Hackers remotely turned supermarket freezers into 'ovens': France blames an Iranian Revolutionary Guard cyber unit for sabotage at 700+ stores

The backstory: cyberattacks are moving from stealing to smashing

When people think of hackers, they usually think of stolen passwords, leaked data, or ransomware that locks files until a payment is made. Those attacks mostly cost information and money.

But more and more physical equipment is now connected to networks: factory machines, water and power facilities, and even the refrigerators and freezers in supermarkets. Retailers do this so they can monitor temperatures remotely and manage stores centrally. If someone breaks into those control systems, though, they can do more than watch. They can change how the equipment runs and cause real, physical damage.

Attacks like that have been relatively rare in the news. This one was strikingly large.

What happened

On November 9, France's Foreign Ministry formally blamed Iran for an attack on supermarket refrigeration last month.

According to Paris, on the night of October 11-12, attackers broke into refrigeration control equipment at more than 700 retail sites across France. A technical report released the same day by France's Cyber Crisis Coordination Center, known as C4, said the attackers raised the equipment's "defrost" settings to high temperatures.

Defrosting is a normal freezer function: a short burst of warming to melt built-up frost. The attackers effectively turned it into a heating mode. Citing French officials and investigators, The Guardian reported that some freezers were driven from about -27C (-17F) to above 50C (122F), hotter than a scorching summer day outdoors, turning freezers into something closer to ovens.

The fallout: large amounts of perishable food had to be thrown out; the technical report recorded at least 15 fires; and in some stores, fires set off sprinklers, causing water damage on top of it. France estimated losses in the tens of millions of euros.

The main victims were large retail groups, including Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché, along with several small butcher shops, a slaughterhouse, and cooperative food-processing plants. The report also said Schneider Electric equipment at several small hydroelectric facilities in France was targeted around the same time, with what it described as limited effects.

Who France says did it

Foreign Minister Jean-Noël Barrot announced the conclusion during the G7 summit in Paris. He said government agencies had enabled him to confirm that Iran's Islamic Revolutionary Guard Corps was responsible, called it "a major violation of the nation's interests," and said Iran's ambassador would be summoned to hear France's protest. He also said France would push for Europe-wide sanctions.

The Foreign Ministry named the operator as Shahid Kaveh, an offensive cyber unit it said is affiliated with the Revolutionary Guard's Electronic Warfare and Cyber Defence Organization and a persistent threat to French critical infrastructure. Paris called the operation unprecedented in scale and aggressiveness, and "the first offensive cyber campaign carried out purely for the purposes of sabotage on French soil."

Paris prosecutor Laure Beccuau said investigators had opened a case against the head of Shahid Kaveh, his deputies, and others yet to be identified, on charges including organized attacks on automated data-processing systems and damage dangerous to people, aggravated by the allegation that the offenses served a foreign power.

Where the claim stops

These are official French findings and legal steps, not a completed trial, and they have not been independently adjudicated in public. Iran has often rejected attributions like this, and no full third-party forensic account has been released.

The Foreign Ministry also placed the incident in a longer timeline: France has previously tied some cyber activity linked to Charlie Hebdo in 2023 and to the Paris 2024 Olympics to Iran. But this attribution covers the October supermarket refrigeration attack only. It should not be read as France blaming the same actors for later cold-chain incidents in Europe that Paris has not publicly linked to them.

What it could change

France said it would use all available means of response under its 2026 National Cybersecurity Strategy, including action within the E.U. and with European and international partners, and reserved the right to take further public or non-public steps.

The bigger picture: conflict between states is reaching the supermarkets ordinary people shop in every day. Retailers and regulators may start taking "boring" connected equipment, such as freezers, air conditioning, and lighting, far more seriously as security risks. Equipment makers may face pressure to ship safer default settings and tighter controls on remote access.

What it means for you

The most immediate issue is food safety. When the cold chain breaks, food can warm up and spoil where you can't see it. In this case, large amounts of affected food were thrown out by stores. As a shopper, it's a simple, useful habit to check frozen and chilled items for signs of thawing and refreezing, and to glance at freezer temperature displays.

Second, losses like these tend to get spread around society somehow, through insurance, business costs, and potentially prices. There's no data yet on whether this attack affected prices, so it's best not to guess.

Third, it's a reminder that the connected devices in your own home are doors too. For routers, cameras, and smart appliances, change default passwords and keep software updated. If hackers can turn a supermarket freezer into an oven, "it's just an appliance" is no reason to leave it unguarded.

Original source published: The Guardian, Nov 10, 2026, 00:53 Beijing time (UTC+8)