“At precisely the moment when our adversaries are accelerating attacks against critical infrastructure.” Five House Democrats, describing when CISA lost a third of its staff, August 2026
Overnight into Monday, someone reached into the refrigeration controllers of supermarkets in six European countries and switched the freezers to defrost, three weeks after the same trick spoiled food across hundreds of French stores. Most coverage is treating this as Europe’s grocery problem, but the first freezers in this story to fail were on US Army bases in August, and Israel’s went before that.
Put the dates in order and it stops looking like a string of bad luck. It looks like a rehearsal, and the country with the most at stake spent the eve of the election watching its president talk about pool paint.
The Order the Freezers Failed In
Nobody has published this sequence in one place, so we built it from the reporting on each incident.
In March, a kosher grocery chain in Israel may have been hit, judging by a video of spoiled meat. In May, attackers wiped computers at a large Israeli food plant and damaged its industrial freezers, halting operations for more than a week. The head of the Israeli firm that responded told NPR he is confident Iranian military hackers were responsible, a group calling itself Cyber Isnaad Front.
On April 7, the FBI, CISA, NSA and four other agencies issued a joint advisory warning of Iranian-affiliated actors disrupting industrial controllers across US critical infrastructure, “resulting in operational disruption and financial loss.” On July 22 they widened it to cover Schneider Electric and Siemens hardware.
In late August, freezers at at least six military commissaries went haywire. Fort Huachuca posted that its unit “went into defrost mode where it heated up all the food.” Four officials say the Pentagon is now treating those failures as a suspected hack, with Cyber Command and Army investigators working alongside French police.
On October 12 it was France. Intermarché said 150 to 200 stores were targeted and Coopérative U nearly 100; the finance minister put the total near 700 of the country’s 10,000 supermarkets. Some units were pushed to 122°F and caught fire. We covered the French attack and the Pentagon’s silence the next day.
Then Sunday night. Belgium, the Netherlands, Luxembourg, Sweden, Ireland and Estonia, with SuperValu pulling chilled food from 13 Irish stores, Coop counting six affected Swedish shops, and an ICA branch in Sjöbo finding its fridges set to 50°C.
That is seven European countries, Israel and the United States, across eight months. The order matters. The US was not downstream of Europe. It was ahead of it.
Who Did It Is Still Open. What It Proves Is Not
Nobody has claimed the European attacks and no government has named a culprit. Investigators reportedly suspect Iran for the commissary failures, though NPR’s sources describe their confidence as low. We are not going to pretend that link is proven, because it isn’t.
What is proven is the method. French officials have named Danfoss refrigeration controllers as one route in, and Danfoss says many of the affected units were obsolete or ran outdated firmware. Some installations, including Fort Irwin and Fort Huachuca, reportedly run older Danfoss models that can no longer take secure updates. The Sabcobel chief who runs Delhaize’s systems in Belgium told Belga the attackers flipped the evaporators to defrost. No explosives, no missiles, no border crossed. A login and a setting.
Finance YouTuber Andrei Jikh put it bluntly in a video published Tuesday: it looks like someone is testing whether they can wreck a country’s food supply. We would add the uncomfortable part. Each test has run faster and wider than the last, and Sweden and Estonia only got off lightly because the French attack had given them a few weeks’ warning. The next target may not get one.
The Agency That Would Catch This Is a Third Smaller
The office whose job is to warn grocery chains, water utilities and military contractors that their controllers are exposed is CISA. Under this administration it went from about 3,300 employees to about 2,200, a loss of roughly 1,100 people that House Democrats asked the Government Accountability Office to examine in August. The acting director told Congress in January that “we have the staff that we need.”
Run the arithmetic on that claim against the timeline above. The April advisory on Iranian-linked controller attacks was already out when the commissary freezers failed in August. The Danfoss controller flaws that researchers at Claroty found were in public CISA advisories in 2025. The warnings existed. The capacity to chase thousands of exposed devices into compliance is what got cut, and a refrigeration controller does not patch itself because a PDF was posted.
Meanwhile, at the Reflecting Pool
On Monday, with Election Day hours away and European grocers counting spoiled stock, Trump skipped the campaign trail and spoke at the Lincoln Memorial Reflecting Pool. He announced its reopening, joked about naming it after himself, showed pictures of rusted pipes, talked up the blue paint and repeated a vandalism claim ABC7 described as false. He closed by holding up a poster of the pool when it was clogged with algae.
CNN called it a closing message about a topic close to his heart but not voters’ minds. That is generous. He did not mention the freezer attacks, the commissaries or Iran’s demonstrated habit of hitting back through keyboards. This was the night after US strikes hit Iran’s Qeshm Island, which is exactly the moment a country whose hackers have already been accused of breaking food plants and water systems would look for a cheap way to answer.
A president can care about a monument. What he cannot do is spend more public breath on grout than on the one attack pattern that has already reached his own troops’ grocery stores.
What Should Happen Before the Next Sunday Night
We think this has to be treated as one campaign until someone proves otherwise, with one owner in Washington. That means the Pentagon saying publicly what it found at the commissaries, CISA naming the controller models and firmware it wants off the open internet, and grocery chains, cold-storage warehouses and school and hospital kitchens being told plainly to pull those devices behind a firewall this week. Danfoss is already telling customers exactly that.
It also means restoring the people. A third of an agency is not a rounding error when the threat is a few thousand forgotten boxes on store walls.
The attackers have shown they can reach a freezer in Fort Huachuca, a supermarket in Sjöbo and a food plant in Israel. They have not yet shown what they do when the target is a regional distribution center the week before Thanksgiving. Nobody in charge should want to find out on a Sunday night.