A woman walks past empty refrigerators at an Intermarché supermarket in Névez, western France, on Oct. 12, following a cyberattack affecting the French supermarket chains Intermarché and Cooperative U that caused their refrigerators to defrost.
FRED TANNEAU/AFP via Getty Images
hide caption
toggle caption
i
FRED TANNEAU/AFP via Getty Images
France is accusing Iran of having launched a series of destructive cyberattacks against its critical infrastructure in October.
According to the French National Cybersecurity Agency, ANSSI, Iranian military hackers took over refrigeration controllers at around 700 different retail sites in France, from supermarkets to butcher shops, turning up the temperature in the middle of the night and spoiling millions of dollars’ worth of food.
They also targeted several small hydroelectric power plants, resulting in “moderate effects,” wrote ANSSI in its press release.
The hacking campaign was “unprecedented in both its scale and its level of aggression,” said French Foreign Minister Jean-Noël Barrot. He said it “marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people.”
The Paris Prosecutor’s Office has opened its own investigation into the Iranian cyber unit, Shahid Kaveh, which the French government is linking to Iran’s Islamic Revolutionary Guard Corps. “The Paris Public Prosecutor’s Office is requesting the issuance of international arrest warrants,” the office said in a statement.
A trend of attacks on refrigeration systems
The attacks on French industrial controllers are part of a larger trend. In 2026 alone, hackers have targeted refrigeration controllers from Europe to Israel and the United States.
Grocery stores in European countries including Sweden and Ireland were hit in similar attacks last week.
In a separate incident in France, employees at a major French blood bank had to act fast to save blood samples from heating up when their refrigeration system was hit last week, prompting international calls for the health sector to protect its lifesaving products from spoiling.
In Israel in the spring, suspected Iranian hackers going by the name of “Cyber Isnaad Front” claimed responsibility for sabotaging an industrial food processing plant, including infecting its corporate computers with malware, taking over office printers to print out threatening messages and hacking office cameras for use in a propaganda video released in early October. That video included a taunt in French referencing ongoing education-related protests, and came just before the attacks on French supermarket fridges. Cyber incident response firm Profero attributed the Israel attack to a wing of Iran’s Revolutionary Guard Corps.
Over the summer, commissaries on U.S. military bases also went through something similar, when food spoiled after the temperature shot up inside refrigerators and freezers overnight.
The French government is the first to formally assign blame for the wave of destructive attacks.
They were able to identify the hackers through a series of digital clues, including digital infrastructure used by the hackers, connection to a propaganda outlet, and “traces” of the use of Farsi language in the attack, according to ANSSI.
While NPR and others have reported that U.S. officials suspect Iran may have been behind the attacks on U.S. military bases in August, the Pentagon has not made any official statement, even to conclude that the disruptions were in fact the result of a cyberattack.
“Consistent with our policy and to preserve the integrity of the process, the DOD [Office of Inspector General] Criminal Investigative Service does not discuss ongoing investigations,” Mollie Halpern, a spokesperson for the Department of War Office of the Inspector General wrote in an email to NPR.
Attacks fit Iranian hackers’ modus operandi
If Iranian hackers are behind the attacks across Europe, the U.S. and Israel, cybersecurity experts say that would fit with what they know about Iranian hackers’ strategy and goals.
“Iran’s cyberattacks against refrigeration systems likely represents the IRGC attempting to reassert Iranian power abroad through both physically and psychologically disruptive operations,” Alex Orleans, the head of threat intelligence at cybersecurity firm Sublime Security, told NPR. “Such activities continue to provide tangible and cost-effect results given how Iran’s national resources remain tied down in the war.”
“Also, Shahid Kaveh, the IRGC cyber unit that the French specifically attributed the disruptive attacks to, is repeating a pattern here,” Orleans says. He referenced a series of cyberattacks on American water treatment plants in August, which most experts believe were linked to Iran, as precedent. The U.S. government has still not officially attributed those attacks.
“This unit has once again refined its tradecraft through attacks on Israeli targets before shifting their targeting to the same systems in the West,” Orleans says.
For those tracking Shahid Kaveh and the other Iranian cyber units that operate alongside it, these attacks fit squarely into their modus operandi.
“Shahid Kaveh group is an offensive cyber unit responsible for some of the greatest hits of Iranian offensive cyber [operations],” says Ari Ben Am, an adjunct fellow at the Foundation for the Defense of Democracies’ Center on Cyber and Technology Innovation.
One group tied to Shahid Kaveh is the Cyber Av3ngers, he explains, which the U.S. government linked to cyberattacks on Israeli-made systems in U.S. water treatment facilities in the winter between 2023 and 2024. The French government also cited other cyberattacks carried out on behalf of the IRGC against French interests, including against the satirical French magazine Charlie Hebdo and another against digital kiosks used at the Paris Olympics in 2024.
Challenges in securing operational technology
Cybersecurity experts say the attacks on refrigeration controllers have highlighted a yearslong difficulty with securing operational technology, the machines that control physical processes in the real world — from water pumps to cooling systems.
These machines are often outdated and riddled with vulnerabilities, and are very difficult to patch because operators can’t afford to shut them down and disrupt critical services including healthcare and transportation. Additionally, the machines are often left exposed to the open internet — often at least in part due to contractual requirements with vendors that want to maintain those systems remotely. That combination of factors makes it a complicated problem to solve.
Iran has yet to respond to the accusations. However, Monday’s accusation by the French government may lead other affected countries to take action as well.
During Monday’s G7 meeting in Paris, Secretary of State Marco Rubio was asked by journalists whether the U.S. shared information with the French to help with their attribution of the Iranian hacks. Rubio said he couldn’t comment, but noted that the “French are quite capable.”
“What kind of sickos are these people?” he asked. “They attack refrigerators. France is not even involved in this, really,” referring to the war between the U.S. and Iran, which began in February. “[These Iranians] do terrible things around the world … the news today doesn’t surprise us,” Rubio concluded.
Rebecca Rosman reported from Paris.