 |
| AI-generated illustration of a supermarket freezer aisle at night, with frost-covered doors standing open, cold mist on the floor, and a glowing red warning light on a temperature control panel. |
On Monday 9 November 2026, France formally accused Iran's Islamic Revolutionary Guard Corps of carrying out the cyberattacks that knocked out supermarket refrigerators and freezers across the country last month. Foreign Minister Jean-Noël Barrot called the attack one of "unprecedented scale and unprecedented aggressiveness" and described it as the first large-scale cyberattack carried out for sabotage purposes on French national territory. France has summoned Iran's ambassador, threatened sanctions at a European level, and opened a criminal investigation into the head of the Iranian cyber unit it says was responsible. The announcement, reported on Monday by Reuters, CNN, the BBC and The Times, is the biggest single development yet in a story that began with spoiled food in French supermarkets and has since spread across Europe. This guide explains what France actually announced, what evidence it says it has, what is still unproven, and why the attribution matters far beyond the freezer aisle.
Two cautions before the detail, because this story is easy to overstate. First, what France has issued is an accusation, not a court verdict. Iran has not responded to the allegations, and it routinely denies carrying out malicious cyber operations. The evidence France cites — traces of Farsi in the attack infrastructure and IP addresses pointing to devices in Iran — has been described by French officials, not independently verified by outside investigators. The New York Times, quoted by The Times, reported that America's spy agencies reached only a "low-confidence" judgment that Iran was behind the attacks. Second, the attribution covers the October attacks in France, not the second wave of freezer attacks that hit supermarkets in Belgium, Sweden, Ireland and other European countries at the start of November. Nobody has claimed responsibility for that wave, and it remains unclear whether it is linked to the French attacks at all. Keep those two limits in mind and the rest of the story reads very differently.
As an Amazon Associate, we earn from qualifying purchases.
Prices and savings can change. Check the retailer for the current price.
The October attack itself was, by any measure, extraordinary. On 11 and 12 October 2026, hackers remotely connected to the refrigeration controllers of around 700 commercial sites across France and switched the units into defrost mode, pushing temperatures inside fridges and freezers as high as 50 degrees Celsius. Food worth tens of millions of euros was spoiled, and at least 15 fires broke out as the overheated equipment caught alight. Most of the affected sites were supermarkets belonging to chains including Intermarché, Système U and E.Leclerc, but the French report says the hacking also hit small butcher stores, a slaughterhouse and factories processing foodstuffs. Supermarket employees spent the hours after the attack carting boxes of perished meat and melted ice cream into giant waste containers. The Paris prosecutor's office has now opened a criminal investigation into suspected offences including fraudulent interference with an automated data-processing system and causing damage by means dangerous to persons.
What France announced on Monday
The announcement came in two parts, and both landed within minutes of each other. First, Reuters reported that investigators privately suspected Iran of being behind the attacks. Minutes later, the French government said so publicly. Barrot, speaking to reporters on the sidelines of a G7 meeting, said the Islamic Revolutionary Guard Corps was behind the October attack, that the Iranian ambassador had been summoned to the foreign ministry to hear France's protest "in the strongest terms", and that France would seek sanctions "at European level against all those responsible for this attack". He added that the attack "represents a major assault on the nation's interests and on the security of the French people".
The second part came from France's prosecutors and its intelligence and cyber agencies. In a joint report, French spy and cyber agencies accused a unit called Shahid Kaveh, described as a cyber offensive unit tied to the Revolutionary Guards' Electronic and Cyber Center, of being behind the hacking campaign. The report named three alleged associates: Hamid Reza Lashgarian, the head of the unit, and his two deputies, Mahdi Lashgarian and Reza Salarvand. The Paris prosecutor, Laure Beccuau, said investigators had opened a case against the three men and requested international arrest warrants. According to the French report, the hackers worked through front groups posing as vigilante hackers, including groups calling themselves "CyberAveng3rs" and "Cyber Isnaad Front". The French said they linked Shahid Kaveh to the attacks by tying the incidents to digital infrastructure used in the sabotage, by matching the pattern of the intrusion to other hacks carried out by the same unit, and by recovering traces of Farsi in the attack infrastructure. The prosecutor's office also cited "the use of Farsi and IP addresses pointing to devices located in Iran".
The reaction was swift. Kaja Kallas, the European Union's chief diplomat, said: "Our response should be strong." The US secretary of state, Marco Rubio, said at the same G7 meeting that he would not be surprised if Iran was responsible, adding that Iran has "done things like this for a very long time". President Emmanuel Macron warned that artificial intelligence presents a real threat to global security and called for collective action in the wake of the attack. Iran's mission to the United Nations did not return messages seeking comment, and there was no immediate comment from Tehran on the French allegations.
