France blames Iran for cyberattacks on thousands of cold-chain units

By Grace Kim

France said cyberattacks hit thousands of connected industrial refrigeration units. The targets spanned France and wider Europe. The government formally blamed Iran’s Islamic Revolutionary Guard Corps. Two attack waves ran from October into November.

What did France attribute, and who was responsible?

French Foreign Minister Jean-Noël Barrot said in Paris on Monday: “I am able to confirm that responsibility for this act lies with the Islamic Revolutionary Guard Corps.” France also summoned Iran’s ambassador.

Barrot continued:

“This was an attack of unprecedented scale and aggression; it represents the first large-scale act of sabotage on our national territory and constitutes a major assault on the nation’s interests and the security of the French people.”

He warned the attacks would not go without consequences. Reuters first reported the attribution, citing sources ahead of the minister’s Paris remarks. France said it would also issue European-wide sanctions against those who carried out the hacks. Barrot said the matter now rests with the French justice system.

How did hackers reach refrigeration equipment?

Two attack waves occurred from October into November. Hackers used remote access to compromise web-based controllers that manage fleets of industrial cold and chilling units at grocery stores and retail supermarkets across France and broader Europe. They raised temperatures to spoil food and destroy goods.

Medical blood banks were also hacked. The French Blood Establishment said it stopped those attacks before any blood spoiled. Food retail suffered physical losses, while medical blood inventories did not.

The sequence matters for cold-chain operators. Hackers did not merely steal information; their reported action changed refrigeration conditions. The physical loss at grocery sites followed that manipulation directly. Blood banks faced an attempted version of the same operation but reported no spoiled stock.

Which controllers remain exposed?

Security researchers warned that the web-based controllers are vulnerable to remote hacks. Some affected models made by Danish manufacturer Danfoss no longer receive security fixes. The disclosure did not name the affected controller models.

The warning covers the broader controller class. Danfoss supplies some affected models. Danfoss does not represent the full set of exposed equipment. Other operators face the same remote-access risk identified by researchers. The public account gives no count of insecure installations.

The support gap turns a cyber incident into an equipment-lifecycle issue for industrial operators, who must manage remote exposure on internet-accessible refrigeration systems even when their models no longer receive current vendor patches.

What is the wider U.S. response?

The French disclosure follows a string of destructive cyberattacks attributed to Iran this year. Earlier attacks targeted U.S. water providers. Other online intrusions caused major disruption at Stryker, a U.S. medical-device maker, and other organizations.

The U.S. government linked those attacks to pro-Iranian hacktivists working for Tehran, likely in response to the U.S.-Israel-led war against Iran that killed its supreme leader in February.

U.S. authorities are examining reports that freezer units on military bases were hacked. Similar outages and disruption were reported earlier this year. U.S. officials reportedly linked the freezer-related cyberattack to Iran. The intelligence community has not made a formal or public attribution.

A spokesperson for Iran’s consulate in New York did not respond to a request for comment.

What happens next?

France has promised sanctions and referred the case to its justice system. The immediate commercial issue is vendor support for exposed refrigeration controllers. Some affected Danfoss models already lack current security fixes.

France’s planned measures target those responsible for the hacks. Barrot also said the attacks would carry consequences. Those steps run alongside a U.S. review of reports about freezer units on military bases.

The next phase will test whether French legal proceedings and European-wide sanctions produce measurable consequences for the attackers, while operators address remote exposure in models that no longer receive vendor patches.