Hackers Spoiled Food at Nine U.S. Military Bases in August

At least nine U.S. military commissaries experienced refrigeration outages in August, according to social media posts and independent confirmations reviewed by NPR. The Defense Commissary Agency, a wing of the Pentagon, has not officially confirmed that hackers caused the disruptions, but the Defense Criminal Investigative Service is treating the incidents as cyberattacks. Two former officials involved in the inquiry told NPR that some evidence points toward Iran as the culprit, though they noted that confidence in that attribution is not yet high.

The attacks exploit specific hardware vulnerabilities. Public government contracting documents show that multiple installations, including Fort Irwin and Fort Huachuca, operate Danfoss remote control systems for refrigeration and HVAC. French officials identified these same Danfoss machines as the vector for confirmed hacks at supermarkets in October. The contracting records indicate that several of these controllers are from the mid-2000s and can no longer receive new secure software updates. A Danfoss spokesperson told NPR that the company is aware of incidents in France and is advising customers to install the latest firmware or remove the devices from the internet.

The wave of attacks follows a destructive cyberstrike in May against a large food production plant in Israel. Omri Segev Moyal, head of the incident response firm Profero, described the attack as a multi-pronged assault. Hackers broke into industrial controllers, adjusted safety limits, and disabled alerts. They used the laws of thermodynamics to overuse the compressors until they failed. Moyal said the equipment was blown up not by explosives, but by being forced to run beyond its capacity. The company’s operations halted for over a week while engineers waited for replacement parts from abroad.

Moyal attributes the Israeli attack to Cyber Isnaad Front, an Iranian military hacking group. He notes that the group has a history of linking its operations to influence campaigns, including those targeting U.S. elections in 2024. Ari Ben Am, co-founder of Telemetry Data Labs, tracks the group on Telegram and says it demonstrates a high level of technical capability. Ben Am concluded that the hackers may have shared digital tools, such as wiper malware, with other Iranian groups like Cyber Av3ngers, which targeted water treatment facilities in the U.S. in 2023.

The use of artificial intelligence appears to have accelerated the attacks. Moyal observed that the hackers rapidly moved from testing the system to fully understanding its configuration. They bombarded the system with different types of configurations until the compressor was destroyed. Moyal stated that the speed and volume of the configurations tested were not achievable by human operators alone. A propaganda video released in October showed a masked hacker claiming the attack was launched on behalf of the starving children of Gaza. The video also referenced French students, a group that had been targeted in previous operations by Cyber Isnaad Front.

Josh Corman, a former cybersecurity official with the Cybersecurity and Infrastructure Security Agency, warned that connecting industrial refrigeration to the Internet exposes these systems to accidents and adversaries. He noted that while current attacks hit food, future threats could target temperature sensitive drugs and laboratory materials. The Pentagon’s Defense Commissary Agency continues to investigate the August outages, with partners including the Army Criminal Investigation Division and French law enforcement.