France has formally blamed Iran for the cyberattack that heated up refrigerators and freezers in around 700 French supermarkets and food businesses last month. Its foreign minister, Jean-Noël Barrot, said on Monday in Paris (overnight Australian time) that a cyber unit of Iran’s Islamic Revolutionary Guard Corps (IRGC) was responsible, summoned Iran’s ambassador and promised European sanctions.
The attribution matters well beyond France. The equipment involved, remote controllers that set the temperature of commercial fridges and cold rooms, is used around the world, and Australia’s cyber agency has already told local operators to check whether theirs are exposed. Here is what France has said, what evidence it has published, what is still unknown, and what Australian businesses that rely on refrigeration should do.
What France announced
In an official statement dated 9 November, the French foreign ministry said that on the night of 11 to 12 October attackers targeted supermarket refrigeration controllers at more than 700 retail sites in France. It said the attacks caused considerable material damage, fires and food losses estimated at several tens of millions of euros, and described the campaign as the first cyber-offensive carried out on French soil purely for sabotage.
The ministry attributed the attacks to Shahid Kaveh, an offensive cyber unit it says is affiliated with the IRGC’s Electronic and Cyber Center. Speaking to reporters on the sidelines of a G7 meeting, Barrot said, as reported by the ABC: “This attack is unprecedented in both its scale and its level of aggression.” He added: “We will implement sanctions at the European level against all those responsible for this attack.”
At the same time, Paris prosecutor Laure Beccuau said a judicial investigation had been opened against the head of Shahid Kaveh and his two deputies. The Record reports that international arrest warrants have been requested.
The evidence France has published
Unusually, France released a five-page public report from its Cyber Crisis Coordination Centre (C4), which brings together the national cyber agency ANSSI, military cyber command and the DGSE and DGSI intelligence services. According to that report:
- The attackers changed the controllers’ defrost settings to high temperatures, causing large stock losses and, in at least 15 cases, fires.
- Victims were mainly large grocery groups, including Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, but also small butchers, an abattoir and cooperative food factories.
- At the same time, the same attack infrastructure was used against Schneider Electric equipment at several small French hydroelectric sites, with what the report calls moderate effects.
The report lists four pieces of evidence for its attribution: the attack infrastructure was also used for reconnaissance on Schneider Electric industrial equipment using techniques it says Shahid Kaveh has used since at least April 2026; the operators used the FOFA internet-scanning tool, which it says is typical of this group; the attack was promoted from 13 October on CyberbanNews, a channel it links to the unit; and traces of Farsi were found in the attack infrastructure. An annex names the head of the IRGC’s cyber centre and two commanders of the unit.
The report says Shahid Kaveh is the group behind hacktivist personas including CyberAv3ngers, which claimed attacks on Israeli-made Unitronics industrial controllers in 2023, including at US water utilities. The Record notes US agencies have also linked Shahid Kaveh to CyberAv3ngers.
Our read: this is more detail than governments usually publish when naming another state. But the indicators are circumstantial, and attribution is hard to verify from outside. As the BBC notes, hackers can hide where they are. Iran had not responded officially by Monday evening, Paris time, though the BBC reports some Iranian media dismissed the claims as baseless.
What France has not said
The attribution covers the French attack of 11 to 12 October only. It does not cover the second wave on 2 November, when retailers in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden reported fridge and freezer temperatures rising as high as 50°C. Affected businesses included Delhaize, Carrefour Belgium, Ikea’s Mons store, ICA and Coop in Sweden, and 13 SuperValu stores in Ireland. Later reports put the number of countries hit at 11 or more, and The Record says three sites of France’s national blood service were also affected.
Neither Barrot nor prosecutors said whether that second wave was linked, according to the ABC. The BBC reports that two Russian-aligned hacktivist groups claimed responsibility for some attacks, but few experts believed them. So the second wave still has no official attribution.
How the fridges were reached
This was not an exotic hack. France’s computer emergency response team, CERT-FR, issued an alert naming the affected controllers: Danfoss AK-SM and AK-SC series systems, and Copeland and Dixell xweb units. It said that exposing a management interface directly to the internet goes against good practice.
Danfoss told the trade publication Cooling Post that most affected units were legacy products or current products running outdated firmware. It named the AK-SM800, declared end-of-life in 2021, and the AK-SC355, phased out in 2016. Neither receives security updates. The current AK-SM800A units that were hit were running out-of-date firmware. A Danfoss security advisory from August 2025 already told AK-SM 8xxA customers to install version 4.3.1 to fix serious flaws.
Weak access controls made things worse. The Sydney Morning Herald reports ANSSI’s chief told the French Senate the controllers sat on the open internet without a firewall, protected only by weak passwords. It also reports a Danfoss spokesperson said Dutch systems hit in the second wave still had factory passwords.
Where AI comes in, and where it doesn’t
Security firm Claroty, whose researchers found the Danfoss flaws, tested how quickly an AI coding tool could rebuild a working attack. In a 13 October write-up, it said an AI coding agent reproduced the three known vulnerabilities and chained two of them to gain full control of a lab device in about 28 minutes, for roughly US$6 in AI usage.
Claroty’s own caveats matter. The model started from public vulnerability details and freely downloadable firmware, it initially got the authentication bypass wrong, and a researcher had to redirect it. Claroty says the precise method used in the French attacks is unconfirmed. There is no public evidence that AI was used in the real attacks. The point is narrower: once a flaw is public, turning it into a working exploit is getting cheaper and faster, so unpatched, internet-facing equipment is a bigger risk than before. We covered the same trend in Google’s warning about agentic AI attacks.
What it means in Australia
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) published a high-rated alert on 14 October about the risks to operational technology, including refrigeration and cooling systems. It said it was aware of incidents affecting commercial refrigeration overseas but had not seen active targeting in Australia. A “high” rating means organisations should act within 48 hours.
No attacks have been reported here. The Sydney Morning Herald reports Woolworths and Aldi are understood not to connect store refrigeration controllers to outside networks; Coles did not respond to the paper’s questions. The same kind of controllers run cold rooms in pharmacies, hospitals, restaurants, butchers and warehouses, which are often looked after by an outside refrigeration contractor rather than an IT team.
Based on the ACSC, CERT-FR and Danfoss advice, practical steps are:
- Ask your refrigeration contractor which controllers you have, whether any can be reached from the internet, and how they log in remotely.
- Take them off the open internet. Remote access should go through a secure VPN or protected network, not a public IP address. CERT-FR suggests checking insurance and service contracts before cutting off data feeds to the contractor.
- Update firmware and change default passwords. For Danfoss AK-SM800A units, Danfoss recommends the latest firmware and its “Strict” security mode. Older AK-SM800 and AK-SC355 systems no longer get updates and should be replaced.
- Check settings and alarms. Review defrost schedules and temperature set points, and make sure independent temperature alarms reach someone overnight.
- Report anything suspicious to ASD on 1300 CYBER1 (1300 292 371) or at cyber.gov.au.
The same lesson applies to other internet-facing systems. This week attackers have also been probing servers affected by the “SSHole” OpenSSH flaw.
What happens next
France now has to persuade other EU members to agree sanctions, which require unanimity. Barrot also said France would take any other necessary and proportionate measures, public or not. Other countries hit in November have not yet said who they think was responsible. We will update this story if Iran responds formally, if the EU acts, or if any attacks are confirmed in Australia.
Featured image: frozen food aisle in a supermarket (illustrative; not a store involved in the attacks). Photo: Raysonho @ Open Grid Scheduler / Grid Engine via Wikimedia Commons, CC0 1.0 public domain dedication; cropped, resized and converted to PNG.
