French prosecutors say 700 retail locations were affected by October’s refrigeration hacks. Iran denies responsibility, while investigators examine similar incidents elsewhere in Europe.
France has accused a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps of carrying out attacks on refrigeration systems at 700 supermarket locations, causing widespread food spoilage and roughly 20 fires. Iran has rejected the allegations as “baseless and hostile.”
The French government announced its attribution on November 9, nearly a month after hackers manipulated commercial refrigeration controls on October 11–12. Foreign Minister Jean-Noël Barrot said France had summoned the Iranian ambassador and would seek European sanctions against those responsible.
This is the first large-scale cyberattack carried out for sabotage purposes on French soil. It represents a major attack on the nation’s interests and on the security of the French people.
Foreign Minister Jean-Noël Barrot
The case has drawn attention beyond France because similar refrigeration failures have been reported at supermarkets elsewhere in Europe and at U.S. military grocery facilities. Investigators have not publicly established that all the incidents were connected.
Hackers manipulated defrost cycles and disabled warnings
According to the Paris prosecutor’s office, the attackers gained remote access to refrigeration equipment through web interfaces. They then initiated prolonged, abnormal defrost cycles while disabling safety alerts intended to warn operators when temperatures exceeded specified limits.
That combination allowed refrigeration units to heat up without triggering their normal warnings. Temperatures in some supermarket fridges reportedly reached 50°C, or 122°F, overnight, destroying chilled and frozen stock. Retailers affected included Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc.
Employees were left discarding spoiled meat, melted ice cream and other perishable products. In some locations, equipment caught fire or melted. One French supermarket owner estimated that nationwide losses could reach tens of millions of euros, although the reporting reviewed for this article does not establish a final, independently audited damage total.
The attacks targeted refrigeration-management software supplied by Danish engineering company Danfoss, according to the BBC. Such systems allow retailers to monitor and manage cooling equipment remotely. Reuters reported that the company behind many affected units said several were obsolete or running outdated firmware, potentially making them easier to compromise.
The reported weaknesses point to vulnerable equipment and remote-access controls; they do not, by themselves, establish that attackers breached Danfoss’s own corporate network. The precise initial entry method has not been publicly established in the accounts reviewed.
Prosecutors target the leader of Shahid Kaveh and two deputies
Paris prosecutor Laure Beccuau said the investigation concerned the leader of Shahid Kaveh and his two deputies. Prosecutors described the group as an offensive cyber unit affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps, or IRGC. Reuters reported that the prosecutor’s office had requested international arrest warrants against the three.
The judicial investigation includes allegations of fraudulent interference with an automated data-processing system and causing damage by means dangerous to people, committed as part of an organized group. Prosecutors said the alleged offenses were aggravated by having been carried out in the service of a foreign power, identified as Iran.
The prosecutor’s office said investigators identified an attack methodology characteristic of the unit, including the use of Persian, also known as Farsi, and IP addresses traced to devices in Iran. Those are elements of the French authorities’ attribution, rather than independently conclusive proof of who directed the operation. Reuters said it could not establish exactly how France reached its determination, while the BBC noted that hackers can conceal their locations and that attributing cyberattacks is difficult.
There is also a distinction between France’s specific accusation against an IRGC-affiliated unit and the assessment reportedly reached by U.S. intelligence agencies. The New York Times, citing three US officials, reported a “low confidence” assessment linking the French attacks to Iran generally, rather than to the Revolutionary Guards specifically. Such an assessment indicates that the supporting intelligence is limited or fragmented and could change as further information emerges.
Iran rejects the accusation as France threatens sanctions
Iran’s foreign ministry rejected the French allegations on November 10, describing them as “baseless and hostile.” The response followed France’s announcement that it would pursue sanctions and consider additional measures.
Barrot said France would take “any other necessary and proportionate measures” to respond and deter further attacks. In a subsequent interview with Franceinfo, he said the government “rules nothing out.”
The sanctions remained a proposed response in the reporting reviewed, rather than an announced, completed EU sanctions package. Nor have investigators publicly established a definitive motive for targeting French supermarkets. Experts cited by The New York Times suggested that vulnerable refrigeration systems may have presented an accessible opportunity for disruption, rather than necessarily having been selected to deliver a particular political message.
Similar attacks elsewhere remain under investigation
A second wave of refrigeration hacks affected more than 100 establishments across Europe in early November, according to Reuters. Reported locations included Belgium, Luxembourg and Sweden, with the BBC also identifying affected shops in Ireland, the Netherlands, Estonia and Finland. Whether those incidents were linked to the October attacks in France remained unresolved.
French blood-storage facilities were also affected in a separate incident. The French Blood Establishment said a cyberattack targeting its refrigeration equipment provider affected cold-storage units at three sites, with temperature and defrost thresholds set excessively high. Its rapid response prevented damage, and staff moved some blood supplies to alternative storage. French officials had not announced a connection between that incident and the supermarket attacks.
In the United States, refrigeration outages at six military bases in August prompted an investigation by the Army’s Criminal Investigation Division. A spokesperson told CBS News that its Cyber Field Office was working with French law enforcement to understand the European incidents. That cooperation does not establish that the same perpetrators were responsible.
A cyberattack with physical consequences
The French case illustrates how interference with connected equipment can move beyond stolen information or disrupted websites to damaged machinery, spoiled inventory and fires. Prosecutors’ account describes attackers manipulating the equipment’s operating settings while suppressing the warnings designed to reveal dangerous temperatures.
Following the refrigeration incidents, the FBI warned that malicious activity was targeting industrial refrigeration and cold-chain monitoring systems worldwide. It said weaknesses in unpatched or internet-accessible controllers could allow attackers to alter settings, causing inventory losses and equipment damage. The agency urged operators to remove controllers from the public internet and protect access behind firewalls, alongside other security measures.
For investigators, the remaining questions include the full financial cost, the precise route into the affected systems and whether the incidents across Europe and the United States form a coordinated campaign. France has made a specific accusation against an Iranian state-linked unit; the scope and connections of the wider refrigeration attacks remain under investigation.
