Overview
France has attributed a cyberattack affecting approximately 700 supermarket sites to Iran’s Islamic Revolutionary Guard Corps (IRGC), after attackers remotely manipulated refrigeration systems during the night of 11–12 October 2026. According to French investigators, the attackers altered cooling controls, causing significant food losses and approximately 20 fires across affected locations, including Système U, Intermarché and E.Leclerc. French officials described the incident as an attack of unprecedented scale and are seeking European sanctions against those responsible.
How the Attack Worked
Investigators said the attackers accessed refrigeration control systems through web-based management interfaces, targeting equipment from Danfoss and subsequently Dixell and Copeland. Once inside, they reportedly triggered abnormal defrost cycles without time limits and disabled temperature-related safety alerts. The combination was particularly damaging because the attackers were able to interfere with the physical cooling process while simultaneously preventing operators from receiving the warnings that would normally indicate dangerous temperature increases.
Why This Is Significant
This incident demonstrates the real-world consequences of compromising operational technology (OT) and industrial control systems. Unlike a conventional data breach where the primary impact may be stolen information or unavailable applications, manipulating refrigeration controls directly affected physical processes, food safety and potentially human safety. It is a strong example of how remotely accessible control systems can turn a cybersecurity incident into an operational and business-continuity crisis.
Security Risks
The exact initial access method has not been publicly confirmed, and French investigators have not established that a previously disclosed Danfoss authentication vulnerability was used in this incident. However, the investigation reportedly identified attack patterns, Farsi-language indicators and IP addresses associated with Iran. Organisations should therefore avoid assuming that an exposed management interface has been compromised simply because it is vulnerable, but should treat publicly accessible OT management systems as a significant security risk.
Security Best Practices
OT operators should remove control interfaces from direct Internet exposure, apply supported firmware and security updates, replace default or weak credentials and restrict remote administration through protected access mechanisms such as VPNs and controlled jump hosts. Following an incident, simply restoring network connectivity is not enough: administrators should verify controller configurations, user accounts, defrost schedules, temperature thresholds, safety alerts and remote-access settings to ensure that malicious changes have not survived the recovery process.
Expert in the Cloud Insight
The supermarket refrigeration attack highlights why cybersecurity and operational technology can no longer be treated as separate disciplines. A compromised web interface controlling a refrigeration system can ultimately affect physical equipment, inventory, safety and business operations. Organisations operating connected HVAC, refrigeration, building-management, manufacturing or other OT systems should therefore identify every remotely accessible controller, understand what physical processes it can influence and ensure that remote access is tightly controlled. If an attacker can change the physical environment, cybersecurity becomes a safety and business-continuity issue — not simply an IT problem.
Expert in the Cloud – The Future Is Now.
Leave a Reply