France Blames Iran for Supermarket Fridge Cyberattack

France has formally blamed an Iranian-linked cyber unit for the October attack that manipulated refrigeration controls at about 700 retail sites. The attribution, announced on 9 November, turns a disruptive supermarket incident into a state-level cyber dispute. French officials say the attack spoiled goods and was linked to at least 15 outbreaks of fire. Iran’s responsibility is the French government’s conclusion, not a finding independently established by TechBooky.

The new account comes from France’s national cybersecurity agency, ANSSI, and its Cyber Crisis Coordination Centre, known as C4. Investigators attribute the destructive operation to Shahid Kaveh, which they identify as affiliated with the cyber arm of Iran’s Islamic Revolutionary Guard Corps. France’s foreign ministry says it will summon the Iranian ambassador and seek European sanctions against those involved.

On the night of 11 to 12 October, attackers compromised refrigeration controllers and changed defrost settings to high temperatures, according to ANSSI. When a supermarket’s cold chain breaks, restoring normal settings is not enough. Food that has warmed beyond safe limits may have to be discarded, and affected equipment must be checked before trading resumes. TechBooky’s first report on the French fridge hack described those immediate operational and food-safety costs, at a point when the attacker had not been identified.

The French assessment goes beyond supermarkets. C4 says it is aware of other victims in food production and retail, including small butchers, an abattoir and co-operative food plants. It also links simultaneous targeting of some Schneider Electric equipment at small hydroelectric installations to the same operation, while describing the effect on those installations as moderate. These findings show why the incident is being treated as physical sabotage rather than an ordinary website outage.

C4 cites a combination of infrastructure characteristics, tools associated with the group, Persian-language traces and coverage of the operation by a propaganda outlet linked to Shahid Kaveh. Public attribution brings together several indicators; it should not be mistaken for proof that every later refrigeration failure in Europe had the same perpetrator. TechBooky has reported on separate fridge disruptions across European countries, where investigators had not established a single common attacker or technical cause.

Naming a state-linked group changes the response. France says it can pursue diplomatic and economic measures as well as technical containment. Prosecutors in Paris have opened a judicial investigation and sought international arrest warrants for several members of the group, according to ANSSI. The foreign ministry says it is considering further proportionate steps with European and international partners. That is a stronger public position than the early warnings to retailers to secure exposed controllers.

For businesses, the practical risk is that connected operational equipment can turn a remote intrusion into spoiled inventory, damaged premises and lost sales. Refrigeration systems are often managed by external service providers, so retailers need visibility into who can change settings, how access is authenticated and whether alarms can still reach staff if a controller is misused. A separate TechBooky report on Ahold Delhaize’s cyber-related sales warning illustrates the wider financial exposure, though that company’s incident should not be presented as proven part of the same attack.

The key new development is not simply that supermarket fridges were hacked. France now says it knows who carried out the October sabotage and is preparing a diplomatic response. The case is a reminder that cyberattacks on seemingly mundane equipment can carry consequences well beyond the IT department.