France says Iran’s military hackers were behind the October supermarket cyberattacks. Picture someone slipping into a shop at night and setting every freezer to heat instead of cool. That is roughly what happened at about 700 French sites. On 9 November, Paris named the Iranian unit it blames, and Iran rejected the accusations as baseless, according to La Libre. Here is what is known, and what is not.
What France Says Happened
On the night of 11 to 12 October, attackers changed the defrost settings of refrigeration controllers at about 700 French retail sites, The Hacker News reported. Defrost is the step that warms a freezer to melt ice. According to an Associated Press report carried by OPB, temperatures reached 50°C (122°F) for about six hours, and stores threw away fresh and frozen food.
French officials counted at least 15 fires, per The Hacker News, though the prosecutor’s release, as reported there, cites about 20. In the AP account, Foreign Minister Jean-Noël Barrot blamed Iran’s Revolutionary Guard Corps on 9 November and called it the first large-scale cyber sabotage on French soil.
How the Hackers Got In
Think of a controller as the small brain that runs a freezer. Many have a web page so technicians can check them remotely. Prosecutors say attackers took over Danfoss and Dixell controllers through these pages, started defrost cycles with no time limit and switched off the safety alerts, according to The Hacker News. The same report says France’s cyber agency had warned in an October alert that exposing such pages to the internet is poor practice.
Analysis: The attack needed no exotic malware. It abused a basic exposure: a management page reachable from the open internet. That is why one campaign could reach hundreds of sites at once.
Why France Points at Iran
France’s cyber crisis centre, C4, lists four clues, as Security Affairs reports. The attack systems were also used to scout Schneider Electric equipment. The attackers used the scanning tool FOFA, which the group normally uses. A propaganda outlet linked to the group reported the attack on 13 October. And the systems held traces of Persian. Prosecutors add that some IP addresses led to devices in Iran, and they have asked for international arrest warrants.
Analysis: Each clue alone is weak. Language traces and common tools can be planted or shared, and IP addresses can be relays. The case rests on the combination, plus any intelligence the government has not published. Readers should treat this as a confident official judgement, not proof.
What Is Still Unclear
These are official findings, not court verdicts. On 2 November, supermarkets in other European countries reported suspected freezer attacks. France spoke only about the October case, and Security Affairs notes that nothing official links that second wave to Iran. Some pro-Russian groups claimed November incidents, so the picture may change. An attack on French blood banks was stopped before it damaged any blood products, AP reported.
What Happens Next
The investigation continues. Operators can act now. On 5 November, five US agencies, including CISA and the FBI, urged owners to take controllers off the internet, change default passwords, update software and set safe temperature limits with alerts.
The same weak spots, open web pages and weak passwords, can hit any cold storage, from shops to hospitals. The fix is basic care, and it costs far less than a night of spoiled stock.
