French authorities say a cyberattack in mid-October hit approximately 700 retail locations nationwide by manipulating refrigeration controllers, causing food spoilage and triggering at least 15 fires. The French government accuses an Iran-linked cyber unit of orchestrating the attack.
What Happened
Between the evening of October 11 and the next morning, hackers accessed Danfoss and Dixell refrigeration controllers via their web interfaces. They disabled essential safety features—turning off alerts tied to temperature thresholds—and forced unusually long defrost cycles, leading to elevated temperatures that damaged food stock. Retail giants including Casino, Leclerc, Carrefour, Intermarché, Coopérative U, and Metro were targeted, among others; small butcher shops and slaughterhouses were also hit. About 20 fires were reported during the assault. A related, but less severe, attack targeted Schneider Electric devices in several small hydroelectric plants.
Ties to Iran and Shahid Kaveh
France alleges that the attack was carried out by Shahid Kaveh, a unit of the Islamic Revolutionary Guard Corps (IRGC), operating under hacktivist fronts such as CyberAveng3rs and Cyber Isnaad Front. Evidence cited includes use of certain reconnaissance and scanning tools typical of this group (including a tool known as FOFA), Persian-language activity, and infrastructure overlaps with other known campaigns. Traces of IP addresses in Iran were also discovered. The National Cybersecurity Agency (ANSSI), intelligence services DGSE and DGSI, together with cyber defense bodies, are part of the investigative task force known as C4, which led the attribution effort.
In response, France has launched a judicial probe. Charges under scrutiny include unlawful interference with computer systems and causing damage through means dangerous to people, aggravated by the fact it is allegedly on behalf of a foreign power. International arrest warrants are being sought for the unit’s leadership. Meanwhile, diplomatic pressure is ramping up, as France intends to summon Iran’s ambassador and push European partners for new sanctions.
Technical Findings & Security Guidance
The retail-site intrusions exploited four families of refrigeration and controller systems: Danfoss AK-SM and AK-SC, Copeland xweb, and Dixell xweb units. Many of these devices were exposed directly to the internet, violating best practices. The alert from France’s CERT-FR highlighted that default credentials and insecure settings remain widespread.
Recommendations for operators include removing external internet exposure, reviewing defrost cycle configurations, enforcing firmware updates, replacing default credentials, using VPNs or firewalls for remote access, and fully resetting compromised units to factory defaults. For devices at end-of-life that no longer receive patches, the risks remain especially acute; factory resets alone will not remediate the inherent vulnerabilities in those cases.
France estimates that the food losses from this sabotage run into tens of millions of euros. The government refers to the incident as the first cyber-offensive aimed solely at sabotage on its soil. The broader relevance became stark as Europe has recently seen similar refrigeration-related disruptions.
Strong attribution in cyberattacks is rare, but C4’s findings rely on multiple converging indicators. Traces of common techniques, overlapping infrastructure, linguistic clues, and forensic data lend weight to France’s charge against the IRGC unit.
This episode underscores the risks baked into industrial control systems and critical infrastructure as IoT devices proliferate. It also signals that nation-state sabotage is no longer a theoretical threat—it’s happening in public, affecting supply chains and civilian safety.
What this means: Governments must rethink cyber-resilience strategies. Operators of industrial control systems should prioritize segregation of networks, rigorous patch management, and cutting off unnecessary external access. Diplomatically, this incident could intensify tensions between Europe and Iran, and may drive new sanctions or cyber-norm rules.
