France has formally accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of orchestrating a series of malicious cyber-attacks that disrupted supermarket refrigeration systems across the nation last month. French Foreign Minister Jean-Noël Barrot described the incident as unprecedented in both its scale and level of aggression, warning that those responsible will face significant sanctions imposed at the European level.
The cyber-sabotage, which occurred on 11 October, involved hackers gaining unauthorized access to software used to manage cold storage units in numerous retail outlets. The breach affected over 100 Coopération U supermarkets, alongside 180 stores operating under the Intermarché and Netto brands. In some instances, the temperature inside refrigeration units was forced up to 50C (120F) overnight, resulting in the spoilage of fresh and frozen goods valued at millions of euros.
Minister Barrot characterized the operation as a major assault on national interests and public security. In response to the intrusion, the French government has summoned the Iranian ambassador to Paris to lodge a strong formal protest. Barrot stated that France is prepared to implement any necessary and proportionate measures to hold those involved accountable and to deter future attempts at such sabotage.
Parallel to these diplomatic actions, the Paris prosecutor’s office has launched a formal investigation targeting the head of an offensive cyber unit linked to the IRGC, as well as his two deputies. Prosecutor Laure Beccuau identified the unit as Shahid Kaveh, which is allegedly affiliated with the electronic and cyber branch of the IRGC. This group is widely believed to be composed of hackers directly employed by the Iranian regime.
The attack utilized vulnerabilities in software provided by the Danish engineering firm Danfoss, which enables retailers to manage temperature controls remotely.
Beyond the initial wave in France, a subsequent series of hacks took place earlier this month, impacting more than 100 stores across several European countries, including Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland. Other retailers impacted by the wider campaign included Carrefour, Monoprix, and E.Leclerc.
While some Russian-aligned hacktivist groups attempted to claim responsibility for the disruption, officials and experts have expressed skepticism regarding these claims. Although the French government has not disclosed the specific methodology used to attribute the attacks to Iran, officials acknowledge that identifying the perpetrators of such digital operations remains difficult due to the ability of attackers to obscure their geographic locations. Few believed them, in spite of a pair of Russian-aligned hacktivist groups claiming they were responsible on Wednesday.
Iran has not yet issued a response to the allegations leveled by the French foreign minister.
Additionally, reports indicate that a small number of US military bases experienced similar refrigeration malfunctions in August. That incident is currently being treated as a potential deliberate cyber-attack, according to information from sources familiar with the matter. Spoiling food, separately in August a small number of US military bases had fridges mysteriously malfunction.
