A woman walks past empty refrigerators at an Intermarché supermarket in Névez, western France, October 12, following a cyberattack affecting French supermarket chains Intermarché and Cooperative U that caused their refrigerators to defrost.
FRED TANNEAU/AFP via Getty Images
hide caption
FRED TANNEAU/AFP via Getty Images
France accuses Iran of launching a series of destructive cyberattacks against its critical infrastructure in October.
According to the National Cybersecurity Agency, ANSSI, Iranian military hackers took over the refrigeration controllers of around 700 different retail sites in France, from supermarkets to butcher shops, raising temperatures in the middle of the night and wasting millions of dollars’ worth of food.
They also targeted several small hydroelectric plants, resulting in “moderate effects.” wrote ANSSI in its press release.
This hacking campaign is “unprecedented both in its scale and its level of aggressiveness,” declared French Foreign Minister Jean-Noël Barrot. He declared that it was “the first large-scale cyberattack aimed at sabotaging our national territory and that it constitutes a major attack on the interests of the nation and the security of the French.”
The Paris prosecutor’s office has open its own investigation into the Iranian cyber unit, Shahid Kaveh, which the French government links to Iran’s Islamic Revolutionary Guard Corps. “The Paris public prosecutor’s office is requesting the issuance of international arrest warrants,” the public prosecutor’s office said in a press release.
A trend of attacks against refrigeration systems
Attacks on French industrial controllers are part of a larger trend. In 2026 alone, hackers have targeted refrigeration controllers from Europe to Israel and the United States.
Grocery stores in European countries, including Sweden and Ireland, were hit by similar attacks last week.
In another incident in France, employees at a major French blood bank had to act quickly to prevent blood samples from heating up when their refrigeration system was hit last week, generate international calls for the healthcare sector to protect its vital products from spoilage.
In Israel in the spring, suspected Iranian hackers named “Cyber Isnaad Front” claimed responsibility for sabotaging an industrial food processing plant, including infecting company computers with malware, taking over office printers to print threatening messages, and hacking office cameras for use in a propaganda video released in early October. This video included a taunt in French referring to ongoing education-related protests and appeared just before the attacks on French supermarket refrigerators. Cyber incident response firm Profero attributed the Israeli attack to a wing of the Iranian Revolutionary Guard Corps.
Over the summer, commissaries at U.S. military bases also experienced a similar situation, when food spoiled after temperatures soared in refrigerators and freezers overnight.
The French government is the first to formally attribute responsibility for this wave of destructive attacks.
They were able to identify the hackers through a series of digital clues, including the digital infrastructure used by the hackers, connection to a propaganda outlet, and “traces” of Farsi language use during the attack. according to ANSSI.
While NPR and others reported that U.S. officials suspected Iran was behind attacks on U.S. military bases in August, the Pentagon made no official statement, even concluding that the disruptions were in fact the result of a cyberattack.
“In accordance with our policy and to preserve the integrity of the process, the DOD (Office of Inspector General) Criminal Investigative Branch does not discuss ongoing investigations,” Mollie Halpern, a spokesperson for the War Department’s Office of Inspector General, wrote in an email to NPR.
The attacks correspond to the modus operandi of Iranian hackers
If Iranian hackers are behind the attacks in Europe, the United States and Israel, cybersecurity experts say it would match what they know about the Iranian hackers’ strategy and goals.
“Iranian cyberattacks on refrigeration systems likely represent an attempt by the IRGC to reassert Iranian power abroad through both physically and psychologically disruptive operations,” Alex Orleans, head of threat intelligence at the cybersecurity firm Sublime Security, told NPR. “Such activities continue to produce tangible and profitable results, given that Iran’s national resources remain constrained by the war.”
“Moreover, Shahid Kaveh, the IRGC cyber unit to which the French specifically attributed the disruptive attacks, is repeating a pattern here,” Orléans says. He referred a series of cyberattacks against American water treatment plants in August, which most experts believe was linked to Iran, setting a precedent. The US government has still not officially attributed the attacks.
“This unit once again refined its expertise by attacking Israeli targets before moving its targeting to the same systems in the West,” explains Orléans.
For those tracking Shahid Kaveh and the other Iranian cyber units operating alongside him, these attacks fit perfectly into their modus operandi.
“The Shahid Kaveh Group is an offensive cyber unit responsible for some of the biggest successes of Iran’s offensive cyber (operations),” says Ari Ben Am, an assistant researcher at the Foundation for Defense of Democracies’ Center on Cyber-Technological Innovation.
One group linked to Shahid Kaveh is the Cyber Av3ngers, he explains. The US government is linked to cyberattacks against Israeli-made systems at US water treatment facilities during the winter of 2023 and 2024. The French government also cited other cyberattacks carried out on behalf of the IRGC against French interests, notably against the French satirical magazine Charlie Hebdo and another against the digital kiosks used at the Paris Olympics in 2024.
The challenges of securing operational technology
Cybersecurity experts say The attacks on refrigeration controllers have highlighted a years-long difficulty in securing operational technology, the machines that control physical processes in the real world – from water pumps to cooling systems.
These machines are often outdated and riddled with vulnerabilities, and are very difficult to patch because operators cannot afford to shut them down and disrupt critical services, including healthcare and transportation. Additionally, machines are often exposed to the open Internet – often at least in part due to contractual requirements with vendors who want to maintain these systems remotely. This combination of factors makes this a complicated problem to solve.
Iran has not yet responded to the accusations. However, the accusation launched by the French government on Monday could prompt other affected countries to act as well.
At Monday’s G7 meeting in Paris, reporters asked Secretary of State Marco Rubio whether the United States was sharing information with the French to help them attribute Iranian hacks. Rubio said he could not comment, but noted that “the French are quite capable.”
“What kind of sick people are these people?” he asked. “They are attacking refrigerators. France is not even really involved in this,” referring to the war between the United States and Iran that began in February. “(These Iranians) are doing terrible things all over the world… today’s news does not surprise us,” Rubio concluded.
Rebecca Rosman reported from Paris.
Gn bussni
