France blames Iran for cyber fridge sabotage

The French government formally accused Iranian military hackers of a large-scale cyberattack on October refrigeration systems, marking the first official attribution of this specific wave of disruptions. The French National Cybersecurity Agency, ANSSI, stated that the attackers controlled temperature settings at approximately 700 retail locations, including supermarkets and butcher shops, causing food spoilage worth millions of dollars. The agency also reported that several small hydroelectric power plants were targeted, resulting in moderate operational effects.

French Foreign Minister Jean-Noël Barrot described the campaign as the first large-scale cyberattack aimed at sabotage on French national territory. He characterized it as a major attack on the nation's interests and the security of its people. The Paris Prosecutor's Office has opened an investigation into Shahid Kaveh, a cyber unit linked to Iran's Islamic Revolutionary Guard Corps. The prosecutor's office is requesting the issuance of international arrest warrants for the suspected perpetrators.

ANSSI identified the hackers through digital infrastructure clues, connections to a propaganda outlet, and traces of the Farsi language in the attack code. This attribution places France at the forefront of a global pattern of attacks on refrigeration controllers. Similar incidents have occurred in Europe, Israel, and the United States in 2026. Last week, grocery stores in Sweden and Ireland suffered comparable damage, and a major French blood bank had to save samples from heating up during a similar breach.

In Israel this spring, hackers claiming the alias Cyber Isnaad Front sabotaged an industrial food processing plant. They infected corporate computers with malware, took over office printers to display threatening messages, and used office cameras for a propaganda video. That video included a taunt in French referencing education protests just before the supermarket attacks. Over the summer, U.S. military commissaries experienced food spoilage after overnight temperature spikes, though the Pentagon has not officially confirmed those disruptions were cyberattacks.

Cybersecurity experts note that the tactics fit the known strategy of Iranian cyber units. Alex Orleans of Sublime Security said the attacks represent an attempt by the IRGC to assert power through physically and psychologically disruptive operations. He noted that Shahid Kaveh has previously targeted American water treatment plants, a pattern that continues to refine its tradecraft. Ari Ben Am of the Foundation for the Defense of Democracies described Shahid Kaveh as an offensive unit responsible for many major Iranian cyber operations.

The vulnerability of these systems stems from the difficulty of securing operational technology. These machines are often outdated, difficult to patch without disrupting critical services, and frequently exposed to the open internet due to vendor remote maintenance contracts. Iran has not yet responded to the French accusations. During a G7 meeting in Paris, U.S. Secretary of State Marco Rubio declined to comment on information sharing but stated that the French are quite capable. He expressed surprise that France, which is not directly involved in the U.S. conflict with Iran, was targeted by what he called a strange choice of victim.

The Department of War Office of the Inspector General stated it does not discuss ongoing investigations. Mollie Halpern, a spokesperson for the office, confirmed this policy in an email. The French accusation may prompt other affected nations to pursue their own formal responses as they review their own infrastructure data.