Pierluigi Paganini November 09, 2026

France blames Iran for supermarket fridge attacks. What’s known, what remains unclear, and how to secure exposed controllers.

French Foreign Minister Jean-Noël Barrot said Iran’s Revolutionary Guard Corps was behind the attacks on supermarket fridges in France on 11 and 12 October. He said they hit 700 sites and raised refrigerator temperatures. Some stores threw away their entire stock of perishable food, and fires broke out in several.

Foreign Minister Jean-Noël Barrot described the attack as “unprecedented in both its scale and its level of aggression” and called it the first major cyber sabotage operation on French soil. He promised EU-level sanctions, and France summoned the Iranian ambassador. EU foreign policy chief Kaja Kallas said the response should be strong, adding that she had only just learned about France’s attribution.

“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran,” Foreign Minister Jean-Noël Barrot said of the cyberattacks on French supermarkets, which occurred on October 11 and 12, and reported Le Monde.

“This attack is unprecedented in both its scale and its level of aggression,” said Barrot. “It marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people.”

“We will implement sanctions at the European level against all those responsible,” he added.

Paris prosecutors opened a judicial investigation into the head of Shahid Kaveh, an offensive cyber unit tied to the Guards’ Electronic and Cyber Center, and his two deputies. Anyone else they identify can be added to the case.

The attribution cites shared infrastructure, attack tools, Persian-language traces, and amplification by a group-linked propaganda outlet.

France wasn’t alone. On 2 November, supermarkets in at least nine other European countries reported a suspected attack on their freezer systems. Barrot spoke only about the French case, so nothing official yet ties the second wave to Iran.

This is where we need to be careful. When a government names a country as responsible for an attack, that’s a serious accusation. But the reports I’ve read don’t explain the technical evidence behind it. We should treat it as an official claim, not a proven fact, and stick to what we know. Fear and uncertainty can be used to spread distrust, and that risk applies to all sides involved in this story.

The key issue isn’t just identifying the attackers, but understanding whether someone is exploiting these incidents to promote a hybrid warfare narrative. Hacktivist claims may serve propaganda and visibility more than reflect actual responsibility. If French investigations confirm Iran’s role in the October attacks, the pro-Russian groups claiming November’s incidents could face a serious credibility problem. They may have tried to take credit for someone else’s operations. Still, their involvement in some incidents remains possible.

In today’s hybrid warfare, uncertain attribution, strategic ambiguity, and information manipulation make it increasingly difficult to separate real attacks from propaganda.

The method used in supermarket fridge attacks, at least, is documented. On 5 November, CISA, the FBI and other US agencies published a fact sheet on the same kind of activity. The actors may exploit vulnerabilities or weaknesses in unpatched or internet-accessible controllers to remotely alter settings and force units into continuous heating and defrost cycles, which can cause widespread inventory loss and equipment hazards.

The agencies list three ways in: bypassing authentication, injecting code and weak settings. They also warn that operators can lose sight of the real temperatures, which is a bad thing to discover after the cheese has gone.

The fixes are dull and they work. Keep controllers off the internet, and if you need remote access, put an updated firewall in front of it. Separate industrial devices from the office network, change default passwords, add phishing-resistant multifactor authentication, patch firmware and replace devices the maker no longer supports.

Then limit who can change settings with an allowlist of approved devices and IP addresses. Keep tested backups offsite and offline, turn on logging and read the logs. The last control is the cheapest: Define and maintain reasonable setpoint limits for devices operating downstream of controllers to stay within safe ranges and establish alerting for deviations.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Iran)