France has blamed Iran’s Islamic Revolutionary Guard Corps for a cyberattack that disrupted refrigeration at around 700 supermarket sites. During the night of October 11 to 12, 2026, attackers changed cooling controls remotely, causing major food losses and around 20 fires, according to the Paris prosecutor’s office.
French supermarket refrigeration attack
Foreign Minister Jean-Noël Barrot confirmed the attribution on November 9 and called it an attack of “unprecedented scale and unprecedented aggression.” He said France had summoned Iran’s ambassador and would seek European sanctions against those responsible. The affected retailers included Système U, Intermarché, and E.Leclerc.
Hackers hijacked refrigeration systems
Investigators said the attackers reached refrigeration control systems through web interfaces and targeted equipment from Danfoss, followed by Dixell and Copeland. Once inside, they started abnormal defrost cycles with no time limit. They also disabled sensor safety alerts that should have warned staff when temperatures exceeded set limits.
Defrosting normally removes ice so cooling equipment can work properly, and keeping that function running helps units maintain safe temperatures. Earlier Cybersecurity News coverage of the supermarket fridge attacks said remote changes left retailers checking stock and removing chilled and frozen food that could no longer be sold safely. The attack combined changing the physical cooling process with removing warnings about the resulting temperature rise.
The damage was not limited to stolen information or unavailable software. The compromised controls directly affected food storage and created safety risks inside stores.
Investigation and attribution
According to Franceinfo’s report on the investigation, the judicial inquiry targets the leader of Shahid Kaveh, his two deputies, and others yet to be identified. Prosecutors described Shahid Kaveh as an offensive cyber unit linked to the IRGC’s electronic and cyber center.
France’s Anti-Cybercrime Office and domestic intelligence agency, DGSI, investigated the incident. Prosecutors cited an attack pattern associated with the unit, the use of Farsi, and IP addresses linked to devices in Iran. The inquiry covers organized computer attacks and dangerous damage, aggravated by allegedly serving a foreign power.
Unconfirmed entry method
The exact entry method remains publicly unconfirmed. Franceinfo’s technical reporting noted a previously disclosed authentication weakness in Danfoss AK-SM 800A systems, but said it had not established its use in this attack. Separately, Cybersecurity News documented thousands of exposed Danfoss hosts, but that count does not prove each system was compromised.
Control access and recovery steps
Operators should remove control interfaces from public internet access, install supported updates, replace default passwords, and restrict remote maintenance through protected connections. Recovery also requires checking controller settings, defrost schedules, accounts, and alerts. Restoring connectivity without reviewing those settings could leave harmful changes in place.
Similar incidents and attribution limits
French officials have cautioned against linking every refrigeration incident to this group. ANSSI chief Vincent Strubel said similar attacks affecting French blood service sites had not been attributed to the same attacker.
Licensed under CC BY-ND 4.0 International