France blames Iran for fridge hacks

French authorities announced on Monday that Iranian military hackers executed a destructive cyber campaign against French critical infrastructure in October. The operation targeted industrial refrigeration controllers at approximately 700 retail locations, including supermarkets and butcher shops. Attackers remotely increased the internal temperature of these units during the night, resulting in the spoilage of food valued at millions of dollars.

The French National Cybersecurity Agency, ANSSI, also reported that the intrusion affected several small hydroelectric power plants. The agency described the impact on these facilities as moderate. Foreign Minister Jean-Noël Barrot stated that this marks the first large-scale cyberattack aimed at sabotage on French national territory. He characterized the incident as a major threat to national interests and public security.

The Paris Prosecutor's Office has opened a formal investigation into the Shahid Kaveh cyber unit, which the government links to Iran's Islamic Revolutionary Guard Corps. Prosecutors are seeking international arrest warrants for the individuals involved. ANSSI identified the perpetrators through digital infrastructure traces, connections to a propaganda outlet, and the use of the Farsi language within the attack code.

This incident is part of a wider pattern of attacks on operational technology across the Atlantic. Similar disruptions occurred at grocery stores in Sweden and Ireland last week. In France, a major blood bank recently had to manually save samples after its refrigeration system was compromised. Over the summer, food spoiled in commissaries on U.S. military bases due to overnight temperature spikes, though the Pentagon has not officially confirmed a cyberattack for those events.

Cybersecurity experts note that the Shahid Kaveh unit has a history of targeting physical infrastructure. Alex Orleans of Sublime Security said the attacks on refrigeration systems allow Iran to project power through physically disruptive operations while its national resources remain engaged in the war. He noted that the unit previously targeted American water treatment plants in August. Ari Ben Am of the Foundation for the Defense of Democracies described Shahid Kaveh as an offensive unit responsible for high-profile Iranian cyber operations.

The vulnerability of these systems stems from the nature of operational technology. These machines often run on outdated software and are difficult to patch because shutting them down would disrupt essential services. They are frequently exposed to the open internet to allow for remote vendor maintenance. Secretary of State Marco Rubio, speaking at the G7 meeting in Paris, declined to confirm whether the U.S. shared intelligence with France to aid in the attribution process.

Iran has not yet responded to the French accusations. The formal attribution by Paris may prompt other affected nations to take similar actions. The U.S. Department of Defense continues to investigate the summer incidents at military bases but has not released findings to preserve the integrity of the process.