France blames Iran for the supermarket freezer sabotage: 700 sites, fires, a judicial probe
France has formally attributed the October sabotage of refrigeration systems at roughly 700 retail sites to an Iranian cyber unit, and has opened a judicial investigation into what prosecutors describe as sabotage carried out on behalf of a foreign power. The move turns a weeks-long industrial incident into a named state-level accusation, with warrants and a diplomatic confrontation attached.
The Ministry for Europe and Foreign Affairs named "Shahid Kaveh", described as a cyber-offensive unit affiliated with the electronic and cyber centre of the Islamic Revolutionary Guard Corps. The assessment came through France's cyber crisis coordination centre, C4, which draws on ANSSI, the military cyber command and intelligence services. According to BleepingComputer, CERT-FR also links the unit to hacktivist personas including CyberAveng3rs, Soldiers of Solomon and Cyber Isnaad Front."France condemns in the strongest possible terms the unacceptable cyberattacks carried out on its territory by the Islamic Republic of Iran against its interests."
What happened on the night of 11-12 October
Attackers reached internet-facing administration interfaces on refrigeration controllers and altered defrost settings so cycles ran without a time limit, pushing cabinet temperatures up. BleepingComputer reports that Danfoss refrigeration controllers were compromised and defrost settings raised to high temperatures. The French security outlet ZATAZ adds that the affected hardware included Danfoss AK-SM and AK-SC units and Dixell/Copeland XWEB controllers, some end-of-support or running obsolete firmware, and that thermal-sensor alerts were disabled too. The physical consequences were immediate. BleepingComputer puts the damage at at least 15 fires, alongside tens of millions of euros in food losses and significant material damage. ZATAZ reports "une vingtaine de departs de feu" - around twenty fires - in its main text, while a later passage in the same article says at least 15. The two figures have not been reconciled publicly. The victim list is broad and mostly mundane. CERT-FR names Casino, Leclerc, Cooperative U, Metro, Carrefour and Intermarche, plus smaller butcher shops, a slaughterhouse and cooperative food-processing facilities. Investigators also found attacks on Schneider Electric gear at small hydroelectric installations, with moderate effects.A judicial investigation, and warrants
On 9 November the Paris prosecutor's office opened a formal judicial investigation into the October attacks, according to ZATAZ. The probe is handled by OFAC, the national anti-cybercrime office, and DGSI, the domestic intelligence service. Prosecutor Laure Beccuau's office is examining fraudulent access to computer systems committed in an organised group, damage liable to endanger people, and acts carried out on behalf of a foreign power. ZATAZ reports that international arrest warrants have been requested against three people: the head of the Shahid Kaveh group and two of his deputies. That is a request, not a conviction. The attribution itself rests on converging indicators rather than a single piece of evidence - the group's modus operandi, Farsi-language traces in the attacker infrastructure, and connections originating from terminals in Iran.Why refrigeration is a physical-effect target
Cold chain equipment is an attractive target for anyone who wants a visible physical result without touching a payment system. A refrigeration controller is a small embedded computer with a web interface, often installed years ago by a contractor, rarely patched, and frequently reachable from the public internet for remote maintenance. Nobody expects it to be a security boundary, so it usually is not one. There was no ransom demand and no reported data theft. The effect was purely operational: spoiled stock, fires started by overheating equipment, and stores forced to close or discard inventory. That profile - low sophistication at the access layer, high consequence at the physical layer - is what makes exposed OT gear worth watching. The technical analysis published by RedHotCyber, drawing on Sekoia's research, found more than 2,700 Danfoss systems exposed globally on 11 October, about 1,700 of them in France. By 16:00 on 12 October roughly half of the French devices were no longer publicly reachable.The second wave, which France did not attribute
A second campaign followed in November. BleepingComputer reports more than 115 stores hit across six European countries, including three facilities storing blood products where temperature and defrost settings were altered. RedHotCyber describes incidents on the night of 1-2 November in about a dozen European countries, including Belgium, the Netherlands, Germany and Sweden, with temperatures at the French blood service sites set as high as 110 degrees Celsius before staff intervened. France attributed only the October supermarket attacks to Iran; the origin of the November wave remains publicly unknown. Separately, the FBI and CISA have warned about ongoing attacks on industrial refrigeration and cold-chain monitoring systems. Diplomatically, France said it would summon Iran's ambassador and push for new EU sanctions against Iranian individuals and organisations involved in malicious cyber operations.What operators should check
The defensive lessons are mostly about exposure. Sekoia's honeypot work, as summarised by RedHotCyber, recorded unauthenticated requests to controller web actions and password spraying against supervisor and admin accounts using the password 12345 - a reminder that default credentials on building and cooling equipment are still a live problem, not a historical one.- Inventory every refrigeration and HVAC controller, and find out which ones answer on a public IP address.
- Remove direct internet exposure; put remote maintenance behind a VPN or a jump host with logging.
- Replace default and shared credentials, and check for accounts with full administrative rights that nobody owns.
- Patch or replace end-of-support firmware; if the vendor no longer ships updates, plan the replacement.
- Segment OT and building-management networks away from corporate IT.
- Alert on configuration changes to defrost cycles, setpoints and sensor thresholds, not just on network anomalies.