In France last month, attackers gained access to refrigeration controllers at roughly 700 retail sites and changed their defrost settings, with the country’s cybersecurity agency reporting lost merchandise and fires started in at least 15 cases.
Before authorities had publicly identified the attackers, Israel’s National Cyber Directorate was already warning food retailers and logistics operators to check who could remotely access their refrigeration systems. It called for stronger authentication, updated equipment, and independent alerts for unusual temperature changes.
The attack, which French authorities later attributed to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps, was frequently discussed at Cyber Week at Tel Aviv University. The four-day conference, held Nov. 9–12 alongside AI Week, hosted officials who debated attacks that can reach physical equipment, where focus often turned to the critical services Israelis rely on each day, such as water, food, hospitals and government systems.
A hacked refrigerator system can illustrate possible physical consequences, but the experience in Europe is showing how Israel now needs to react: Ensure an operator can keep a service running or restore it, verify that it is safe for citizens, and explain what it knows to the public.
The next attack
“The war puts enormous pressure on Israel’s cyber defenses—and there is no ceasefire in cyber,” said Yossi Karadi, director general of the Israel National Cyber Directorate. “While the world wants to prevent Iran from acquiring a nuclear weapon, we know Iran is working to develop another offensive capability that could harm the world using AI to launch cyberattacks.”
He described Israel as facing attacks across critical infrastructure, essential organizations, businesses, and the wider economy. His concern was the cumulative effect of repeated attacks. “What happens when the next attack arrives before we recover from the last one? What happens when cyber pressure outpaces recovery?” he asked.
Karadi calls the scenario “Community Cyber Operational Attrition.” His test is whether essential services keep running and whether their operators can restore them before the next attack. An organization may stop one intrusion but still remain vulnerable as staff members repair equipment or investigate what happened.
Israel’s published national cybersecurity strategy places emphasis on critical infrastructure for national security and the well-being of residents with an objective of “Zero Significant Damage to Critical Infrastructure.” The same strategy identifies a broader layer of organizations that provide essential services but do not have the same consistent cyber obligations across sectors, which Karadi described as hospitals, fuel and food companies.
Their operations may sit outside the strictest infrastructure designation while remaining important to daily life. The refrigeration warning demonstrated how quickly a system operated by a food business can become a target for an attack. The directorate’s National Cyber Defense Bill, which passed a first reading and entered Knesset committee deliberations, helps define which organizations fall into that category and what they must do to manage and report cyber risks.
Karadi also argued that AI is changing the time available to defenders. He called the interval between an attacker gaining a new AI capability and a country deploying an effective defense at scale the “attacker’s window.” An attacker can choose one organization and one moment, he said, and the directorate is there to help organizations prepare against attacks.
That pressure does not make familiar weaknesses disappear. In further remarks, Karadi pointed to weak passwords and routine failures in cyber hygiene as recurring problems. Faster tools may help both sides, but an exposed controller or an unsecured supplier account can still give attackers access.
Karadi ended his post-conference remarks by giving an update on Election Shield, the operation set up to protect Israel’s election previously reported by JNS. In response to our questioning, he said that after more than three months of preparation with other cyber organizations, he knew of no cyberattack that had harmed election systems.
His directorate focused on cyber-based influence and did not identify a specific attempt that had been stopped.
The question at the tap
Refael Franco’s experience with an earlier attack gives national concerns another form. Franco, a former senior official in Israel’s cyber apparatus who now leads crisis-management company Code Blue, told JNS that his work responding to attacks on Israeli water facilities in 2020 changed how he understood recovery and resilience.
“In the end, the question was, ‘If I am a citizen in Israel, is the water safe or not?’ This is not a question of incident response; it’s a question of trust,” he said. “Can I drink from the tap? Is it safe to drink?”
Israel’s Water Authority confirms that water and sewage facilities faced cyberattacks in April 2020. Its annual report says teams worked with local defenders to identify and contain the attacks, prevent damage, investigate, and repair weaknesses. The report does not say drinking water was contaminated.
