French Officials Suspect Iran Behind October Fridge Cyberattack

Reuters, citing sources familiar with the investigation, reported on Monday that French officials believe Tehran was responsible for the October supermarket refrigeration cyberattack in France. A full public French attribution has not been issued, and the wire’s detailed report was not yet freely available at publication time.

The overnight attack, disclosed on Oct. 12, raised temperatures in connected cold units—some to about 50°C (122°F)—spoiling food and sparking fires at hundreds of stores, Reuters reported at the time. The Paris prosecutor’s office opened a cybercrime inquiry into what it called a “large-scale” strike on connected refrigerators at major food retailers.

Prime Minister Sébastien Lecornu ordered France’s National Cybersecurity Agency (ANSSI) to investigate, a person in his office told Reuters in October. Finance Minister Roland Lescure later told parliament that roughly 700 of about 10,000 French supermarkets were affected, though retailer tallies varied by chain.

How the Attack Worked

Hackers remotely overrode temperature and defrost settings on internet-exposed refrigeration controllers. CERT-FR alert CERTFR-2026-ALE-012 named Danfoss AK-SM and AK-SC series units, along with Copeland and Dixell XWEB systems. ANSSI Director General Vincent Strubel later said attackers exploited “elementary” security failures, including devices left open to the internet and weak passwords.

Danish manufacturer Danfoss said a limited number of refrigeration management systems in France were affected and that those units ran outdated firmware. Chains named in contemporary reporting included Intermarché, Coopérative U, Carrefour, Monoprix and E.Leclerc. Intermarché’s owner, Les Mousquetaires, said fridges at about 150 stores ran at 50°C for six hours.

No group claimed the French strike at the time, and no ransom demand was reported—a silence that puzzled investigators, a source told Reuters in mid-October.

Wider Wave, Unsettled Blame

Clash Report has tracked the follow-on supermarket freezer failures across Europe and the later breach that raised temperatures at French blood-storage sites. Pro-Russian hacktivists later claimed parts of the European wave; cybersecurity researchers including Sekoia have treated those claims with caution, and the Kremlin has denied involvement.

Separately, U.S. investigators have reportedly examined Iran-linked actors over August freezer malfunctions at American military commissaries—an assessment first reported by Nextgov and echoed by former officials speaking to NPR. That U.S. track is distinct from Monday’s Reuters sourcing on French officials and does not by itself confirm a single attributed campaign.

Iran has not publicly responded to the Monday report. French authorities have not released forensic evidence tying Tehran to the October supermarket attack.