France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites Swati KhandelwalNov 10, 2026Cyber Attack / Industrial Sabotage An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday. The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures. That caused food losses and, in at least 15 cases, fires. The unit is called Shahid Kaveh. It is known mainly through hacktivist personas, such as CyberAveng3rs and Cyber Isnaad Front, that publicly claim some of its attacks, France says. France's Foreign Ministry plans to summon Iran's ambassador and to ask its European partners to adopt new sanctions against Iranian organizations and individuals involved in the attack. The Paris prosecutor's office opened a judicial investigation yesterday against the unit's head, the head's two deputies and anyone else identified. It has asked for international arrest warrants. The offenses under investigation include illegally interfering with computer systems and causing damage by means dangerous to people, both made more serious by the aim of serving a foreign power, Iran. In the October attack, the attackers took remote control of Danfoss and Dixell refrigeration controllers through web interfaces, the prosecutor's office said in a press release. They started abnormal defrost cycles with no time limit and switched off the temperature probes' safety alerts, which should go off above a certain temperature. The attack caused about 20 fires. Most of the organizations hit were large retailers, according to a joint report by France's cyber crisis coordination center, known as C4. They include Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. Small butcher shops, a slaughterhouse and cooperative food plants were also among the victims. The center also tied the attack to the simultaneous targeting of Schneider Electric equipment at several small hydroelectric installations in France. The effects on that equipment were moderate. In its attribution statement, the ministry estimated the food losses at several tens of millions of euros and called the operation the first offensive cyber campaign on French soil carried out purely for sabotage. The C4 brings together France's national cybersecurity agency (ANSSI), the DGSE and DGSI security services, the armament directorate and the cyber defense command. It says four indicators point to the IRGC as the sponsor of the attack and to Shahid Kaveh as the unit that carried it out. The infrastructure used in the attack was also used during the same period for reconnaissance of Schneider Electric equipment. That equipment is installed at sites such as small- and medium-sized energy and water production sites. The reconnaissance relied on techniques that Shahid Kaveh has used since at least April. The attackers also used FOFA, a scanning tool they usually use. CyberbanNews, a propaganda outlet linked to the unit, reported on the attack as early as October 13. The attack infrastructure also held traces of Persian. Prosecutors said the criminal investigation, run by France's anti-cybercrime office (OFAC) and the DGSI, found an attack method typical of the unit. It also found the use of Persian and IP addresses leading to devices located in Iran. Shahid Kaveh has previously claimed attacks on industrial equipment, according to C4. Through CyberAveng3rs, it claimed an earlier campaign against Unitronics, an Israeli company that makes industrial control systems, in November 2023. In March and April, it claimed a large sabotage campaign against Israeli and U.S. interests that hit industrial control equipment, including Israeli refrigeration equipment. France's attribution does not mention the new wave of refrigeration attacks that struck supermarkets in several other European countries last week. France's CERT-FR said in an incident alert that it was aware of numerous compromises affecting remote refrigeration controllers across four product families. They are the Danfoss AK-SM and AK-SC series, the Copeland xweb, and the Dixell xweb. The alert, last updated on October 16, warned that attack campaigns against this equipment were probably still underway, and that exposing a management interface to the internet goes against good practice. For controllers that are not compromised, the alert's steps are: Remove internet exposure from these units and from any unit reachable at a public IP address. Check insurance contract terms before cutting off the data feed to the refrigeration contractor. Review the full configuration, especially the defrost ranges. Restore access only through a secure VPN or a protected network. In an emergency, filtering the contractors' IP addresses at a firewall is possible, but it is not a lasting fix. Follow the maker's recommended practices. For Danfoss devices, this includes updating firmware, setting the security level to Strict, and ensuring default passwords have been changed. For compromised controllers, the steps are: Remove internet exposure and check insurance terms, as above. Restart Danfoss equipment, or otherwise restore the device to its factory settings. Restore access only through a secure VPN or a protected network. As above, firewall filtering of contractors' IP addresses is an emergency option, not a lasting fix. Reconfigure the device before putting it back into service, then follow the maker's recommended practices. An end-of-life (EOL) device that receives no security fixes faces a very high risk of compromise if it remains exposed to the internet, the alert warns. In that case, a factory reset alone is not enough: it removes the attackers' persistence, but the device stays vulnerable and will almost certainly be compromised again. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Cyber Attack, cyber espionage, Industrial Control Systems, Nation-State 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub The Flood is Coming And The Pipes Were Already Full The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk