The French Government has formally accused Iran of orchestrating a wave of destructive cyberattacks targeting the country’s critical infrastructure, including the widespread sabotage of commercial refrigeration systems across the nation’s supermarkets.
According to the French National Cybersecurity Agency (ANSSI), Iranian military hackers successfully infiltrated and took control of refrigeration systems at roughly 700 retail sites across France on the night of October 11-12.
The attackers systematically overrode temperature settings in the middle of the night, driving temperatures up in freezers, fridges and chiller cabinets, in some cases to 50C, by hijacking the units’ defrost function.
The targeted sabotage forced tonnes of food to be dumped, spoiling millions of euros’ worth of inventory. Intermarché chief executive Thierry Cotillard estimated the damage at “tens of millions of euros” nationwide.
In some instances, the extreme temperature spikes melted equipment and sparked fires, triggering store sprinkler systems and causing water damage.
French foreign minister Jean-Noël Barrot, speaking on November 9 on the sidelines of a G7 meeting in Paris, condemned the hacking campaign as “unprecedented in both its scale and its level of aggression”.
He stated that the breach “marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people. That is why it will not go unanswered.”
In response, the foreign ministry summoned the Iranian ambassador in Paris, and Barrot vowed to push for European sanctions against Tehran. On November 10, he said France ruled out “nothing” and would take “all measures — including those we may not disclose publicly — that we deem proportionate and necessary to deter any further attacks”.
The Paris Public Prosecutor’s Office has opened a formal investigation and announced it is seeking international arrest warrants for the head of an Iranian cyber unit known as Shahid Kaveh and his two deputies.
French authorities have directly linked the unit to Iran’s Islamic Revolutionary Guard Corps (IRGC), describing it as an offensive cyber unit affiliated with the IRGC’s Electronic and Cyber Centre.
ANSSI investigators reportedly tracked the perpetrators through digital infrastructure clues, connections to known propaganda outlets and traces of the Farsi language left in the attacks. Paris prosecutor Laure Beccuau also cited “IP addresses pointing to devices located in Iran”.
On October 21, ANSSI director general Vincent Strubel told French senators the intrusions had been made possible by “elementary security flaws” and weak passwords on internet-exposed equipment.
The attacks hit major French supermarket chains.
Intermarché reported that at least 300 of its stores and its Netto brand locations were affected.
Coopérative U saw nearly 100 of its sites hit, while Carrefour reported 80 affected supermarkets. Monoprix indicated that approximately 5 per cent of its network of some 490 stores was compromised, and E.Leclerc said several of its stores were targeted.
Beyond supermarkets, hackers also accessed the control systems at cold stores stocking blood products at three sites of the French Blood Establishment (EFS) on the night of November 1-2, forcing employees to scramble to save lifesaving samples from spoiling.
The EFS said no blood products were lost. Barrot said he could not comment on whether Iran was behind that incident, as investigations were still ongoing.
ANSSI confirmed the hackers also targeted several small hydroelectric power plants, though those breaches resulted in “moderate effects”.
The French incident appears to be part of a broader, systemic vulnerability in commercial cold-chain infrastructure.
On November 2, similar overnight temperature spikes and refrigeration failures hit dozens of stores and a food distribution hub across Belgium, Luxembourg, Ireland, Sweden, Estonia, the Netherlands, Finland and Italy.
While France is the first government to formally attribute the attacks, the FBI, the US Cybersecurity and Infrastructure Security Agency (CISA) and three other federal departments issued a joint warning on November 5 regarding malicious activity targeting industrial refrigeration worldwide.
The agencies warned that attackers “may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers” to alter system settings, and urged organisations to take their controllers off the public internet and secure them behind firewalls.
The Iranian government has yet to issue an official response to the French prosecutor’s allegations. Tehran routinely denies carrying out malicious cyber operations.
Most recent cyberattacks in Europe have been attributed to Russia, which always denies responsibility.
