquely difficult challenge that has plagued cybersecurity experts focused on it for many years and is only getting worse.

"This has always been an issue," explained Michael Garcia, the Policy Director of the Operational Technology Cybersecurity Coalition, a coalition of government and industry partners working to improve cybersecurity and resilience for critical infrastructure. "We know the threat is there, and it's just a matter of time before a bad actor compromises something."

It's difficult to estimate the full extent of how many of these devices, from remote monitoring systems to what are called programmable logic controllers, are vulnerable to attack and for what reason, though cybersecurity firms have identified thousands of refrigeration systems alone still exposed to basic attacks even after the widely publicized incidents in France.

Sponsor Message

In recent years, there's been a trend towards greater connectivity between devices, to allow individuals to remotely manage massive networks of machines from a central location. It makes sense, particularly for major corporations who are dealing with complex machines that can't be adequately managed by individuals onsite, unlike a household refrigerator. But many of these systems were not originally designed with internet connectivity or security in mind.

On top of that, many of these systems are aging and can no longer be patched at all, because the companies that made them have moved on to newer versions.

And finally, many of the officials or executives whose agencies or businesses run operational technology have limited to no visibility into the specific devices they're using, which ones are vulnerable, or whether or not they have cybersecurity protections in place. Some of those people haven't invested in securing these systems the way they should.

"Internet exposed devices were always the soft underbelly of operational technology," explained Amir Preminger, the chief technology officer for cybersecurity firm Claroty. Claroty first published a piece on the vulnerabilities in refrigeration technology back in August.

"Devices can be vulnerable to [bugs] that were discovered and nobody fixed them," Preminger said. "They can be known vulnerabilities and nobody patched. And there can just be the fact that there's no security measures. If you leave that door open, anyone can come in and do whatever he wants."

— Eleanor Beardsley and Daniel Estrin contributed to this story.