France says an Iran-linked cyber unit sabotaged supermarket refrigeration controls at more than 700 grocery and food-distribution sites, causing food losses, material damage and at least 15 fire starts in one of the clearest warnings yet that connected cold-chain equipment has become a target for cyberattacks.
The French Ministry for Europe and Foreign Affairs said the attacks occurred overnight from Oct. 11 to Oct. 12 and targeted refrigeration controllers used in large retail operations. The ministry attributed the campaign to Shahid Kaveh, which it described as a cyber-offensive unit affiliated with the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps.
The accusation moves the incident beyond a costly supermarket outage and into a wider national-security dispute over operational technology — the control systems that run physical equipment such as refrigeration, cold storage, energy systems and industrial machinery.
What France Says Happened
In a Nov. 9 statement, France’s foreign ministry said the refrigeration-controller attacks caused “considerable” material damage, fire starts and food losses estimated in the tens of millions of euros.
A separate technical report from CERT-FR and France’s cyber crisis coordination center said the incident affected about 700 retail sites. After the systems were compromised, defrost settings were changed to high temperatures, producing major merchandise losses and at least 15 fire starts, according to the report.
The affected organizations were mainly large retailers, including Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, the French report said. It also identified other food-sector victims, including several small butcher shops, a slaughterhouse and cooperative food-processing plants.
More Read
France said it would summon Iran’s ambassador, seek new European sanctions against Iranian entities and individuals involved in the attack, and reserve the right to take additional public or non-public measures it considers necessary and proportionate.
How the Attack Hit Refrigeration Equipment
The French technical report said investigators tied the attack to Shahid Kaveh through a group of indicators, including shared infrastructure, reconnaissance activity against industrial control systems, use of the FOFA scanning tool and traces of Farsi in the attack infrastructure.
The report said Shahid Kaveh has used online personas including CyberAveng3rs and has conducted large-scale targeting of industrial equipment for sabotage, mainly against Israel and the United States, but also against France and other European countries. The same report said the unit has had scripts since at least June 2024 for scanning, accessing and controlling industrial equipment from Schneider Electric, Siemens and Rockwell.
For appliance and refrigeration businesses, the important point is not only the named attacker. The method described by French authorities was aimed at connected control equipment — systems that may sit outside the main corporate IT network but can still be reachable remotely for monitoring, maintenance, alarms or energy management.
U.S. Agencies Warn of Global Cold-Chain Threat
The U.S. government had already warned operators of cold-chain systems to harden refrigeration controls. In a Nov. 5 joint advisory, the Cybersecurity and Infrastructure Security Agency, FBI, Health and Human Services, U.S. Department of Agriculture and Department of Transportation said they were aware of malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems globally.
The advisory said attackers are targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold-storage facilities. Unpatched or internet-accessible controllers can be exploited to alter settings and force units into continuous heating and defrost cycles, potentially causing inventory loss, equipment hazards, fire risk and loss of visibility into actual temperatures, the agencies said.
The advisory’s recommended controls are basic but operationally significant: remove controller panels from the public internet, isolate operational technology from business networks, change default passwords, use strong authentication where feasible, patch firmware, restrict access by approved devices and IP addresses, maintain backups, monitor logs and set safe temperature limits with reliable alerts.
Why This Matters for Retailers and Service Companies
The French incident shows how a cyberattack on refrigeration equipment can become an immediate food-safety, inventory and fire-risk problem. For grocers, cold-storage operators and food distributors, the exposure is not limited to lost product. A manipulated defrost cycle can create questions about store closures, spoilage documentation, insurance coverage, regulatory reporting, customer confidence and whether temperature records can be trusted after the event.
For refrigeration contractors and service companies, the attacks put more pressure on installation and maintenance practices that once were treated as routine convenience features. Remote access, default credentials, unsupported controllers, firmware updates, network segmentation and alarm routing are now part of the reliability profile of the equipment.
The U.S. advisory also makes clear that the concern extends beyond grocery stores. Healthcare, food and agriculture, chemical operations and transportation systems all use refrigeration and cold-chain monitoring for automated temperature logging, defrost management and remote monitoring.
France’s allegation against Iran remains a government attribution, not a court judgment. But the practical lesson for cold-chain operators is already concrete: refrigeration controls that can be reached from the public internet, run outdated firmware or rely on weak access controls are no longer a narrow IT issue. They are a physical risk to food, medicine, equipment and store operations.
