Ethical Hacking News
France has accused Iran of carrying out a sophisticated cyberattack on the country's refrigeration controllers, which has left about 700 retail sites affected. The attack, which occurred on October 11, involved the Iranian Islamic Revolutionary Guard Corps (IRGC) unit known as Shahid Kaveh, and is believed to have been carried out by a cyber unit of the IRGC. The attackers used remote control to gain access to the controllers and changed their defrost settings to high temperatures, causing food losses and at least 15 fires.
France has accused Iran of carrying out a sophisticated cyberattack on refrigeration controllers, affecting about 700 retail sites. The attack, carried out by the Iranian Islamic Revolutionary Guard Corps (IRGC), used remote control to gain access to the controllers and caused food losses and fires. The attack was carried out in several waves, targeting Danfoss and Dixell refrigeration controllers through web interfaces, and switching off safety alerts. The French government has called for sanctions against Iranian organizations and individuals involved in the attack and has opened a judicial investigation. The attack has highlighted the growing threat of cyberattacks on industrial control systems and the need for greater security measures and cooperation between governments and industries.
France has formally accused Iran of carrying out a sophisticated cyberattack on the country's refrigeration controllers, which has left about 700 retail sites affected. The attack, which occurred on October 11, involved the Iranian Islamic Revolutionary Guard Corps (IRGC) unit known as Shahid Kaveh, and is believed to have been carried out by a cyber unit of the IRGC. The attackers used remote control to gain access to the controllers and changed their defrost settings to high temperatures, causing food losses and at least 15 fires.
The attack was carried out in several waves, with the attackers targeting Danfoss and Dixell refrigeration controllers through web interfaces. The attackers also switched off the temperature probes' safety alerts, which should have gone off above a certain temperature. The attack caused about 20 fires, with most of the affected sites being large retailers such as Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché.
The French government has called for Iran's ambassador to be summoned and has asked its European partners to adopt new sanctions against Iranian organizations and individuals involved in the attack. The Paris prosecutor's office has opened a judicial investigation against the unit's head, the head's two deputies, and anyone else identified. The offenses under investigation include illegally interfering with computer systems and causing damage by means dangerous to people, both made more serious by the aim of serving a foreign power, Iran.
The attack was carried out using a technique known as FOFA, a scanning tool that is usually used by Shahid Kaveh. The attackers also used IP addresses leading to devices located in Iran. The unit has previously claimed attacks on industrial equipment, including an earlier campaign against Unitronics, an Israeli company that makes industrial control systems.
France's CERT-FR has issued an incident alert warning that attack campaigns against remote refrigeration controllers are probably still underway. The alert advises operators to remove internet exposure from these units and from any unit reachable at a public IP address, and to check insurance contract terms before cutting off the data feed to the refrigeration contractor.
The incident has highlighted the growing threat of cyberattacks on industrial control systems and the need for greater security measures to protect these systems. The attack has also raised concerns about the potential for nation-state actors to carry out such attacks, and the need for greater cooperation between governments and industries to prevent such attacks.
In a statement, France's Foreign Ministry estimated the food losses at several tens of millions of euros and called the operation the first offensive cyber campaign on French soil carried out purely for sabotage. The incident has also raised concerns about the potential for similar attacks to be carried out against other countries.
In recent years, there have been several high-profile cyberattacks on industrial control systems, including attacks on Saudi Aramco and Ukraine's power grid. These attacks have highlighted the growing threat of cyberattacks on critical infrastructure and the need for greater security measures to protect these systems.
The incident has also highlighted the need for greater cooperation between governments and industries to prevent such attacks. The French government has called for greater cooperation with its European partners to adopt new sanctions against Iranian organizations and individuals involved in the attack.
In conclusion, the cyberattack on French retail sector has highlighted the growing threat of cyberattacks on industrial control systems and the need for greater security measures to protect these systems. The attack has also raised concerns about the potential for nation-state actors to carry out such attacks, and the need for greater cooperation between governments and industries to prevent such attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/France-Blames-Iran-for-Cyberattack-on-French-Retail-Sector-ehn.shtml
https://thehackernews.com/2026/11/france-blames-iran-for-sabotage-attack.html
https://www.cnbc.com/2026/11/10/iran-fridge-cyberattacks-france.html
Published: Tue Nov 10 05:32:01 2026 by llama3.2 3B Q4_K_M
