France Blames Iranian Hackers for Hijacking Refrigeration Systems at 700 Supermarkets via Remote Defrost Controls

France has blamed Iran’s Islamic Revolutionary Guard Corps for a cyberattack that disrupted refrigeration at around 700 supermarket sites.

During the night of October 11–12, 2026, attackers changed cooling controls remotely, causing major food losses and around 20 fires, according to the Paris prosecutor’s office.

Foreign Minister Jean-Noël Barrot confirmed the attribution on November 9, calling it an attack of “unprecedented scale and unprecedented aggression.”

He said France had summoned Iran’s ambassador and would seek European sanctions against those responsible. The affected retailers included Système U, Intermarché, and E.Leclerc.

Iranian hackers supermarket cyberattacks

Investigators said the attackers reached refrigeration control systems through web interfaces, targeting equipment from Danfoss, followed by Dixell and Copeland.

Once inside, they started abnormal defrost cycles with no time limit. They also disabled sensor safety alerts that should have warned staff when temperatures exceeded set limits.

Defrosting normally removes ice so cooling equipment can work properly. Keeping that function running prevents units from maintaining safe temperatures.

Earlier Cybersecurity News coverage of the supermarket fridge attacks described how remote changes left retailers checking stock and removing chilled and frozen food that could no longer be sold safely.

The attack therefore combined two harmful actions: changing the physical cooling process and removing warnings about the resulting temperature rise.

That distinction matters because the damage was not limited to stolen information or unavailable software. The compromised controls directly affected food storage and created safety risks inside stores.franceinfo

According to Franceinfo’s report on the investigation, the judicial inquiry targets the leader of Shahid Kaveh, his two deputies, and others yet to be identified. Prosecutors described Shahid Kaveh as an offensive cyber unit linked to the IRGC’s electronic and cyber center.

France’s Anti-Cybercrime Office and domestic intelligence agency, DGSI, investigated the incident. Prosecutors cited an attack pattern associated with the unit, the use of Farsi, and IP addresses linked to devices in Iran.

The inquiry covers organized computer attacks and dangerous damage, aggravated by allegedly serving a foreign power.

The exact entry method remains publicly unconfirmed. Franceinfo’s technical reporting noted a previously disclosed authentication weakness in Danfoss AK-SM 800A systems, but said its use in this attack had not been established.

Separately, Cybersecurity News documented thousands of exposed Danfoss hosts, a count that does not prove each system was compromised.

Operators should remove control interfaces from public internet access, install supported updates, replace default passwords, and restrict remote maintenance through protected connections.

Recovery also requires checking controller settings, defrost schedules, accounts, and alerts. Restoring connectivity without reviewing those settings could leave harmful changes in place.

French officials have also cautioned against linking every refrigeration incident to this group. ANSSI chief Vincent Strubel said similar attacks affecting French blood service sites had not been attributed to the same attacker.

That boundary remains important as investigators separate confirmed findings from similarities across incidents.

The post France Blames Iranian Hackers for Hijacking Refrigeration Systems at 700 Supermarkets via Remote Defrost Controls appeared first on Cyber Security News.