The Iranian attack on supermarket refrigeration systems in Europe, which France this week officially attributed to the Revolutionary Guards, sounds like a strange story: hackers changing defrost settings on fridges. But it teaches something important about how Iran fights in cyberspace. The attackers did not look for the best-protected target. They looked for the least-protected connected equipment, and found it in hundreds of stores.
Refrigeration systems, air-conditioning controllers, pumps, irrigation systems and security cameras are connected to the internet today so they can be managed remotely. In most cases, whoever installs them is a technician, not a security professional, and the settings stay as they came from the factory. A default password, a management interface open to the internet and software not updated for years are not exceptions, they are the norm.
Israel knows this pattern well. Over the years, attempts by Iran-linked hackers to tamper with controllers of water systems were reported, and again and again the targets turned out to be small, distributed equipment: a controller at a local facility, a community's irrigation system, an interface left open. In Israel too, as in Europe, thousands of such devices are connected to the network, some with no protection at all.
What sets the attack in France apart is that it proved this weakness can be turned into large-scale physical damage, in one night, in many countries in parallel. For the attacker, it is a cheap operation with a big psychological effect: supermarket fires make headlines, undermine a sense of security and do not require breaking into a military or government system.
What needs to happen? Israel's National Cyber Directorate has published guidance on securing control systems for years, but guidance is not enough when the equipment's owners are retail chains, local authorities and small businesses. It may be time to require manufacturers and installers to supply equipment without default passwords and with updates, as Europe and Britain already do for consumer products. Until then, the question is not whether someone will try this in Israel, but when.
