France accuses IRGC of hacking supermarket refrigeration systems

Paris alleges that an Iranian cyber unit sabotaged refrigeration controls in hundreds of French supermarkets, destroying large quantities of food and raising concerns about the vulnerability of essential commercial infrastructure.

France has accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of orchestrating cyber-attacks that disrupted refrigeration systems in hundreds of supermarkets across the country, in an incident that exposed the vulnerability of everyday infrastructure to digital sabotage.

Foreign Minister Jean-Noël Barrot described the operation as unprecedented in its scale and aggression, warning that those responsible would face sanctions. He said the attack represented a major threat to France’s national interests and public security. The French government has summoned Iran’s ambassador in Paris to lodge a formal protest.

Iran has not issued an official response to the allegations. Some Iranian media outlets have dismissed them as baseless. The French government has not publicly explained the intelligence or technical evidence underpinning its attribution, while investigators continue to examine the case.

The first reported wave of attacks took place on 11 October, when hackers gained control of software used to regulate the temperatures of supermarket refrigeration units.

More than 100 stores operated by Coopérative U were affected, alongside 180 Intermarché and Netto outlets. Other major retailers, including Carrefour, Monoprix and E.Leclerc, were also targeted.

The attacks exploited software supplied by Danish engineering company Danfoss, which enables retailers to manage refrigeration systems remotely. In some supermarkets, refrigerator temperatures reportedly rose to 50°C overnight, resulting in the destruction of tonnes of chilled and frozen food.

The incident demonstrates how systems designed to improve operational efficiency can become potential points of entry for cyber-attacks. Although refrigeration controls are not traditionally regarded as critical digital infrastructure, their disruption can have immediate consequences for food safety, supply chains and retail operations.

The Paris prosecutor’s office has opened an investigation involving the head of an offensive cyber unit associated with the IRGC and two of his deputies.

Paris prosecutor Laure Beccuau identified the unit as Shahid Kaveh, which she said was affiliated with the IRGC’s electronic and cyber centre. The name is used for a group of hackers believed to be directly employed by the Iranian state.

However, the public information available so far does not establish precisely how investigators linked the attacks to the unit. Attribution in cyber incidents can be difficult because perpetrators can conceal their locations, identities and operational methods.

A pair of Russian-aligned hacktivist groups claimed responsibility for the attacks on Wednesday, but their claims received limited credibility among observers, according to the BBC report. The French authorities have continued to point towards an Iranian connection.

A second wave of cyber-attacks earlier in November affected more than 100 supermarkets across several European countries.

Retailers in Belgium and Luxembourg were among those affected, while smaller numbers of stores in Sweden, Ireland, the Netherlands, Estonia and Finland also experienced disruptions.

It remains unclear whether the incidents across Europe were connected to the French attacks or involved the same perpetrators. The geographical spread nevertheless raises concerns about the security of remotely managed refrigeration systems used by major food retailers.

The BBC also reported a separate incident in August involving malfunctioning refrigerators at a small number of US military bases, where food was spoiled. Reuters, citing sources familiar with the matter, reported that the incident was being investigated as a possible deliberate cyber-attack. No established connection between the US incidents and the European attacks has been demonstrated.

The accusations come amid heightened tensions involving Iran, the United States and Israel. In recent weeks, some Iranian commentators and politicians have argued that any renewed conflict should prompt retaliation beyond the Middle East.

The possibility that the supermarket attacks formed part of a broader deterrence strategy remains unconfirmed. The French government has not established publicly whether the operation was connected to Iran’s regional military calculations or other strategic objectives.

Barrot said France would take necessary and proportionate measures to deter further attacks. The response could include sanctions, although the government has not detailed the measures under consideration.

The case also illustrates the growing significance of cyber operations in international disputes. Unlike conventional military action, attacks on digital systems can disrupt civilian services and commercial operations without requiring a physical presence at the targeted location.

The supermarket incidents raise questions about the cybersecurity of systems that control essential services and everyday business operations. Refrigeration networks, building management systems, industrial controls and logistics platforms increasingly depend on remote software and connected devices.

A compromise of these systems can produce consequences beyond data theft or temporary service disruption. In this case, manipulating temperature controls reportedly caused food losses across multiple retailers, demonstrating how digital access can translate into physical and economic damage.

For businesses, the incident underscores the importance of securing remote-access systems, monitoring unusual changes in operational settings and maintaining safeguards that can prevent unauthorised control of critical equipment.

For governments, the challenge is more complex. Establishing responsibility for a cyber-attack requires credible technical and intelligence evidence, while responding to state-linked operations involves diplomatic, legal and security considerations.

France’s accusation against Iran marks a significant escalation in the diplomatic response to the supermarket attacks. But the central questions remain unresolved: what evidence connects the suspected cyber unit to the operation, whether the European incidents were coordinated and whether similar attacks could target other essential commercial systems.

Sources

• BBC — France accuses Iran of supermarket fridge hacking — source report by Ella Kipling and Joe Tidy, BBC World Service, 10 November 2026.
• Reuters — Reporting on suspected deliberate cyber-attacks involving refrigeration systems at US military bases, as cited by the BBC.
• Danfoss — The refrigeration-management software provider identified in the BBC report.