Franco’s concerns related to what a citizen needs to be able to trust after an attempted attack on the service.
“Resilience is the ability to continue to work under cyber attack and pressure,” Franco told JNS. Technical teams may contain an intrusion and restore systems. Operators may then need to check physical conditions, decide whether a service can be used, and communicate those findings. The answer given to the public has to rest on what those checks establish.
Blue Castle offers an AI-assisted platform for managing crisis decisions, but Franco emphasized that people still want human guidance when an incident becomes severe. “Even if the platform is providing perfect guidance, people still want people,” he said. He described a customer in crisis seeking a person who could help navigate the situation, alongside the technical advice.
Code Blue manages or assesses approximately 150 crisis cases a year across clients in the United States, Europe, Israel, Canada and other locations. Franco estimated the company has about 140–160 clients, more than 30 of which belong to the energy sector and finance treasuries of countries.
For Franco, the French refrigerator attack was part of a broader influence campaign designed to demonstrate the fragility of its government and question its ability to care for its citizens. “The influence campaign was to try to show that Europe is vulnerable,” he explained. “We speak about the problem with the salaries and the prices and cost in Europe. So it’s part of the influence campaign to attack the food, because the food is connected directly to the pricing.”
Government services
The same challenges apply when the services are digital. Nati Cohen, head of Israel’s National Digital Agency, told Cyber Week that his agency supplies digital services to citizens and businesses while protecting the systems and personal information behind them. He described cooperation with Karadi’s directorate, standards for suppliers, threat assessment across government bodies, and teams prepared to respond to incidents.
Cohen identified confidence between citizens and government as a central concern as more services move online. “We understand that resilience is very important,” he said. “Trust between civilians and the government is the most important thing we want to build.”
Israel’s personal government portal, MyGov, lets people complete tasks that can include renewing identification documents, transferring vehicle ownership and registering a child. A person using such a service depends on it being available, but also on the state protecting the information submitted through it.
“If most of the services go through the MyGov platform and it’s not secure, and it’s still not protected by personal IDs, we have a big problem,” he told the crowd.
Israel’s national strategy acknowledges that a major cyber incident can weaken public trust in digital services and discourage their use. It also identifies supply chains as a route through which harm at one organization can spread to others. Those concerns connect Cohen’s government-service work with Karadi’s wider view of the economy: citizens encounter the service, while responsibility for protecting it may be distributed among different organizations or suppliers.
On Nov. 8, the National Cyber Directorate announced a consultation on a proposed single digital identity and national digital wallet, in cooperation with Israel’s National Digital System, the Population and Immigration Authority, the Budget Division of the Ministry of Finance, and the accountant general. The proposal would place more interactions behind shared digital credentials, increasing secure access and dependable recovery.
A service people can rely on
Karadi told the conference that no country or organization can defend its systems alone. He called for government, infrastructure operators, companies, cloud providers and international partners to share intelligence, exercise together and plan recovery before a crisis. Israel’s refrigeration warning shows one way that cooperation can work: An attack abroad led authorities at home to identify a class of equipment Israeli businesses should inspect.
But it also shows the limits of measuring resilience by whether an intrusion was stopped. France’s operators had to deal with spoiled stock and damaged equipment, potentially spilling out further into public unrest. A water supplier, on the other hand, has to know whether its water remains safe.
A government agency has to protect both a service and the personal data that makes it useful, while making sure its citizens trust the service and believe their information remains safe or private.
This week’s Cyber Week offered accounts of faster detection, stronger coordination and AI-assisted response. The country’s published strategy recognizes that essential organizations need clearer and more consistent obligations alongside the protections already applied to critical infrastructure. But work ahead includes testing whether services remain available when under attack, how they are restored, and what operators can tell the public when the next attack arrives.
Franco’s question about the tap remains a demanding measure. A citizen cannot inspect a water facility’s systems or review a refrigeration controller’s settings. But those responsible for services most at risk of attack must be able to do that work, explain what they found, and stand behind the answer.
