France has formally blamed Iran’s Revolutionary Guard for a cyberattack that hit refrigeration systems in roughly 700 of the country’s 10,000 supermarkets on 12 October. Nobody’s card details were stolen. The attackers went for the cooling instead, and that should change how every retailer, food exporter and coolstore operator thinks about cyber risk.
Foreign Minister Jean-Noël Barrot summoned Iran’s ambassador, called it “the first large-scale cyberattack aimed at sabotage on French soil” and said France will push for EU sanctions. Paris prosecutors have opened a judicial investigation targeting a unit of the Guards known as Shahid Kaveh, according to franceinfo.
Default passwords did the damage
The mechanics are almost embarrassingly simple. Attackers reached industrial refrigeration controllers from Danfoss, Dixell and Copeland through exposed web interfaces, triggered endless defrost cycles and switched off the temperature alarms that would have warned staff, France’s national cyber agency CERT-FR found. In some stores temperatures hit 50C for about six hours. Units overheated badly enough to cause around 20 fires nationally.
Intermarché alone reported losses of “tens of millions of euros” in a single day. Casino, Leclerc, Carrefour, Metro and Coopérative U were all hit, along with butchers, slaughterhouses and processing cooperatives.
This was not a nation-state masterpiece. Rafe Pilling, senior director at Sophos, told The Guardian the attacks “were not particularly complex”, with hackers reportedly using default passwords. Much of the equipment was legacy hardware no longer receiving security updates. The IRGC did not need a zero-day. It needed a device search engine and a list of factory logins.
Shared vendors turned one breach into 700
The reason one unit could hit hundreds of stores at once is structural. Competing chains buy from the same handful of refrigeration vendors and use the same maintenance software. Sébastien Abis of IRIS France warned that “a common vulnerability can… have simultaneous consequences across hundreds of shops” that are otherwise commercially independent.
That is a concentration risk most boards have never priced. Your competitor’s fridge controller is probably your fridge controller.
The campaign is spreading, not stopping
On 2 November, supermarkets in nine other European countries, including Sweden, Belgium, Ireland and Estonia, reported similar failures and binned spoiled food. A second wave reached more than 100 sites, including British meat suppliers and three French blood service locations. Investigators also found Iranian hackers probing Schneider Electric controls at small hydroelectric plants, BleepingComputer reports.
RNZ places this among the most disruptive cyberattacks of the Iran war that began in February. Worse, hundreds of refrigeration devices stayed exposed to the internet even after the first wave was public. Claroty CTO Amir Preminger called connecting them at all “an old-fashioned bad practice”.
Andrew Tierney of Pen Test Partners put the industry failure bluntly, telling TechTarget “we’re still seeing the same mistakes being made today that we’ve seen being made 10 years ago.” Forescout’s Daniel dos Santos described operational technology as “a sort of soft underbelly”.
New Zealand runs on the same kit
None of the coverage mentions New Zealand, but the read-through is direct. Our meat, dairy and horticulture exporters, and both supermarket groups, depend on networked refrigeration and cold-chain monitoring, often from the same brands compromised in France. Distance from Tehran is no defence when the attack surface is a web login.
For a domestic retailer, a sabotaged freezer is a stock write-off and a bad week. For an exporter it is worse. A prolonged temperature excursion in a coolstore or processing plant is a food-safety and market-access problem in the EU, US and China, buyers that do not forgive cold-chain breaches. The reputational cost lands on the national brand, not just the company.
Most NZ firms have spent the past five years hardening payments, email and customer data. Far fewer have audited which compressors, controllers and building systems are reachable from the internet, who installed them, and whether anyone changed the default password.
The audit belongs on the board agenda
The fix is not exotic or expensive. Inventory every connected piece of plant. Pull it off the public internet. Change factory credentials. Replace controllers that no longer get updates. Make sure maintenance contractors are not the back door. Insurers are already urging brokers to review property, liability and cyber cover together rather than in silos, because a hacked fridge that starts a fire falls between all three.
France’s sanctions push will play out slowly in Brussels. The vulnerability will not wait. Iran has shown that anyone willing to scan for exposed devices can turn a supermarket’s cooling into a weapon, and the next operator to find a list of open controllers may not care which hemisphere they sit in.
Sources
- 1News: France blames Iran for cyberattack on supermarket fridges (2026-11-09)
- franceinfo: La France accuse l’Iran de la cyberattaque contre des frigos de supermarchés (2026-11-09)
- The Guardian: Cyber-attack on French supermarket freezers has geopolitical context (2026-11-09)
- RNZ: French supermarkets suffer refrigerator shutdown after ‘unprecedented’ cyberattack (2026-10-13)
- NZ Herald: Supermarket fridges, the new battlefront of cyber warfare in Europe (2026-11-09)
- The Record: France blames Iran for fridge cyberattacks, says some caused fires (2026-11-09)
- BleepingComputer: France blames Iranian hackers for supermarket attacks that sparked fires (2026-11-09)
- RNZ: French officials accuse Iran of being behind refrigerator hacks (2026-11-10)
- Politico: Cyberattack on French supermarkets tells us more about food security than AI safety (2026-10-19)
- TechTarget: European freezer hacks expose OT security blind spot (2026-11-03)
Join the discussion
Add useful context, ask a good question, or challenge an idea — keep it specific and respectful.