France links supermarket refrigeration attacks to Iran-backed group
French authorities have attributed October attacks on refrigeration systems at hundreds of food retail and agricultural sites to an Iran-linked cyber unit, escalating concern about the exposure of operational technology that keeps food supplies safe. The incidents disrupted refrigerator controllers, spoiled food and caused fires, according to details released by French officials.
The attacks took place on Oct. 11 and 12 and affected refrigerator controllers at about 700 retail locations across France, the French National Cybersecurity Agency said. Attackers remotely reset the equipment to extremely high defrost temperatures. The resulting failures spoiled food worth millions of euros and led to at least 15 fires.
France’s Cyber Crisis Coordination Centre linked the activity, after an investigation, to the Shahid Kaveh offensive cyber unit. The Ministry for Europe and Foreign Affairs made the formal attribution. Authorities said the campaign also affected a slaughterhouse, butcher shops and cooperative agri-food sites. Separately, hackers targeted Schneider Electric equipment at small hydroelectric facilities in France.
Exposed controllers raise operational risk
In October, France’s national cybersecurity agency connected the compromised refrigeration equipment to vulnerabilities in controllers made by Danfoss and Copeland. Successful exploitation could give an attacker control of a device, according to the agency’s account. Many such systems are exposed to the public internet, making them discoverable by remote actors.
Researchers at Claroty disclosed the flaws in August through a coordinated process with Danfoss. They had found the vulnerabilities in 2025 and worked with the manufacturer for more than a year to investigate them, develop a patch and notify customers. The available information does not identify specific affected product versions or provide CVE numbers, so operators should consult the manufacturers and relevant advisories to determine whether their equipment is affected.
The incidents illustrate how compromise of a relatively specialized control system can produce consequences beyond IT service disruption. Refrigeration controls directly affect the conditions needed to preserve food, while equipment at agricultural and energy facilities serves other physical processes. Internet exposure and the possibility of remote control therefore make asset identification and careful management of access important priorities for operators.
France and EU signal a coordinated response
France said it would summon Iran’s ambassador to condemn the attacks and work with European partners to pursue sanctions against organizations and individuals involved. The government also reserved the option of taking further public or non-public measures it considers necessary and appropriate. The Paris Public Prosecutor’s Office has opened a judicial investigation and, according to authorities, intends to seek international arrest warrants for members of the Shahid Kaveh group.
European Union officials confirmed France’s attribution and said they were coordinating with French authorities on a joint response. A European Commission spokesperson expressed the bloc’s solidarity with France over the disruption to refrigeration systems in hundreds of supermarkets.
French authorities’ announcement comes amid reports of related activity elsewhere. Earlier in November, hackers launched a similar round of attacks against supermarket refrigeration systems in Europe. Attackers also targeted an equipment supplier linked to the French Blood Establishment, which manages blood plasma used for transfusions and other purposes.
U.S. agencies warn refrigeration operators
The FBI and the Cybersecurity and Infrastructure Security Agency issued an advisory urging providers of industrial refrigeration and cold storage to take additional steps to protect their systems. The Retail and Hospitality Information Sharing and Analysis Center also warned members about the heightened threat. Google security executives briefed RH-ISAC officials on the threat environment, according to the information provided by authorities.
For operators, the immediate challenge is to understand which controllers are deployed, whether they are reachable from the internet and whether vendor patches or mitigations apply. The reported use of remote access against exposed equipment reinforces the need to review connectivity and restrict unnecessary external access. Organizations should also account for the operational impact of controller changes and system outages, including how staff will detect abnormal temperatures and respond if automated refrigeration fails.
The attribution has wider relevance because Shahid Kaveh is described as the public-facing name for threat actors associated with CyberAv3ngers. Check Point Research has linked the group to years of attacks against the U.S. water sector and said it was known for targeting vulnerabilities in Unitronics programmable logic controllers. Check Point also reported scanning activity against VNC ports at Israeli industrial facilities in March 2026. Those details do not establish that the same methods were used in the French refrigeration incidents, but they underline the group’s reported interest in internet-accessible operational technology.
U.S. agencies have also been investigating suspected outages at military commissaries that began in August, though the supplied information does not establish a connection to the French campaign. The latest advisory places industrial refrigeration and cold storage among the operational environments requiring attention as authorities assess threats to essential services and supply chains.
