Paris blames Iran for nationwide fridge hack

French authorities formally attributed a destructive cyberattack on the country's retail sector to Iranian state hackers.

The French National Cybersecurity Agency, ANSSI, reported that Iranian military operators compromised refrigeration controllers at approximately 700 retail locations during October. The sites included supermarkets and butcher shops. Hackers increased the internal temperatures during overnight hours, which spoiled food valued at millions of dollars. The campaign also targeted several small hydroelectric power plants, causing what ANSSI described as moderate effects.

This incident follows a broader pattern of attacks on cooling systems across the globe in 2026. Grocery stores in Sweden and Ireland experienced similar disruptions last week. In a separate event in France, staff at a major blood bank had to manually save blood samples after their refrigeration system was breached. Earlier in the spring, suspected Iranian hackers targeted an industrial food processing plant in Israel. They infected corporate computers with malware and used office printers to display threatening messages. A propaganda video released in early October referenced French education protests and appeared shortly before the French retail attacks.

U.S. military bases faced comparable issues over the summer when overnight temperature spikes spoiled food in commissaries. The Pentagon has not officially confirmed a cyber cause for those disruptions, citing ongoing investigations. Mollie Halpern, a spokesperson for the Department of War Office of the Inspector General, stated that the Criminal Investigative Service does not discuss active cases.

The Paris Prosecutor's Office opened an investigation into the Iranian cyber unit Shahid Kaveh, which the French government links to the Islamic Revolutionary Guard Corps. The prosecutor's office is requesting international arrest warrants. Jean-Noël Barrot, the French Foreign Minister, called the operation a major attack on national interests. He noted that it marks the first large-scale cyberattack aimed at sabotage on French territory.

ANSSI identified the hackers through digital infrastructure, connections to a propaganda outlet, and traces of the Farsi language in the code. Cybersecurity experts said the attacks fit the known strategy of Shahid Kaveh. Alex Orleans, head of threat intelligence at Sublime Security, said the group is attempting to reassert Iranian power through physically disruptive operations. Ari Ben Am, an adjunct fellow at the Foundation for the Defense of Democracies, noted that Shahid Kaveh has a history of targeting French interests, including the Charlie Hebdo magazine and digital kiosks at the 2024 Paris Olympics.

The vulnerability lies in operational technology, which controls physical processes like cooling and water pumping. These machines are often outdated and difficult to patch because operators cannot afford downtime. They are frequently exposed to the open internet to allow for remote vendor maintenance. Iran has not yet responded to the accusations. During the G7 meeting in Paris, Secretary of State Marco Rubio declined to comment on information sharing but said the French are quite capable. He described the attackers as sickos who target refrigerators in a conflict where France is not directly involved.

The U.S. government suspects Iran may be behind the attacks on American military bases, but officials have not made a formal statement. The French government is the first to officially assign blame for the wave of destructive attacks on cooling systems.