France Blames Iran for Industrial Scale Refrigeration Cyberattacks

France has formally accused Iran's Islamic Revolutionary Guard Corps of directing a wave of disruptive cyberattacks that targeted supermarket refrigeration units and small hydroelectric power plants across the country. According to statements from French officials and the country's national cybersecurity agency, ANSSI, the operation compromised remote management software, turning up temperatures in retail cold storage units overnight and destroying tons of perishable goods. Foreign Minister Jean-Noël Barrot described the assault as unprecedented in its scale and aggression, marking a significant escalation in state-sponsored digital sabotage on national territory.

The Paris Prosecutor's Office has opened a formal investigation and is seeking international arrest warrants targeting the head of an offensive cyber unit known as Shahid Kaveh and his deputies. According to NPR, the French government linked the unit to the IRGC using digital clues including infrastructure traces, propaganda connections, and Farsi language markers. The campaign extended beyond retail stores, with NPR reporting that a major French blood bank narrowly avoided losing vital medical supplies after its cooling system was similarly disrupted, while ANSSI noted moderate effects on several small hydroelectric plants.

The attacks in France form part of a broader, multi-country pattern affecting operational technology systems globally. According to BBC News, a second wave of similar hacks struck over one hundred stores across several European countries including Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland. Earlier incidents targeted food processing facilities in Israel, while reports indicate that commissaries on United States military bases suffered unexplained refrigeration failures over the summer that are now being investigated as potential cyberattacks.

The technical core of the crisis lies in the vulnerabilities inherent to operational technology, the specialized software and hardware that govern physical industrial processes. Cybersecurity experts consulted by NPR highlighted that these systems frequently rely on outdated architectures that are exceptionally difficult to patch because critical services cannot tolerate downtime. Furthermore, many such devices remain exposed to the open internet, often to satisfy contractual requirements permitting vendors to perform remote maintenance and diagnostics.

Industry analysts suggest the targeting of commercial and industrial cooling infrastructure fits established patterns of Iranian state-backed cyber operations aimed at exerting psychological and physical disruption abroad. Alex Orleans of Sublime Security noted in comments reported by NPR that such operations deliver cost-effective disruption while national resources remain constrained. As governments in Europe grapple with the fallout, the attacks underscore an urgent need to secure remote management interfaces and vendor access pathways across critical supply chains and retail sectors.