France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites

The French government has formally accused a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC) of carrying out a sabotage attack on refrigeration controllers at approximately 700 retail sites in October. The attackers compromised systems on the night of October 11, altering defrost settings to dangerously high temperatures, which resulted in significant food losses and at least 15 fires.

The IRGC unit, identified as Shahid Kaveh, is primarily known through hacktivist personas like CyberAveng3rs and Cyber Isnaad Front that publicly claim some of its attacks. In response to this incident, France's Foreign Ministry announced plans to summon Iran's ambassador and request European partners to impose new sanctions on Iranian organizations and individuals involved in the attack.

Investigation and Legal Action

The Paris prosecutor's office opened a judicial investigation yesterday against the head of Shahid Kaveh, the unit's two deputies, and any other identified individuals. Prosecutors have requested international arrest warrants, with offenses including illegal interference with computer systems and causing damage by means dangerous to people, both aggravated by the aim of serving a foreign power.

According to the prosecutor's office, attackers took remote control of Danfoss and Dixell refrigeration controllers through web interfaces, initiating abnormal defrost cycles with no time limits and disabling temperature safety alerts. The attack caused approximately 20 fires and food losses estimated at several tens of millions of euros.

The ministry called the operation the first offensive cyber campaign on French soil carried out purely for sabotage.

Victims and Evidence

Major retailers including Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché were among the primary targets, though smaller establishments like butcher shops, a slaughterhouse, and cooperative food plants were also affected. The cyber crisis coordination center C4 also linked the attack to simultaneous targeting of Schneider Electric equipment at several small hydroelectric installations in France, though effects on that equipment were moderate.

C4, which brings together France's national cybersecurity agency ANSSI, security services DGSE and DGSI, the armament directorate and cyber defense command, identified four indicators pointing to IRGC as the sponsor and Shahid Kaveh as the perpetrator. These included infrastructure overlap with reconnaissance activities against Schneider Electric equipment, use of the FOFA scanning tool, reporting by the unit-linked propaganda outlet CyberbanNews, and traces of Persian language in the attack infrastructure.

Recommended Actions

France's CERT-FR issued an incident alert warning that attack campaigns against remote refrigeration controllers were likely ongoing. The alert specifically identified four product families: Danfoss AK-SM and AK-SC series, Copeland xweb, and Dixell xweb.

For unaffected controllers, CERT-FR recommended removing internet exposure, checking insurance terms, reviewing configuration settings, restoring access through secure VPNs, and following manufacturer best practices including firmware updates and changing default passwords. For compromised devices, the agency advised removing internet exposure, performing factory resets, and reconfiguring before restoring service.

The alert emphasized that end-of-life devices without security updates face very high risks if exposed to the internet, noting that factory resets alone are insufficient as the devices remain vulnerable to recompromise.