France blames Iran for mass-hacks targeting freezers in grocery stores

The French government has formally blamed Iran for orchestrating widespread cyberattacks that compromised thousands of internet-connected industrial chilling and freezer systems across France and wider Europe, according to details shared in TechCrunch's report. French foreign minister Jean-Noël Barrot confirmed on Monday that the Islamic Revolutionary Guard Corps carried out the sabotage, marking what officials described as the first large-scale physical sabotage operation against critical civilian cooling infrastructure on French territory.

This report details the technical targets, affected retail and healthcare facilities, diplomatic fallout, and ongoing transatlantic security investigations surrounding the intrusion campaigns. The analysis is structured for enterprise security teams, critical infrastructure operators, and supply chain managers monitoring industrial control hardware vulnerabilities, legacy equipment risks, and state-sponsored disruption across civilian networks.

01Formal attribution to the Revolutionary Guard

Addressing reporters in Paris on Monday, French foreign minister Jean-Noël Barrot identified the Islamic Revolutionary Guard Corps as the entity responsible for the disruption. The minister stated that responsibility for the operation lies with Iran's military and state-aligned hackers, characterizing the wave of intrusions as an unprecedented assault on the nation's security and domestic interests.

Barrot described the campaign as the first large-scale act of sabotage on national territory, emphasizing that the cross-border digital assault would not go without consequences. The French government moved quickly to summon Iran's ambassador to Paris in response to the findings, while Iranian consular representatives in New York did not issue an immediate comment.

Advance reporting from Reuters initially revealed the state attribution prior to the foreign minister's public remarks in Paris. Following the formal announcement, Barrot confirmed that the investigation and subsequent legal proceedings have been handed directly to the French justice system for formal legal review and enforcement.

02Danfoss controllers and manipulated storage temperatures

The physical disruption centered on web-based controller units designed to automate and manage large fleets of commercial refrigeration equipment. Security researchers warned that these internet-accessible devices remain vulnerable to external takeover, particularly models manufactured by Danish engineering firm Danfoss that no longer receive official security patches or firmware fixes.

Attackers leveraged these internet-connected management interfaces during two coordinated intrusion waves that unfolded across October and into November. Once inside the remote interfaces, the operators altered standard environmental settings and deliberately raised internal cooling temperatures across commercial food storage facilities to spoil goods.

The unauthorized configuration overrides eliminated the safe thermal preservation required for commercial and perishable inventories across Europe. By disabling active chilling cycles through network commands, the intruders converted networked temperature management systems into physical tools capable of destroying stored goods without requiring physical on-site access to the machinery.

03Retail supermarket spoilage and blood supplies

The economic damage of the cooling resets hit retail supermarkets and local grocery store chains directly across France and wider European regions. Perishable inventories spoiled inside disabled holding vaults, forcing store operators to dispose of compromised foodstuffs and absorb widespread commercial merchandise losses across multiple retail locations.

Beyond the commercial grocery sector, the intrusion campaign also penetrated storage facilities at regional medical blood banks. The French Blood Establishment confirmed that the malicious configuration changes were detected and halted before critical medical blood reserves suffered temperature degradation, preventing loss of vital transfusable materials.

The targeting of vital healthcare refrigeration demonstrated a deliberate expansion of digital operations beyond retail grocers into national medical logistics. Rapid defensive intervention by the French Blood Establishment prevented catastrophic contamination, preserving life-saving reserves while administrative personnel isolated vulnerable network controllers from public exposure.

04Coordinated intrusions against water and healthcare

The cooling sabotage represents the latest incident in a broader surge of destructive cyber operations linked to Tehran throughout the current calendar year. Earlier digital campaigns compromised utility systems across United States municipal water providers, showing a sustained operational pattern of targeting physical operational hardware rather than strictly accessing sensitive administrative data.

Similar intrusions also generated widespread operational chaos for American medical technology company Stryker alongside several other commercial organizations. United States intelligence assessments linked those disruptive incidents to pro-Iranian hacktivists coordinating closely with state authorities in Tehran to inflict maximum institutional disruption across essential civilian supply chains.

Federal analysts believe the retaliatory offensive stems from geopolitical hostilities surrounding the United States and Israel led war against Iran, which resulted in the death of the country's supreme leader in February. The resulting campaigns have consistently targeted critical civilian, utility, and healthcare functions across Western allies to maximize domestic friction.

05European sanctions and military freezer investigations

In the wake of foreign minister Barrot's public attribution, the French government announced plans to implement comprehensive European-wide sanctions against the individuals and entities responsible. Diplomats in Paris are coordinating with allied continental governments to penalize the threat groups behind the critical infrastructure strikes across multiple member states.

Across the Atlantic, United States defense authorities are actively investigating whether industrial refrigeration and freezer equipment stationed on military bases suffered comparable intrusions. The ongoing defense inquiry follows previously reported equipment outages and physical disruptions documented across various military installations earlier in the year.

While American investigators have unofficially connected the domestic military base freezer failures to Iranian operators, intelligence agencies have not released a formal public attribution. International security officials continue auditing operational technologies as both Europe and the United States respond to state-sponsored infrastructure sabotage across commercial and defense assets.