Public incident case study · Manufacturing and industrial · Israel

Cyber Isnaad Front / Israeli Food-Processing Refrigeration Sabotage Case Study

Sabotage in May 2026 · incident report published 24 May · review published August

3compressors physically destroyedProfero's incident-response team reported that three compressors in the newer industrial refrigeration array were physically destroyed after attackers reprogrammed controllers and deliberately manipulated the system's operating state.

2: industrial refrigeration systems manipulated
~1 week: new refrigeration system remained impaired
0: malware required on the OT controllers
CO₂: refrigerant released through pressure relief

Abnormal temperatures exposed deliberate controller changes
The first visible indication was operational rather than a conventional security alert. Refrigeration engineers were called after cold rooms and freezers began warming. Investigation found that industrial refrigeration controllers had been deliberately reprogrammed: temperature setpoints, protection thresholds, alarms, and other operating parameters had been altered. Credentials for the central controller had also been changed, preventing the engineers who normally managed the system remotely from accessing it.
The two refrigeration systems were attacked differently
The facility operated two industrial refrigeration systems using CO₂, or R-744, refrigerant. On the older system, the attackers altered setpoints, protection thresholds, and alarm and alert limits. Engineers identified the changes and restored that system the same night. The newer system suffered substantially deeper manipulation: its programmatic configuration was wiped or reset, including mappings for temperature sensors, pressure transmitters, compressor outputs, motorised valves, fans, and fault inputs.
Native controller functions were used to create physical damage
The attackers placed motorised valves controlling pressure in the gas cooler and receiver into manual mode and forced them open. Consumer controllers were also forced open. Profero assessed that these changes were deliberately selected to keep refrigerant moving without allowing the system to contain it correctly. When engineers attempted to return the newer compressor array to service, three compressors were found to have been physically destroyed.
Pressure relief vented CO₂ while recovery took days
With the refrigeration process unable to control pressure normally, relief valves vented CO₂ refrigerant from the system. Recovery required replacement of damaged compressors and other components, modifications to piping and electrical connections, replacement of pressure switches, valves, electrical boxes, drying filters, and relief components, followed by pressure testing, vacuum testing, and recharging. Profero reported that the newer system didn't return to normal operation for the better part of a week. At the time of Profero's report, one replacement compressor still needed to be supplied by an overseas manufacturer. The reported return to normal operation therefore shouldn't be taken as confirmation that every permanent equipment replacement had been completed.

Lykos analysis

What organisations should learn.

Why this matters to executives and boards

This incident demonstrates that destructive OT attacks do not necessarily require specialised malware running on industrial controllers. The attacker used legitimate controller capabilities, including parameter changes, program configuration, operating modes, and valve commands, together with detailed knowledge of refrigeration physics to create a physical consequence. The controllers performed functions they were designed to perform; the security problem was that an unauthorised operator was able to determine how those functions could be combined destructively. The simultaneous presence of destructive Windows capability also shows why IT and OT incidents cannot always be planned, detected, or managed as separate events.

Readiness gaps and lessons visible in the public record

The public record shows that attackers were able to change process parameters, modify controller configuration, alter operating modes, and change credentials in a way that locked legitimate engineers out while equipment was failing. Recovery of the newer system required days of engineering work, including reconstruction of controller configuration from electrical schematics and physical wiring. The case supports strict segmentation and brokering of IT-to-OT access, resilient credential-recovery paths, monitoring for changes to setpoints, alarms, operating modes, and controller programs, independent process visibility that cannot be silently retuned by the same control path, offline version-controlled copies of controller configuration, and recovery exercises that involve both cyber responders and plant engineers.

How Lykos helps