France blames Iran for supermarket fridge attacks. What’s known, what remains unclear, and how to secure exposed controllers.

French Foreign Minister Jean-Noël Barrot said Iran’s Revolutionary Guard Corps was behind the attacks on supermarket fridges in France on 11 and 12 October. He said they hit 700 sites and raised refrigerator temperatures. Some stores threw away their entire stock of perishable food, and fires broke out in several.

“France attributes destabilization and sabotage campaigns against French interests to the Islamic Republic of Iran (electronic and cyber center of the Islamic Revolutionary Guard Corps of Iran – IRGC-ECC).” reads the announcement published by French cybersecurity agency ANSSI. “Following its investigation, C4 is able to attribute these destructive actions to the Shahid Kaveh cyber-offensive unit, affiliated with the electronic and cyber center of the Islamic Revolutionary Guard Corps of Iran (IRGC-ECC): infrastructure characteristics, use of signing tools, relay of the attack by a propaganda organ linked to Shahid Kaveh, traces of the use of Persian in the attack infrastructure.”

Foreign Minister Jean-Noël Barrot described the attack as “unprecedented in both its scale and its level of aggression” and called it the first major cyber sabotage operation on French soil. He promised EU-level sanctions, and France summoned the Iranian ambassador. EU foreign policy chief Kaja Kallas said the response should be strong, adding that she had only just learned about France’s attribution.

“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran,” Foreign Minister Jean-Noël Barrot said of the cyberattacks on French supermarkets, which occurred on October 11 and 12, and reported Le Monde.

“This attack is unprecedented in both its scale and its level of aggression,” said Barrot. “It marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people.”

“We will implement sanctions at the European level against all those responsible,” he added.

Paris prosecutors opened a judicial investigation into the head of Shahid Kaveh, an offensive cyber unit tied to the Guards’ Electronic and Cyber Center, and his two deputies. Anyone else they identify can be added to the case.

The attribution cites shared infrastructure, attack tools, Persian-language traces, and amplification by a group-linked propaganda outlet.

French authorities say Iranian cyber operations targeting French interests date back to at least 2020. Previous incidents include a planned attack against Charlie Hebdo, a 2023 breach of its online store attributed to Emennet Pasargad, and a 2024 attempt to hijack digital advertising kiosks to display anti-Israel messages ahead of the Paris Olympics. C4 attributes these operations to the IRGC-linked Shahid Shoostari unit.

France wasn’t alone. On 2 November, supermarkets in at least nine other European countries reported a suspected attack on their freezer systems. Barrot spoke only about the French case, so nothing official yet ties the second wave to Iran.

This is where we need to be careful. When a government names a country as responsible for an attack, that’s a serious accusation. But the reports I’ve read don’t explain the technical evidence behind it. We should treat it as an official claim, not a proven fact, and stick to what we know. Fear and uncertainty can be used to spread distrust, and that risk applies to all sides involved in this story.

The key issue isn’t just identifying the attackers, but understanding whether someone is exploiting these incidents to promote a hybrid warfare narrative. Hacktivist claims may serve propaganda and visibility more than reflect actual responsibility. If French investigations confirm Iran’s role in the October attacks, the pro-Russian groups claiming November’s incidents could face a serious credibility problem. They may have tried to take credit for someone else’s operations. Still, their involvement in some incidents remains possible.

In today’s hybrid warfare, uncertain attribution, strategic ambiguity, and information manipulation make it increasingly difficult to separate real attacks from propaganda.

The method used in supermarket fridge attacks, at least, is documented. On 5 November, CISA, the FBI and other US agencies published a fact sheet on the same kind of activity. The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.

The agencies list three ways in: bypassing authentication, injecting code and weak settings. They also warn that operators can lose sight of the real temperatures, which is a bad thing to discover after the cheese has gone.

The fixes are dull and they work. Keep controllers off the internet, and if you need remote access, put an updated firewall in front of it. Separate industrial devices from the office network, change default passwords, add phishing-resistant multifactor authentication, patch firmware and replace devices the maker no longer supports.

Then limit who can change settings with an allowlist of approved devices and IP addresses. Keep tested backups offsite and offline, turn on logging and read the logs. The last control is the cheapest: Define and maintain reasonable setpoint limits for devices operating downstream of controllers to stay within safe ranges and establish alerting for deviations.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Iran)

Hackers hit French supermarkets via unpatched Danfoss refrigeration systems, remote-heating freezers and destroying stock worth millions.

Overnight from Sunday to Monday, a large cyberattack hit the refrigeration systems of hundreds of French supermarkets, BFMTV revealed. The attackers targeted equipment from the Danish maker Danfoss that many French stores use to regulate their cold. Fresh and frozen stock was destroyed, and the Paris prosecutor says there were also fires.

The method is simple and nasty. Refrigeration systems have a forced defrost function that clears ice buildup, and the attackers appear to have triggered it remotely in a continuous mode, with a temperature setting of 50 degrees. The equipment heated for several hours instead of keeping goods cold, and when staff opened the fridges and freezers in the morning, a sector source told BFM, “a wave of heat” came out.

