France blames Iranian hackers for supermarket attacks that sparked fires
France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, saying the attacks caused food losses and sparked at least 15 fires.
France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, saying the attacks caused food losses and sparked at least 15 fires.
In a statement issued Monday, France's Ministry for Europe and Foreign Affairs blamed the attacks on Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of Iran's Islamic Revolutionary Guard Corps (IRGC).
The attacks occurred overnight on October 11–12, when hackers compromised Danfoss refrigeration controllers and remotely changed defrost settings to high temperatures, disrupting systems used to preserve food.
As the outlet first reported, the attacks affected an estimated 250 to 350 French supermarkets, forcing stores to discard fresh and frozen products.
A technical report published by France's CERT-FR says Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché, along with smaller butcher shops, a slaughterhouse, and cooperative food-processing facilities, were affected by the attacks.
French investigators also detected attacks against Schneider Electric industrial equipment at small hydroelectric installations during the same period, which they linked to the same campaign.
The October attacks were followed by a second wave of refrigeration system attacks reported in November, affecting more than 115 stores across six European countries.
France's national blood service also reported a similar incident that altered temperature and defrost settings at three facilities used to store blood products.
French authorities say the attacks caused tens of millions of euros in food losses and significant material damage, and see what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
France's Cyber Crisis Coordination Center (C4), which includes the country's cybersecurity agency ANSSI, military cyber command, and intelligence agencies, attributed the attacks to the Iranian Shahid Kaveh IRGC unit.
FBI disrupts Chinese hacking tools used to breach critical infrastructure Maersk confirms data breach as WhiteArmor ransomware demands $5 million
French investigators linked the refrigeration attacks to Shahid Kaveh through the following observations: CERT-FR says Shahid Kaveh claimed responsibility for a large-scale sabotage campaign targeting Israeli and U.S. interests in March and April 2026, including attacks on Israeli refrigeration equipment and other industrial control systems.
Last week, the FBI and CISA warned of ongoing cyberattacks targeting industrial refrigeration and cold-chain monitoring systems worldwide.
What happened
France has linked October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations to Iranian state-backed hackers, saying the attacks caused food losses and sparked at least 15 fires.
In a statement issued Monday, France's Ministry for Europe and Foreign Affairs blamed the attacks on Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of Iran's Islamic Revolutionary Guard Corps (IRGC).
The attacks occurred overnight on October 11–12, when hackers compromised Danfoss refrigeration controllers and remotely changed defrost settings to high temperatures, disrupting systems used to preserve food.
What changed
As the outlet first reported, the attacks affected an estimated 250 to 350 French supermarkets, forcing stores to discard fresh and frozen products.
A technical report published by France's CERT-FR says Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché, along with smaller butcher shops, a slaughterhouse, and cooperative food-processing facilities, were affected by the attacks.
French investigators also detected attacks against Schneider Electric industrial equipment at small hydroelectric installations during the same period, which they linked to the same campaign.
Who is affected
The October attacks were followed by a second wave of refrigeration system attacks reported in November, affecting more than 115 stores across six European countries.
France's national blood service also reported a similar incident that altered temperature and defrost settings at three facilities used to store blood products.
Why it matters
French authorities say the attacks caused tens of millions of euros in food losses and significant material damage, and see what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Technical details
France's Cyber Crisis Coordination Center (C4), which includes the country's cybersecurity agency ANSSI, military cyber command, and intelligence agencies, attributed the attacks to the Iranian Shahid Kaveh IRGC unit.
FBI disrupts Chinese hacking tools used to breach critical infrastructure Maersk confirms data breach as WhiteArmor ransomware demands $5 million
Response
French investigators linked the refrigeration attacks to Shahid Kaveh through the following observations: CERT-FR says Shahid Kaveh claimed responsibility for a large-scale sabotage campaign targeting Israeli and U.S. interests in March and April 2026, including attacks on Israeli refrigeration equipment and other industrial control systems.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.