How the freezers were hacked
The technical side of this story is, in a sense, the most alarming part of it, because the attack was not sophisticated. Modern supermarket refrigeration is managed centrally: temperature sensors, controllers and monitoring software report back to head office, raise alarms when a unit warms up, and let engineers adjust settings remotely. The attackers reached the controllers that run the cooling equipment — systems supplied by the Danish manufacturer Danfoss and the Italian firm Dixell — and told them to stop cooling and start warming, by switching the evaporators into defrost mode. Defrost is a legitimate function, normally run briefly to clear ice build-up. Left running, it turns a freezer into an oven.
That is the world of "operational technology", or OT: the computers that run physical things, from factory lines to power grids to fridge compressors. Much OT equipment was designed years ago, before anyone expected it to be reachable from the internet, and it often runs old software that is rarely patched because taking a system offline to update it is disruptive and expensive. Reuters reported that the firm behind many of the stricken units said several were obsolete or running outdated firmware, which could have made it easy for hackers to break in. Saher Naumaan, a senior threat researcher at the cybersecurity company Proofpoint, told Reuters the cold-storage sabotage was less a measure of Iran's cyber prowess than of "how exposed these systems are". In other words, the attackers did not need to defeat a hardened target. They needed to find a door that was already open.
Why France is treating this as a state attack
France's language matters here, because it turns a crime story into a diplomatic one. Barrot called the incident the first large-scale cyberattack carried out for sabotage purposes on French soil, and the foreign ministry said the campaign was "unprecedented in its scale and level of aggressiveness". The ministry linked the attack to what it called a long-term Iranian campaign of destabilisation, citing the hacking of the satirical magazine Charlie Hebdo in 2023 and attempts to disturb the 2024 Paris Olympic Games. France's cyber crisis coordination centre — which brings together the national cybersecurity agency, the internal and external intelligence agencies, the armaments directorate and the cyber-defence command — said the attack on French industrial refrigeration controllers on 11 and 12 October "represents an unprecedented campaign in its scale and level of aggressiveness".
The attribution also fits a wider pattern that Reuters described in its reporting. The French supermarket hacks were among the most disruptive cyberattacks of what Reuters called the "Iran war" that began in February 2026, after the United States and Israel launched strikes against Iran. That conflict has been marked by scattered incidents of alleged digital disruption, including hacks against the Los Angeles transit system in March, against US water treatment plants in July, and against ships bound for the United States in August. Shortly after the February strikes, the US intelligence community issued private warnings to American companies and government agencies urging vigilance amid the threat of possible cyberattacks from Iran, according to national security sources and memos reviewed by CNN. Microsoft, meanwhile, had privately tied Iran to the October cold-storage sabotage at least two weeks before the French announcement, according to three people familiar with the matter cited by Reuters. Microsoft declined to comment.
The second wave, and the American connection
The French attribution does not close the story, because the attacks did not stop in October. At the start of November, a second wave hit supermarkets in Belgium, Sweden, Ireland, Luxembourg and Estonia, with the same signature: refrigeration units remotely switched into defrost mode, temperatures pushed toward 50 degrees Celsius, food spoiled. We covered that wave in detail on 2 November, when no authority had publicly named a suspect and online speculation pointing at Russia or Iran had no evidence behind it. That position has now changed for the French attacks — but not for the November wave. No one has claimed responsibility for the November incidents, and it remains unclear whether they are linked to the attacks in France. The Times reported that a similar attack in the same week affected a small number of British meat suppliers, and Reuters reported that the November wave even reached refrigerators used by French blood banks, forcing staff to move blood to different cold storage units.
There is also an American thread. The sabotage of European supermarket fridges was preceded by at least one similar incident in the United States. In August 2026, refrigerators in at least six military commissaries went out of commission. Pentagon investigators are treating the malfunctions as a suspected cyberattack and are working with French officials. A person familiar with the matter told Reuters that the Pentagon considers Iran a suspect in the August commissary hacks, but that the investigation is still in progress. The Pentagon said on Monday that it was "aware of speculation regarding a potential cyber incident" but could not offer further comment for security reasons. Taken together, the three episodes — the French attacks in October, the wider European wave in November, and the American commissary failures in August — describe a campaign against cold storage that spans months and continents, even if investigators have not yet shown that all three share the same hand.
