{"id":4132,"date":"2026-11-10T09:50:36","date_gmt":"2026-11-10T17:50:36","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=4132"},"modified":"2026-11-10T09:50:36","modified_gmt":"2026-11-10T17:50:36","slug":"france-blames-iran-irgc-supermarket-refrigeration-cyberattack-controllers","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/france-blames-iran-irgc-supermarket-refrigeration-cyberattack-controllers\/","title":{"rendered":"France Blames Iran\u2019s IRGC for Heating Supermarket Fridges: Refrigeration Controllers Become a State Target"},"content":{"rendered":"

France has formally blamed Iran\u2019s Revolutionary Guard for the October cyberattack that switched supermarket refrigerators to heating across hundreds of stores. Paris prosecutors named the IRGC, and France\u2019s national cyber agency ANSSI attributed the operation to the Shahid Kaveh group, which it describes as an IRGC-affiliated cyber unit, according to an AP report published by SecurityWeek on 10 November (SecurityWeek\/AP<\/a>). The attribution turns a facilities problem into a nation-state operational-technology issue for every retailer, cold-chain operator and building manager with controllers on the internet.<\/p>\n\n\n\n

Attribution<\/strong><\/td>France (prosecutors and ANSSI): IRGC-linked Shahid Kaveh group<\/td><\/tr>
Attaque<\/strong><\/td>Overnight 11\u201312 October 2026; about 700 of France\u2019s roughly 10,000 supermarkets affected (reported)<\/td><\/tr>
Impact<\/strong><\/td>Fridges reached about 50\u00b0C for around six hours; Intermarch\u00e9 reported losses of tens of millions of euros (reported)<\/td><\/tr>
Devices named<\/strong><\/td>Danfoss AK-SM\/AK-SC and Copeland\/Dixell XWEB (CERT-FR, as reported)<\/td><\/tr>
Still exposed<\/strong><\/td>3,124 controllers (47%) reachable on 5 November, per Censys<\/td><\/tr>
Legal action<\/strong><\/td>Judicial investigation opened; arrest warrants sought, not yet issued; EU sanctions promised, not yet enacted<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Ce qui s'est pass\u00e9<\/h2>\n\n\n\n

Prosecutor Laure Beccuau opened a judicial investigation into organised cybercrime carried out on behalf of a foreign power, targeting the group\u2019s leader and two deputies. The evidence cited includes the use of Farsi and IP addresses linked to devices in Iran. International arrest warrants are being sought but had not been issued. Foreign minister Jean-No\u00ebl Barrot summoned Iran\u2019s ambassador, called it \u201can attack of unprecedented scale and aggressiveness\u201d and said France would seek sanctions at the European level (SecurityWeek\/AP<\/a>). Iran\u2019s response had not been reported at press time.<\/p>\n\n\n\n

The reported impact is unusually physical: attackers took control of refrigeration in hundreds of stores, temperatures reached about 50\u00b0C for roughly six hours, and around 700 supermarkets were affected. The AP account dates the attack to 12 October; earlier reporting places it overnight on 11\u201312 October (SecurityWeek, 3 Nov<\/a>).<\/p>\n\n\n\n

\"Timeline
From the first wave to the attribution. Dates as reported; the link between the waves is not confirmed. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

Competing claims, and what is still open<\/h2>\n\n\n\n

France\u2019s attribution is official. Earlier, pro-Russian hacktivist groups NoName057(16) and Z-Pentest Alliance reportedly claimed to have hacked Danfoss (SecurityWeek, 6 Nov<\/a>), claims The Record describes as unverified (Le Record<\/a>). It is also not confirmed whether the attribution covers the second wave, overnight from 31 October to 2 November, which hit more than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden (Semaine de la s\u00e9curit\u00e9<\/a>), or the incident at the French Blood Establishment (EFS), where attackers reached three plasma cold-storage sites through refrigeration supplier Coolworld and EFS says no blood products or samples were compromised (SecurityWeek\/AP<\/a>).<\/p>\n\n\n\n

Qui est concern\u00e9 ?<\/h2>\n\n\n\n

Five US agencies, CISA, the FBI, HHS, USDA and the Department of Transportation, say they are aware of malicious actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold-storage facilities (Semaine de la s\u00e9curit\u00e9<\/a>; advisory: IC3 joint advisory<\/a>, which we could not retrieve directly). CERT-FR first flagged Danfoss AK-SM and AK-SC controllers, then added Copeland\/Dixell XWEB. Danfoss said most of the hacked units were legacy products it no longer updated, and told customers on 13 October to disconnect them from the internet (Semaine de la s\u00e9curit\u00e9<\/a>).<\/p>\n\n\n\n

Exposure is falling but far from gone. Censys counted 6,695 exposed controllers on 9 October and 3,124, or 47%, still reachable on 5 November. Copeland\/Dixell XWEB exposure fell from 3,708 to 2,420 and Danfoss StoreView from 3,004 to 708 (Censys<\/a>). These figures come from Censys, not from the government advisory.<\/p>\n\n\n\n

Comment fonctionne l'attaque<\/h2>\n\n\n\n

As reported from the US advisory, attackers exploit unpatched or internet-accessible controllers through authentication bypass, code injection and weak configurations. They then change settings remotely to force continuous heating and defrost cycles, and cause \u201cdenial of view\u201d, so operators cannot see the real state of the system (Semaine de la s\u00e9curit\u00e9<\/a>). No indicators of compromise were available to us because the advisory PDF could not be retrieved.<\/p>\n\n\n\n

Que rechercher<\/h2>\n\n\n\n