France has accused Iran’s Islamic Revolutionary Guard Corps of orchestrating a cyberattack that disrupted supermarket refrigeration systems, spoiled food across hundreds of stores and prompted prosecutors to seek international arrest warrants for three alleged Iranian operatives. Foreign Minister Jean-Noël Barrot described the October 11 and 12 incident as France’s first large-scale cyber-sabotage attack against national interests, while warning that Paris would pursue European sanctions.
The attack took control of software used to remotely manage supermarket cold-storage equipment. More than 100 Coopérative U stores and about 180 Intermarché and Netto locations were affected, with Carrefour, Monoprix and E.Leclerc also among the reported victims. In some cases, refrigeration temperatures reportedly climbed as high as 50C, destroying chilled and frozen inventory. The software was supplied by Danish engineering company Danfoss, according to the BBC’s reporting. [1]
Paris prosecutor Laure Beccuau opened a judicial investigation into the head of Shahid Kaveh, described by French authorities as an offensive cyber unit affiliated with the IRGC’s electronic and cyber center, along with two deputies and any other participants identified during the inquiry. The prosecutor’s office has requested international arrest warrants, although the reports do not indicate that any suspect has been detained. France also summoned Iran’s ambassador. Iran has not officially accepted responsibility and Iranian media have rejected the accusation, while French officials have not publicly detailed all of the intelligence behind their attribution.
The incident’s operational impact was serious, but publicly available reporting does not identify a specific software flaw or CVE. Neither the affected Danfoss product nor a vulnerable version has been named, and there is no verified public proof of concept, exploitation-in-the-wild report or vendor patch associated with this incident. A search of the National Vulnerability Database therefore does not establish a vulnerability-specific remediation path; organizations should not infer that updating an unrelated Danfoss component will address the attack.
For retailers, the episode highlights the risk created when operational technology controlling refrigeration is reachable through remote-management infrastructure. Operators should identify every internet-facing control interface, restrict remote access through strong authentication and tightly scoped network paths, review administrative logs around October 11 and 12, and confirm that temperature alarms can trigger an independent, local response. They should also ask Danfoss and their integrators for product-specific incident guidance, preserve forensic evidence before resetting affected systems, and maintain manual or fail-safe procedures for keeping food within required temperatures.
France’s attribution remains a government claim rather than a finding tested in open court, and the public accounts do not link the French attack conclusively to subsequent incidents reported at supermarkets elsewhere in Europe. The arrest-warrant request nevertheless marks an escalation: Paris is treating manipulation of commercial refrigeration as a national-security attack, even though the technical vulnerability and intrusion chain remain undisclosed.
