France blames Iran for hacking 700 fridges, opening criminal probe
Officials say Iranian military hackers disrupted cooling systems at retail sites and hydro plants, prompting international arrest warrants.
By Thabo Hoffmann ·
France formally attributed a series of destructive cyberattacks to Iran on Monday, marking the first official attribution for a wave of incidents targeting physical infrastructure across the West.
The French National Cybersecurity Agency, ANSSI, determined that Iranian military hackers compromised refrigeration controllers at approximately 700 retail locations, including supermarkets and butcher shops. The intruders raised the temperature inside these units overnight, spoiling millions of dollars worth of perishable goods. The same campaign also targeted several small hydroelectric power plants, which ANSSI reported resulted in moderate effects on operations.
French Foreign Minister Jean-Noël Barrot described the campaign as the first large-scale cyberattack aimed at sabotage on French national territory. He stated that the incident constitutes a major attack on the nation's interests and the security of its people. The Paris Prosecutor's Office has opened an investigation into the Iranian cyber unit Shahid Kaveh, which the French government links to the Islamic Revolutionary Guard Corps. The prosecution is requesting the issuance of international arrest warrants.
These attacks fit a pattern of incidents targeting operational technology systems in 2026. Similar hacks hit grocery stores in Sweden and Ireland last week. In France, employees at a major blood bank had to intervene manually to save samples when their cooling system failed. In the United States, food spoiled in commissaries on military bases over the summer, though the Department of Defense has not officially confirmed the cause of those disruptions.
ANSSI identified the attackers through digital infrastructure clues, connections to a propaganda outlet, and traces of the Farsi language within the attack code. Security experts note that the tactics align with the known modus operandi of Shahid Kaveh. Ari Ben Am, an adjunct fellow at the Foundation for the Defense of Democracies, identified the group as responsible for some of Iran's most notable offensive cyber operations. Alex Orleans, head of threat intelligence at Sublime Security, said the attacks represent an attempt to reassert Iranian power through physically disruptive operations while national resources remain tied up in the ongoing war with the United States.
The vulnerability of these systems stems from the nature of operational technology, which controls physical processes like cooling and pumping. These machines are often outdated, difficult to patch without halting critical services, and frequently exposed to the open internet to allow remote vendor maintenance. The French government cited previous attacks by the same unit against Charlie Hebdo and digital kiosks at the 2024 Paris Olympics as precedent for its findings.
Iran has not yet responded to the accusations. During a G7 meeting in Paris, Secretary of State Marco Rubio was asked if the United States shared information with France to aid in the attribution. Rubio declined to comment on the specifics but noted that the French are quite capable. He described the attackers as individuals who attack refrigerators, observing that France is not directly involved in the war between the U.S. and Iran that began in February.
