MAG212 CYBER ORIGINAL ARTICLE

France Blames Iran’s IRGC for Heating Supermarket Fridges: Refrigeration Controllers Become a State Target

November 10, 2026 · El Mostafa Ouchen

France has formally blamed Iran’s Revolutionary Guard for the October cyberattack that switched supermarket refrigerators to heating across hundreds of stores. Paris prosecutors named the IRGC, and France’s national cyber agency ANSSI attributed the operation to the Shahid Kaveh group, which it describes as an IRGC-affiliated cyber unit, according to an AP report published by SecurityWeek on 10 November (SecurityWeek/AP). The attribution turns a facilities problem into a nation-state operational-technology issue for every retailer, cold-chain operator and building manager with controllers on the internet.

Attribution	France (prosecutors and ANSSI): IRGC-linked Shahid Kaveh group
Attack	Overnight 11–12 October 2026; about 700 of France’s roughly 10,000 supermarkets affected (reported)
Impact	Fridges reached about 50°C for around six hours; Intermarché reported losses of tens of millions of euros (reported)
Devices named	Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB (CERT-FR, as reported)
Still exposed	3,124 controllers (47%) reachable on 5 November, per Censys
Legal action	Judicial investigation opened; arrest warrants sought, not yet issued; EU sanctions promised, not yet enacted

What happened

Prosecutor Laure Beccuau opened a judicial investigation into organised cybercrime carried out on behalf of a foreign power, targeting the group’s leader and two deputies. The evidence cited includes the use of Farsi and IP addresses linked to devices in Iran. International arrest warrants are being sought but had not been issued. Foreign minister Jean-Noël Barrot summoned Iran’s ambassador, called it “an attack of unprecedented scale and aggressiveness” and said France would seek sanctions at the European level (SecurityWeek/AP). Iran’s response had not been reported at press time.

The reported impact is unusually physical: attackers took control of refrigeration in hundreds of stores, temperatures reached about 50°C for roughly six hours, and around 700 supermarkets were affected. The AP account dates the attack to 12 October; earlier reporting places it overnight on 11–12 October (SecurityWeek, 3 Nov).

From the first wave to the attribution. Dates as reported; the link between the waves is not confirmed. Diagram: MAG212 CYBER

Competing claims, and what is still open

France’s attribution is official. Earlier, pro-Russian hacktivist groups NoName057(16) and Z-Pentest Alliance reportedly claimed to have hacked Danfoss (SecurityWeek, 6 Nov), claims The Record describes as unverified (The Record). It is also not confirmed whether the attribution covers the second wave, overnight from 31 October to 2 November, which hit more than 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden (SecurityWeek), or the incident at the French Blood Establishment (EFS), where attackers reached three plasma cold-storage sites through refrigeration supplier Coolworld and EFS says no blood products or samples were compromised (SecurityWeek/AP).

Who is affected

Five US agencies, CISA, the FBI, HHS, USDA and the Department of Transportation, say they are aware of malicious actors targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold-storage facilities (SecurityWeek; advisory: IC3 joint advisory, which we could not retrieve directly). CERT-FR first flagged Danfoss AK-SM and AK-SC controllers, then added Copeland/Dixell XWEB. Danfoss said most of the hacked units were legacy products it no longer updated, and told customers on 13 October to disconnect them from the internet (SecurityWeek).

Exposure is falling but far from gone. Censys counted 6,695 exposed controllers on 9 October and 3,124, or 47%, still reachable on 5 November. Copeland/Dixell XWEB exposure fell from 3,708 to 2,420 and Danfoss StoreView from 3,004 to 708 (Censys). These figures come from Censys, not from the government advisory.

How the attack works

As reported from the US advisory, attackers exploit unpatched or internet-accessible controllers through authentication bypass, code injection and weak configurations. They then change settings remotely to force continuous heating and defrost cycles, and cause “denial of view”, so operators cannot see the real state of the system (SecurityWeek). No indicators of compromise were available to us because the advisory PDF could not be retrieved.

What to look for

Setpoint or defrost-schedule changes nobody on your team made.
Controller dashboards that freeze, go blank or show values that don’t match the store floor.
Any controller or building-management interface reachable from the internet, tested from outside your network.

Contain and harden

The agencies’ recommended mitigations, as reported (SecurityWeek):

Remove control systems from the internet, or put them behind a firewall or edge device.
Isolate OT networks from IT and guest networks.
Restrict access to trusted identities using strong passwords and phishing-resistant MFA.
Patch, or replace legacy controllers the vendor no longer supports.
Keep offsite backups of controller configurations.
Turn on logging and monitoring.

How to confirm you’re clean

An external scan confirms controller interfaces are no longer reachable from the internet.
Setpoints and defrost schedules match known-good values, compared against your offsite configuration backup.
Remote access for maintenance contractors goes through a controlled, logged path.

Lessons for admins, staff and leaders

MSPs and facilities teams: treat any internet-reachable building controller serving retail, food, pharmacy or healthcare clients as an incident waiting to happen.
Store and site staff: report unexplained temperature alarms or dashboard outages to IT as a possible security event, not just a maintenance call.
Leaders: the same pattern is appearing in other OT tools. A related example is the CVSS 10 Node-RED flaw (CVE-2026-58115, including Siemens SIMATIC IoT2050), which VulnCheck has seen exploited since 30 October against instances without admin authentication (SecurityWeek).

What we still don’t know

Whether France’s attribution also covers the second wave and the EFS incident.
The advisory’s technical indicators, pending retrieval of the IC3 document.
Iran’s response, and whether EU sanctions and arrest warrants follow.

Related on MAG212 CYBER

MAG212 CYBER Daily, 10 November 2026