What happens next
The immediate next steps are diplomatic and legal. France is pushing for sanctions at a European level against the people it says were responsible, and its prosecutors have requested international arrest warrants for the three named men. Whether EU sanctions follow, and how quickly, will depend on whether other member states accept the French attribution — and several European countries were themselves hit by the November wave, which gives them a direct interest in the answer. Iran's response, when it comes, will matter too: Tehran routinely denies carrying out malicious cyber operations, and a denial would leave the dispute exactly where such disputes usually sit, with one government asserting attribution and the other rejecting it.
The security response is already under way in a different sense. US officials warned this week that more attacks could be coming, and the lesson for the industries involved is the same one we drew on 2 November: exposed, unpatched operational technology is a standing invitation. The European Union already has cybersecurity rules covering essential services, and repeated incidents in food retail — a sector that sits close to everyday life — tend to accelerate enforcement. Expect questions about whether temperature-control systems should be treated as critical infrastructure in practice, whether suppliers of that equipment owe customers faster patches for known flaws, and whether the "CyberAveng3rs" style front groups that claimed earlier incidents were cover for a state operation all along. The answers will take months. The attribution, for better or worse, arrived in a day.
What this means for you
For most readers, the practical consequences of the attribution are limited: the food on the shelves was pulled, the affected stores restocked, and the risk was local and specific, not general. But the episode is a useful reminder that the machines around us are computers now, and the same habits that protect a laptop apply to the connected equipment in a home or a small business.
- Change default passwords. If you have a smart fridge, a freezer monitor, a security camera or any other connected appliance, change any default password it shipped with, and use a unique password for each device.
- Keep software updated. Install firmware and software updates for connected devices when they are offered. The French attacks exploited systems that were, in Reuters' reporting, obsolete or running outdated firmware.
- Do not put devices on the open internet unless they need to be there. A controller that can be reached from anywhere can be attacked from anywhere. If remote access is not needed, turn it off.
- Watch for official notices, not rumours. Store counts, affected branches and restocking times shifted during the November wave as retailers confirmed details. Retailers' own notices and national cybersecurity centres are the reliable sources; social media speculation is not.
- If a store's freezer section was affected, do not buy from it until it is restocked. Food that warmed up and was re-chilled can feel cold again while still being unsafe. When in doubt, throw it out.
- For a business, inventory every connected device. The fixes security specialists recommend are unglamorous: list every connected device, remove the ones that do not need internet access, segment operational networks away from ordinary office networks, and patch on a schedule rather than waiting for an incident.
Bottom line
France's announcement changes this story from a mystery into an accusation — and accusations between states carry consequences that a freezer fire does not. The facts France has put on the record are serious: 700 sites attacked, temperatures driven to 50 degrees Celsius, at least 15 fires, tens of millions of euros in losses, three named suspects, and a demand for European sanctions. What is not yet established is just as important: the evidence has been described by French officials but not independently verified, American intelligence has reportedly reached only a low-confidence judgment, Iran has not responded, and the November wave that hit the rest of Europe remains unattributed. The safest way to read Monday's announcement is as a major diplomatic event built on an intelligence assessment, not as the final word on who hacked the freezers. The one conclusion that needs no attribution at all is the lesson the freezers taught in the first place: equipment nobody thinks of as a computer can be attacked like one, and the cost of leaving it exposed is no longer theoretical. It is measured in ruined food, closed freezer aisles, fires — and now, in sanctions and arrest warrants.
Reference sources
- Reuters (via Daily Maverick), "French officials blame Iran for refrigerator hacks, vow retaliation", 9 November 2026: dailymaverick.co.za
- CNN, "France blames Iran for ‘unprecedented’ supermarket fridge cyberattack", 9 November 2026: cnn.com
- The Times, "France accuses Iran over supermarket fridge cyberattacks", 9 November 2026: thetimes.com
- Le Temps, "France blames Iranian regime for supermarket fridge failures across the country", 9 November 2026: letemps.ch
- Gizmodo, "France Blames Iran for Cyberattacks That Sabotaged 700 Grocery Stores", 9 November 2026: gizmodo.com
- Associated Press (via ETV Bharat), "France Blames Iran For The Last Month's Cyberattack On Supermarket Fridges", 9 November 2026: etvbharat.com
- Abloominst 24/7, "Freezers Hacked to 50°C: How the November 2026 Supermarket Cyberattacks Expose the Hidden Risks of Connected Machines", 2 November 2026 (our earlier coverage of the November wave, when no suspect had been named)
Leave a public comment