France has attributed an October cyberattack affecting refrigeration controllers at about 700 French retail sites to an Iranian military cyber unit. The Hacker News reported that the government named Shahid Kaveh, part of Iran’s Islamic Revolutionary Guard Corps (IRGC), on November 9 after an operation that spoiled food and caused fires.
For refrigeration operators, the attack demonstrates the physical consequences of unauthorized access to equipment controls. During the night of October 11, attackers raised defrost temperatures; prosecutors said they also removed time limits from abnormal defrost cycles and disabled temperature warnings. France’s Foreign Ministry estimated food losses at several tens of millions of euros.
The victims included Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, France’s cyber crisis coordination center, C4, said. Large retailers accounted for most affected organizations, but smaller businesses and food-production facilities also suffered damage, including butcher shops, a slaughterhouse and cooperative food plants.
Remote access enabled changes to refrigeration settings
The Paris prosecutor’s office said the attackers reached Danfoss and Dixell refrigeration controllers through web interfaces and took control remotely. They disabled the safety alerts from temperature probes, which should warn operators when readings exceed a threshold, while initiating defrost cycles with abnormal settings and no time limit.
The Hacker News reported fires in at least 15 cases; prosecutors gave an estimate of about 20 fires. The Foreign Ministry characterized the operation as the first offensive cyber campaign in France conducted purely for sabotage.
C4 also connected the refrigeration attack with simultaneous targeting of Schneider Electric equipment at several small French hydroelectric installations, where the effects were moderate.
A CERT-FR incident alert identified numerous compromises across four refrigeration-controller families: Danfoss AK-SM and AK-SC, Copeland xweb, and Dixell xweb. In its October 16 update, France’s incident-response service warned that campaigns against this equipment were probably continuing and criticized the exposure of management interfaces to the internet.
A further wave of refrigeration attacks hit supermarkets in several other European countries during the week preceding the November 10 report, but France’s attribution statement addressed the October operation without discussing those attacks.
The evidence behind France’s attribution
France identifies Shahid Kaveh as a unit whose public presence largely takes the form of hacktivist personas, including CyberAveng3rs and Cyber Isnaad Front, used to claim some operations.
C4 attributed sponsorship to the IRGC and execution to Shahid Kaveh using four indicators. The center combines the national cybersecurity agency ANSSI, the DGSE and DGSI security services, the armament directorate and the cyber defense command.
One indicator connected the attack infrastructure to reconnaissance—scouting potential targets—of Schneider Electric equipment during the same period. Such equipment operates at facilities including small and medium-sized energy and water production sites. C4 said the scouting methods matched techniques Shahid Kaveh had used since at least April.
The other indicators were the attackers’ use of FOFA, a scanning tool associated with the unit; coverage of the attack as early as October 13 by CyberbanNews, a propaganda outlet linked to Shahid Kaveh; and traces of Persian on the attack infrastructure.
Prosecutors described additional findings from the criminal investigation conducted by France’s anti-cybercrime office, OFAC, and the DGSI: methods typical of the unit, use of Persian, and IP addresses pointing to devices in Iran.
C4 also cited the unit’s previous claims concerning industrial equipment: a November 2023 campaign against Israeli industrial-control manufacturer Unitronics claimed through CyberAveng3rs, and a large March–April sabotage campaign against Israeli and US interests that included Israeli refrigeration equipment.
On November 9, the Paris prosecutor’s office opened a judicial investigation targeting the unit’s leader, two deputies and others who may be identified, and requested international arrest warrants. The alleged offenses include unlawful interference with computer systems and damage caused by means dangerous to people, with aggravating circumstances tied to the alleged purpose of serving Iran as a foreign power.
France’s Foreign Ministry plans to summon Iran’s ambassador and ask European partners to impose new sanctions on Iranian organizations and individuals involved.
Operators should restrict access and check configurations
CERT-FR’s response guidance begins with removing refrigeration controllers from direct internet access, including units reachable at public IP addresses. Before interrupting the data feed to a refrigeration contractor, operators should check their insurance contract terms.
Equipment that has reached end of life and receives no security fixes presents a particular problem. CERT-FR warns that a factory reset can remove an attacker’s persistent access while leaving the device vulnerable; if it remains exposed to the internet, another compromise is almost certain.
For controllers that have not been compromised, CERT-FR advises operators to examine the entire configuration, with particular attention to defrost ranges. Manufacturer recommendations should also be applied. For Danfoss devices, these include updating firmware—the software running the controller—selecting the Strict security level and ensuring default passwords have been changed.
For compromised equipment, the alert calls for restarting Danfoss devices or otherwise returning controllers to factory settings. Operators should reconfigure affected devices before putting them back into service and apply the manufacturer’s recommended practices.
For both groups, CERT-FR says remote access should resume only through a secure VPN, an encrypted network connection, or a protected network. A firewall rule restricting access to contractors’ IP addresses can serve as an emergency measure, but operators should establish the protected access arrangement as the lasting fix.
