France has identified Iran’s Islamic Revolutionary Guard Corps as responsible for a significant cyberattack targeting the refrigeration systems of approximately 700 supermarkets. This incident, which occurred during the night of October 11–12, 2026, involved the remote manipulation of cooling controls, resulting in substantial food spoilage and nearly 20 fires, as reported by the Paris prosecutor’s office.
Unprecedented Scale of the Cyberattack
On November 9, Foreign Minister Jean-Noël Barrot confirmed the cyberattack’s attribution, describing it as an event of “unprecedented scale and aggression.” In response, France has summoned Iran’s ambassador and plans to pursue European sanctions against those accountable. The affected retail chains include Système U, Intermarché, and E.Leclerc.
According to investigators, the hackers accessed refrigeration control systems via web interfaces, targeting equipment from manufacturers such as Danfoss, Dixell, and Copeland. Once inside, they initiated continuous defrost cycles and deactivated safety alerts, which would have notified staff of unsafe temperature levels.
Impact on Food Safety and Business Operations
The attack led to severe disruptions in the cooling process, directly impacting food safety in the stores. Defrost cycles, typically used to remove ice, were manipulated to prevent refrigeration units from maintaining the necessary temperatures. This forced retailers to inspect and discard potentially unsafe chilled and frozen products.
In this complex cyberattack, the attackers not only altered the physical cooling operations but also disabled critical warning systems, creating a dual threat of operational and safety hazards. The incident goes beyond mere data theft or software disruption, highlighting the tangible risks associated with compromised control systems.
Ongoing Investigation and Preventative Measures
The judicial investigation targets Shahid Kaveh’s leader, an offensive cyber unit associated with the IRGC’s electronic operations, as well as his deputies and other unidentified individuals. France’s Anti-Cybercrime Office and domestic intelligence agency, DGSI, are leading the investigation, linking the attack pattern, use of Farsi language, and Iranian IP addresses to the incident.
The exact method of entry remains unclear, although previous vulnerabilities in Danfoss systems have been noted. However, cybersecurity experts emphasize that this does not confirm the exploitation of such weaknesses in the current attack. Cybersecurity recommendations include restricting public access to control interfaces, updating systems, and securing remote maintenance connections.
French authorities advise caution against assuming every refrigeration-related incident is linked to the same group. ANSSI chief Vincent Strubel highlighted that similar attacks on other sites, such as French blood services, have not been attributed to these hackers, stressing the importance of distinguishing confirmed findings from coincidental similarities.
