In what officials in France are calling an attack of historic scope, Iranian-linked hackers allegedly targeted refrigeration systems across approximately 700 supermarkets on the night of October 11–12, 2026. The assault caused widespread spoilage of chilled and frozen goods—and triggered about 20 fires—by interfering with cooling controls and disabling critical safety sensors. Authorities trace the breach back to Iran’s Islamic Revolutionary Guard Corps (IRGC).
How the Attack Unfolded
French investigators believe the intruders accessed supermarket refrigeration via web interfaces tied to equipment from manufacturers including Danfoss, Dixell, and Copeland. Once inside, they manipulated defrost cycles—keeping them active without a time limit—and shut off alerts designed to signal when temperatures rose above safe thresholds. The result: cooling units could no longer maintain safe temperatures, and store staff were forced to dispose of perishable inventory that had been compromised.
The retailers affected include major chains such as Système U, Intermarché, and E.Leclerc. French authorities say the tactics went beyond the typical data theft or software sabotage: this intrusion physically endangered food safety and the well-being of customers.
Attribution and Investigation
The Paris public prosecutor’s office has formally blamed the IRGC, citing ballistic indicators such as IP addresses inside Iran, language in Farsi used during the attack, and forensics linking the breach to known IRGC infrastructure. A unit known as Shahid Kaveh—connected to the IRGC’s electronic and cyber center—is said to be leading the operation. Key figures within that group are now under judicial inquiry, including two deputies and an alleged head of Shahid Kaveh.
Officials have yet to publicly confirm the exact point of entry. Some reports point to a known authentication weakness in Danfoss AK-SM 800A refrigeration controllers, but there’s no firm confirmation that this was exploited. Tens of thousands of exposed Danfoss systems across the internet have been catalogued, but exposure doesn’t equal compromise.
Official Response and Next Steps
France has responded diplomatically by summoning Iran’s ambassador and calling for EU-level sanctions. On the technical side, French cybersecurity authorities suggest immediate actions for retailers: block web interfaces from public internet access, update firmware/software, replace default passwords, limit remote maintenance to protected connections, and review all defrost, alert, and sensor configurations in refrigeration controllers. Restoring only the network connection isn’t enough—settings must be verified to prevent repeat damage.
The DGSI (France’s domestic intelligence agency) and the Anti-Cybercrime Office are jointly leading the investigation. Prosecutors have brought charges under statutes governing organized cyberattacks and damage enhanced by foreign-state involvement. Officials caution researchers not to conflate this case with other refrigeration anomalies or system failures unless there’s concrete attribution.
What this means: this incident marks a dangerous escalation. Physical infrastructure—in this case, food-storage—and public health were attacked, rather than simply data or digital systems. Looking ahead, supply-chain organizations, food retailers, and infrastructure operators will be under stronger pressure to harden controls that bridge the digital and physical worlds. Authorities will need stronger international cooperation to deter such state-sponsored cyber operations.
