Over the past several months, a sequence of cyberattacks against industrial refrigeration systems has spread across three continents, exposing a silent but dangerous vulnerability in the infrastructure that maintains the cold chain for food, medicine, and blood. What began as a series of unexplained malfunctions at U.S. military bases in Arizona and Europe has evolved into a coordinated campaign, affecting at least a dozen countries and prompting joint warnings from CISA and the FBI this week.
The turning point came in August, when freezers at a store in Fort Huachuca, an Army base in Arizona, suddenly entered defrost mode. Temperature spiked, products spoiled, and a base officer posted a graphic account on social media: "Trust us when we say it was 'spoiled,' but believe me, it was way worse." Days later, the same symptom was reported at three other U.S. military bases in Europe, with Pentagon commissaries suffering simultaneous failures. The Department of Defense opened an investigation, but the connection between incidents remained thin — until Europe collapsed.
In October, French supermarkets were the first to feel the impact at scale. More than 40 stores with freezers from Belgian brand Sabcobel reported that their evaporators had been switched to defrost mode, raising internal temperatures to up to 50°C. Millions of euros in perishable goods were lost. The following month, the wave hit Belgium, Sweden, Ireland, the Netherlands, Estonia, Finland, and the UK — this time affecting at least 100 stores across seven countries. In Sweden, an ICA store in Sjöbo posted on Facebook: "Our refrigerators and freezers have been hacked and set to 50 degrees." The Coop chain saw six stores in Stockholm compromised. In Ireland, SuperValu lost freezers in 13 of its 223 stores.
What makes this case so troubling is not just the scale, but the sophistication of the attack. According to NPR's investigation, hackers gained access to the electronic controllers that remotely manage industrial freezers — devices normally found in isolated industrial environments, not exposed to the internet. The attackers did not just change the temperature: they adjusted safety limits, opened gas pressure valves, changed access credentials, and disabled monitoring logs. In one case in Israel, engineers discovered compressors broken by overheating, with smoke rising from the freezers. The local refrigeration company was stranded for more than a week waiting for spare parts from abroad.
The forensic trail points consistently to an Iran-linked group. Omri Segev Moyal, director of the Israeli incident response firm Profero, which responded to one of the cases, identified forensic data and direct claims from the attackers that led him to attribute the strikes to the Cyber Isnaad Front — an Iranian military group also linked to influence campaigns in the 2024 U.S. elections. In the group's propaganda video, a masked man sits in front of digital screens displaying the "Cyber Isnaad Front" logo. The group directly claimed responsibility for the freezer attacks.
But the most critical question is technical: what vulnerabilities allow a freezer controller to be hacked? The CISA advisory (ICSA-25-140-03) reveals the answer. Danfoss AK-SM 8xxA controllers, widely used in remote commercial refrigeration systems, contain three critical vulnerabilities: CVE-2025-41450 allows authentication bypass via date-and-time-generated passwords (CVSS 8.2); CVE-2025-41451 is a command injection leading to authenticated remote code execution (CVSS 7.6); and CVE-2025-41452 causes denial of service (CVSS 6.8). Danfoss released fixes, but NPR found that the Defense Commissary Agency — responsible for military commissaries — operates versions of the AK-SM 8xxA controllers dating to the mid-2000s that can no longer receive secure software updates.
This is the crux of the problem. Modern industrial refrigeration relies on internet-connected controllers for remote monitoring, energy efficiency, and predictive maintenance. But many of these devices were designed decades ago, without modern cybersecurity, and are exposed directly to public internet. When Danfoss stopped providing security updates for its older freezers, it effectively left a door open. The company stated it was aware of the incidents and advised customers to install the latest firmware, remove devices from the internet, and operate behind a firewall and VPN — which is, ironically, exactly what the entire cybersecurity industry has been saying for years: do not expose operational technology (OT) to public internet.
Thursday's joint alert from CISA, the FBI, the Department of Health and Human Services (HHS), the Department of Agriculture (USDA), and the Department of Transportation (DOT) is unprecedented in scope. For the first time, five U.S. federal agencies acknowledge that industrial refrigeration is not just a maintenance issue — it is a national security concern. "Every organization that depends on refrigeration and monitoring systems should assume it could be a target," said Chris Butera, CISA's acting executive assistant director for cybersecurity. The FBI warned that attacks are being seen across global critical infrastructure sectors, including food, agriculture, transportation, and medicine shipping.
The most recent — and most alarming — incident occurred on November 2 at three facilities of the EFS (Établissement Français du Sang), France's national blood bank. Hackers altered the temperature and defrost settings of the cold-storage chambers storing donated blood and biological samples. The EFS detected the changes quickly, transferred or stabilized affected products, and reported no loss of blood products or health impact. But the incident shows what could happen: a hacked freezer at a blood bank does not just spoil food — it can compromise lives.
Industry response has been slow. Many commercial refrigeration operators simply do not know their controllers are vulnerable. Profero estimated that the Cyber Isnaad Front is "one of the most technically capable hacking groups" its director has seen — but did not specify which groups are exploiting the Danfoss and Copeland/Dixell XWEB controller flaws. Several security experts, including Michael Garcia, policy director of the Operational Technology Cybersecurity Coalition, warn that the problem is structural: "We know the threat exists. It's only a matter of time until a malicious actor compromises something."
What this episode reveals is something bigger: the silent expansion of the cyber battlefield into physical assets no one would think to protect. A supermarket freezer, a cold-room temperature controller, a commissary monitoring system — these are not targets that appear in cyberwar briefings. But when hackers can turn a refrigerator into a weapon against the food and medicine supply chain, the line between cybercrime and physical sabotage disappears. And the question is whether industry is prepared to defend not just its data, but the very devices that keep the world running.
Sources: TechCrunch, NPR, CISA
✓ Independent sources cross-checked and verified before publishing
