French authorities have attributed a series of disruptive cyberattacks on supermarket refrigeration systems to Iran’s Islamic Revolutionary Guard Corps (IRGC).
The intrusions, which occurred in October 2026, forced major retailers to discard large quantities of perishable food after remote temperature controls were compromised.
French Minister of Foreign Affairs Jean-Noel Barrot confirmed the state-level responsibility on November 9, 2026, as reported by detikNews. Barrot described the incident as an act of sabotage against French national interests. "I can confirm that these attacks were carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran," Barrot stated.
He further characterized the operation as a cyberattack aimed at sabotaging French national territory, noting its "unprecedented" scale and aggression. The French government has summoned the Iranian ambassador to Paris to lodge a formal protest regarding the acts, which the government says caused food to rot and be discarded.
October Refrigeration Attacks
The initial wave of attacks targeted supermarket cooling systems on October 11 and 12, 2026. According to Kompas, the hackers gained remote access to refrigeration units, causing temperatures to spike to 50 degrees Celsius. In some instances, the temperature manipulation reportedly triggered fires.
Intermarche CEO Thierry Cotillard estimated that the damages across the affected stores could reach tens of millions of euros. Specific impact data includes approximately 150 stores for Les Mousquetaires (Intermarche), 80 stores for Carrefour, and 25 stores for Monoprix, representing 5 percent of its 490 total locations in France.
Investigations by French authorities suggest the attackers exploited firmware vulnerabilities in systems manufactured by the Danish firm Danfoss. While Danfoss indicated that older firmware versions were likely the primary entry point, the Paris Prosecutor’s Office has opened a formal judicial investigation into the Shahid Kaveh group, a cyber unit affiliated with the IRGC’s Electronic and Cyber Center.
Claroty, a cybersecurity firm, had previously published research on August 9 identifying these specific vulnerabilities in Danfoss systems. Prime Minister Sebastien Lecornu has ordered the French National Cybersecurity Agency (ANSSI) to conduct a formal investigation into the breaches.
Expansion to Medical Facilities
The scope of the cyber campaign extended beyond retail in early November. On the night of November 1, 2026, hackers targeted refrigeration facilities managed by Coolworld, a contractor for the French Blood Establishment (EFS).
The attackers attempted to alter the temperature settings of storage units—typically kept at minus 30 degrees Celsius—to 110 degrees Celsius. The incident was detected early by staff, and the Ministry of Health confirmed that blood transfusion operations remained unaffected.
France has opened an investigation and accused Iran of being behind recent cyberattacks targeting refrigeration units in supermarkets. French authorities says that they are probing a cyber unit affiliated with the Islamic Revolutionary Guard Corps (IRGC). pic.twitter.com/G6X93MZv5w
Global Cybersecurity Warnings
The FBI, CISA, and several federal departments issued a joint warning on November 7, 2026, urging organizations to isolate cooling systems from the public internet. The U.S. government noted that similar intrusions have been observed across various global infrastructure sectors, including a reported August incident involving grocery units at a U.S. military base.
Diplomatic and Regulatory Response
Foreign Minister Barrot announced that France intends to coordinate with European partners to impose sanctions on those responsible for the sabotage. European Union High Representative for Foreign Affairs Kaja Kallas echoed the need for a unified stance, stating that the EU’s response must be firm.
In the legal sphere, experts like Hanoi-based lawyer Nguyen Phu Thang have noted that regulations, such as those under Decree No. 174/2026/ND-CP, provide frameworks for penalizing the dissemination of false information, such as content intended to cause public panic, while emphasizing the need to distinguish between foreign recommendations and official domestic guidelines regarding emergency preparedness.
Retailers Face Impacts as Authorities Investigate Security Gaps
Retailers including Intermarche, Carrefour, Monoprix, E Leclerc, and Cooperative U reported impacts. Intermarche alone reported that approximately 150 of its stores were targeted during the initial October wave.
The Paris Prosecutor’s Office is investigating the Shahid Kaveh group, an IRGC-affiliated unit. Meanwhile, technical investigations have pointed toward security gaps in Danfoss-manufactured controllers, specifically those running outdated firmware.
Security agencies, including those in the U.S. and France, have warned that the same vulnerabilities could potentially affect other vital sectors. Experts cited by Warta Ekonomi noted that hospitals and energy grids are at risk if their internet-connected control systems remain unpatched or exposed.
More on France
French officials have accused Iran’s Islamic Revolutionary Guard Corps of responsibility for the cyberattacks that knocked out commercial refrigerators and freezers across France last month, saying there would be consequences for Iran. 🔴 LIVE updates: https://t.co/j5JxfVazVc pic.twitter.com/OwcEo3OJxS
Related reading