Refrigeration attacks draw attention to connected-device security
Further details published on November 11 put the number of French stores affected by the October 11-12 refrigeration attacks at about 700. A second wave of suspected attacks on November 2 affected businesses in at least nine European countries.
French authorities have attributed the first attack to an Iran-linked cyber unit. Responsibility for the second wave remained unclear, so the two waves should not automatically be attributed to the same actor.
France's cybersecurity agency described exposed control systems, weak or default passwords and older equipment without security updates as contributing weaknesses. Unique passwords, supported software and limited remote access are important safeguards for connected equipment.
Earlier report (2026-11-10)
UPDATE: France has accused Iran of involvement in cyberattacks on supermarket refrigeration systems and opened an investigation into a cyber unit allegedly linked to Iran's Islamic Revolutionary Guard Corps. The official action follows earlier reports that French authorities suspected Iranian state-backed hackers.
Foreign Minister Jean-Noel Barrot said France had summoned the Iranian ambassador to condemn the attacks and would pursue sanctions at European level. This is a stated intention to seek sanctions, not an announcement that new European Union measures have already taken effect.
The Paris prosecutor's office has requested international arrest warrants for the head of the Shahid Kaveh cyber unit and two deputies. The request does not mean the warrants have been issued or that the allegations have been proven.
An attack on 11 October altered temperature controls at hundreds of retail locations in France. Some refrigeration units reportedly caught fire, while melted ice cream and spoiled meat were discarded. Retailers estimated losses could run into tens of millions of euros.
A second wave this month targeted more than 100 organisations across Europe. French blood-bank refrigeration was also affected, requiring blood supplies to be moved to other cold-storage rooms. Iran has routinely denied conducting malicious cyber operations.
The network equipment image is illustrative, not a photograph of the affected refrigeration systems.