“300 Intermarché and Netto stores, and fewer than 100 U stores, were affected on Monday, October 12, by a cyberattack targeting the refrigeration control systems of the Danish manufacturer Danfoss, according to the two retailers.” reports BFMTV. “Hackers reportedly remotely altered the temperatures of the systems, causing the destruction of stocks of fresh and frozen products.”

The scale is still being counted. The Mousquetaires group says 300 of its Intermarché and Netto stores were affected, Coopérative U says fewer than a hundred of its outlets, and E.Leclerc confirmed repercussions on cooling equipment in several stores without giving numbers. A specialist site reported that Carrefour Market and Monoprix stores were hit too, which those chains haven’t confirmed.

The money follows. A sector source told BFM national losses could reach several million euros, and Intermarché said its affected stores had to throw out all the fresh and frozen products concerned. In Haguenau, an Intermarché reportedly lost its entire frozen stock, an estimated 50,000 euros, and a Leclerc store about 30 kilometers away in Wasselonne reportedly discarded frozen and fresh goods worth around 220,000 euros.

Danfoss stated that it is aware of the incidents in France, noting that they affected a limited number of refrigeration management systems. The company explained that most of the impacted equipment was older hardware—specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates—while the AK-SM800A units involved were running outdated firmware. Danfoss emphasized that it has long advised customers to keep supported systems updated and is actively collaborating with those affected.

Following the attacks, the Paris prosecutor launched an independent investigation into the cyberattack targeting connected refrigerators across major French food retailers. The anti-cybercrime unit is leading the inquiry, with the OFAC office responsible for counting victims and connecting them to the resulting damages, which include spoiled food and fires.

This incident follows a concerning precedent. On August 9, Claroty’s Team82 released research detailing vulnerabilities in Danfoss refrigeration controllers. Upon examining the AK-SM 800A, one of the models targeted in this week’s attack, the researchers discovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols.

The full extent of the damage is still being calculated. The Mousquetaires group reported that 300 Intermarché and Netto stores were affected, while Coopérative U stated that fewer than 100 of its locations were hit. E.Leclerc also confirmed that cooling equipment in several stores was affected, though they did not provide specific figures. Meanwhile, a specialized news site reported that Carrefour Market and Monoprix stores were targeted as well, though these chains have not yet confirmed it.

The financial impact is heavy. Industry sources told BFM that national losses could reach several million euros, and Intermarché confirmed that all affected stores had to throw out their fresh and frozen inventory. For example, an Intermarché in Haguenau lost its entire frozen stock, estimated at 50,000 euros, while a Leclerc store about 30 kilometers away in Wasselonne had to discard around 220,000 euros worth of fresh and frozen goods.

The damage isn’t limited to the east. In the Loire-Atlantique, the huge Leclerc Atlantis in Saint-Herblain took all its frozen products off its Drive service indefinitely, and the Leclerc in Saint-Brevin-les-Pins wasn’t expected to reopen its fresh aisle normally before Tuesday, October 13. Several U stores were hit as well, some only in the frozen aisle, and an Intermarché in the same area too. One photo from BFM shows an ice cream shelf reading 26 degrees, which is a fine temperature for a beach.

Dominique Schelcher, the CEO of Coopérative U, said on X that attacking equipment essential to preserving fresh food and feeding French shoppers is extremely serious and unprecedented. His point is easy to see. Nobody was stealing data here, and the target was food.

The authorities moved quickly. According to the Prime Minister’s office, the national cybersecurity agency ANSSI has identified a vulnerability in software supplied by Danfoss and contacted the company. ANSSI is also talking to its European counterparts because other countries may be affected, and it’s trying to find other French companies hit.

Danfoss stated that it is aware of the incidents in France, noting that they affected a limited number of refrigeration management systems. The company explained that most of the impacted equipment was older hardware, specifically AK-SM800 and AK-SC355 systems that have reached their end of life and no longer receive security updates, while the AK-SM800A units involved were running outdated firmware. Danfoss emphasized that it has long advised customers to keep supported systems updated and is actively collaborating with those affected.

Following the attacks, the Paris prosecutor launched an independent investigation into the cyberattack targeting connected refrigerators across major French food retailers. The anti-cybercrime unit is leading the inquiry, with the OFAC office responsible for counting victims and connecting them to the resulting damages, which include spoiled food and fires.

This incident follows a concerning precedent. On August 9, Claroty’s Team82 released research detailing vulnerabilities in Danfoss refrigeration controllers. Upon examining the AK-SM 800A, one of the models targeted in this week’s attack, the researchers discovered multiple flaws, including a hidden authentication mechanism that bypassed standard login protocols.

Because these controllers are typically managed remotely and feature a built-in web server, an attacker who gains access can send direct commands to the connected cooling systems—such as forcing a manual defrost. Claroty’s research highlights that the product is widely deployed across supermarkets, cold-storage facilities, and logistics warehouses, with a Censys scan revealing 2,765 exposed management interfaces online. Claroty disclosed these vulnerabilities to Danfoss, which subsequently patched them in firmware version R4.3.1.

However, BFM notes that authorities have not officially confirmed whether hackers exploited this specific flaw in the recent attack. If it was the entry point, standard security disclosure practices were followed, as details were withheld until a patch was made available. For legacy, end-of-life units, no security patches exist, leaving disconnecting them from the public internet as the only viable defense.

Below is my interview on the case with TRT World Now.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, French supermarkets)