Officials suspect Iran hacked military freezer controllers
Attribution is preliminary and access is unexplained, but the outages land squarely on the overlooked food-handling OT that DHS flagged as a spoilage risk back in 2021.
TL;DR
U.S. officials suspect Iran-linked hackers caused freezers to malfunction at around six military commissaries, beginning in late August, per two people familiar with the matter. Cyber Command and DoD law enforcement are probing the incidents; French authorities are also involved after hackers overrode refrigeration controls at more than 350 establishments there. Access is still unclear. The outages put the computers controlling food storage, an often-neglected area, back in view.
U.S. officials suspect Iran-linked hackers are behind freezer malfunctions that spoiled food at roughly six military commissaries beginning in late August, two people familiar with the matter told Nextgov. At Fort Huachuca in Arizona, a freezer entered defrost mode and heated its contents. Cyber Command and Defense Department law enforcement units are investigating, and French authorities are working alongside them after a separate incident this month in which hackers overrode temperature controls at more than 350 French establishments, forcing supermarkets to throw out spoiled food.
How the intruders reached the freezer systems isn't yet clear. The reporting notes only that digital vulnerabilities tied to freezer controls can expose the equipment to tampering, and that assessments could shift as investigators learn more.
That uncertainty is the point worth sitting with. The attackers don't have to be confirmed, or their method established, for the target to be legible. A 2021 DHS threat assessment on food and agriculture named refrigeration failures and shipping delays as cybersecurity risks that could cause spoilage and shortages. The Food and Agriculture Information Sharing and Analysis Center has separately warned that attackers can reach internet-accessible industrial controls that may lack adequate defenses.
The suspected attribution would also match a broader pattern. CISA and its partners issued an April 7 advisory, updated in July, warning of Iranian-affiliated activity against internet-connected operational technology devices across U.S. critical infrastructure sectors, including programmable logic controllers disrupted through malicious interactions with project files and manipulated HMI or SCADA displays. That advisory was broadened over time past Rockwell Automation to cover Schneider Electric and Siemens gear as well.
None of this confirms Iran is behind the freezer outages. What it does is remove the excuse for treating food-handling equipment as outside the security perimeter. Refrigeration failures were on the government's own risk list five years ago, and now they're the subject of an active federal investigation with foreign partners attached.
Published ·Deep Fathom