French authorities on Monday attributed the October cyberattacks against hundreds of supermarket refrigerators to hackers linked to the Islamic Revolutionary Guard Corps of Iran.
The attackers on Oct. 11-12 targeted refrigerator controllers at about 700 retail sites across the country, according to the French National Cybersecurity Agency. The controllers were remotely reset to extremely high defrost temperatures, causing millions of euros’ worth of food to spoil and setting at least 15 fires.
Following an investigation, the French government’s Cyber Crisis Coordination Centre linked the attack to the Shahid Kaveh offensive cyber unit.
Authorities said the attacks impacted several related types of facilities, including a slaughterhouse, butcher shops and cooperative agri-food sites. In addition, hackers targeted Schneider Electric equipment at small hydroelectric facilities in France.
The formal attribution was made by the Ministry for Europe and Foreign Affairs. French authorities plan to use all means available to deter further actions, saying it would summon the ambassador of the Islamic Republic of Iran to condemn the attacks.
France will also work with European partners to seek sanctions against organizations and individuals involved in the attacks. Officials said France reserves the right to take additional public and non-public actions considered “necessary and appropriate” to respond to the attacks.
EU officials confirmed the French attribution, and said they are working closely with authorities on a united response to the attacks.
“The European Union stands in full solidarity with France following the cyberattacks that disrupted refrigeration systems in hundreds of French supermarkets,” a spokesperson for the European Commission said.
The Paris Public Prosecutor’s Office has opened a judicial investigation and will seek international arrest warrants against members of the Shahid Kaveh group, according to authorities.
France’s national cybersecurity agency in October linked the compromised refrigerators to vulnerabilities in Danfoss and Copeland refrigerator controllers, which could enable an attacker to gain control of a device if successfully exploited. Many of these systems are exposed to the open internet and are therefore visible to remote hackers.
Researchers at Claroty originally disclosed vulnerabilities in August under a coordinated process with Danfoss. Researchers discovered the flaws in 2025, but worked with the manufacturer for more than a year in order to properly investigate the flaws, develop a patch and notify customers.
Earlier this month, hackers launched a similar round of attacks against supermarket refrigerators across Europe. Hackers also targeted an equipment supplier linked to the French Blood Establishment, which manages the blood plasma supply for transfusions and other uses.
Implications for U.S.
The FBI and Cybersecurity and Infrastructure Security Agency issued an advisory on Thursday urging providers of industrial refrigeration and cold storage to take additional steps to protect their systems from potential attacks.
U.S. authorities have been investigating a prior series of suspected attacks at domestic military facilities. At least a half dozen commissaries reported mysterious outages starting in August, leading military investigators to launch a probe.
National security analysts warned the attacks could have major implications for security in the U.S., which has been at war with Iran since February.
“That’s because the vast majority of U.S. critical infrastructure is privately run, and when we expand that definition to things like food retailers and supermarkets, it, of course, hits 100% (or at least close to it),” said Ari Ben Am, an adjunct fellow at the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies.
Iran-linked actors were blamed for a wave of attacks targeting U.S. drinking and wastewater facilities in July.
The FBI and CISA on Thursday urged providers of industrial refrigeration and cold storage to take additional steps to protect their systems from potential attacks.
The Retail and Hospitality Information Sharing and Analysis Center (RH-ISAC) issued advisories warning of the heightened threat. Security executives from Google also briefed RH-ISAC officials on the threat environment.
A spokesperson for CISA declined to comment beyond the advisory. FBI officials also declined to comment.
