France blames Iran-linked hackers for cold-storage cyberattacks

France says Iran-linked hackers targeted 700 commercial sites, including at least 15 where fires broke out after attacks on industrial refrigeration equipment. The affected systems serve supermarkets and food plants, making the case a retail continuity problem as well as a cyber incident. The reported consequences included unusable inventory and physical fires.

Paris has summoned Iran’s ambassador and threatened additional European Union sanctions, Reuters reported. The dispute concerns industrial refrigeration equipment, not consumer fridges. That distinction sets the scale: a compromised cold room or freezer can interrupt supermarket and food-plant operations, spoil inventory and, in the reported cases, contribute to fires.

Cold storage became the target.

At least 15 affected sites experienced fires. Employees at stores discarded spoiled meat and melted ice cream. One supermarket owner estimated that damage across France could reach tens of millions of euros. The owner’s estimate is not presented as a final government loss figure. It nevertheless converts a cyberattack into a food-loss problem with a potentially material national cost.

Security experts linked the attacks’ success mainly to vulnerabilities in the refrigeration equipment. Some devices were outdated, and others ran older software. Proofpoint threat researcher Saher Namaan said the episode shows “how vulnerable these systems are.” This places the reported weakness in the equipment layer, rather than in a disclosed flaw across retailers’ wider IT networks.

French intelligence attributed responsibility to Shahid Kaveh, a division linked to the Islamic Revolutionary Guard Corps. Paris prosecutors requested international arrest warrants for people suspected of taking part. The legal steps add a second track to the investigation: naming a responsible unit and seeking international custody for suspected participants.

France’s response combines a diplomatic summons with the threat of new EU sanctions. The source names no measures or dates for those sanctions, so their scale remains undefined. Iran’s mission to the United Nations did not answer Reuters’ request for comment. Tehran has previously denied, repeatedly, responsibility for malicious cyber operations.

What changed in November?

In November, a new wave of attacks affected more than 100 facilities in Europe, as well as refrigerators at French blood banks. Employees moved some blood-bank stock into other cold chambers. The wave broadened the reported target set from commercial refrigeration to health-service storage and extended the geography beyond France. The report gives no year for November and no list of affected countries or institutions.

At stores, employees discarded spoiled meat and melted ice cream; blood-bank staff relocated part of the inventory. The report does not quantify the amount moved, the length of any outage or product losses at blood banks. It also provides no breakdown between the 700 French commercial targets and the 100-plus European facilities affected in November.

How did the attackers gain leverage?

The report supports a four-part sequence of impact:

• Attackers targeted industrial refrigeration equipment operating in supermarkets and food plants.
• Outdated devices and older software created the equipment vulnerabilities that experts identified as the main reason for success.
• The effects included at least 15 fires, spoiled meat, melted ice cream and the relocation of blood-bank stock.
• France named Shahid Kaveh as responsible and requested international arrest warrants.

The source does not describe the initial access method, affected brands or models, or the number of devices compromised. That leaves the technical chain incomplete and prevents a defensible comparison of the 700 commercial sites with the 100-plus European facilities. It also limits any calculation of average damage per site or the share of cold-chain operators exposed.

What does the case mean for retail operations?

For retailers, the immediate mechanism is visible in the stock losses. Once refrigeration equipment fails, temperature-sensitive inventory can become unsellable, as the discarded meat and melted ice cream show. In this case, the reported consequences included fires and reached blood-bank storage. Equipment age and software support therefore sit inside operational resilience, not only inside a purchasing checklist.

The next test for authorities is evidentiary: identify suspects, execute any requested international arrest warrants and specify the EU sanctions under consideration. For operators, the unanswered question is whether outdated refrigeration equipment and old software can be identified before attackers exploit the same weakness. The cited incidents provide neither an inventory of exposed devices nor a complete remediation record.