The latest: State-sponsored cyber sabotage targets essential civilian food supply chains
In an unprecedented escalation of state-sponsored cyber warfare targeting civilian infrastructure, French judicial authorities have formally accused the Islamic Revolutionary Guard Corps (IRGC) of Iran of executing a coordinated digital assault that compromised commercial refrigeration and freezer systems across approximately 700 supermarkets in France.
Paris Public Prosecutor Laure Beccuau confirmed Monday that her office's national cybercrime division (JUNALCO) has initiated formal criminal proceedings and requested international arrest warrants for senior military cyber commanders within the IRGC's specialized offensive cyber unit known as "Shahid Kaveh." Investigators revealed that hackers breached internet-connected industrial temperature controllers manufactured by Danish engineering giant Danfoss, reprogramming the devices to force continuous defrost cycles while disabling automated acoustic alarms.
The sabotage resulted in catastrophic thermal spikes that ruined tens of thousands of metric tons of perishable groceries, meat, dairy, and pharmaceuticals. More alarmingly, the endless heating element cycles overheated industrial compressor units, triggering approximately 20 active electrical fires inside grocery utility rooms across the country before emergency technicians could manually disconnect the equipment from power grids.
How hackers manipulated Danfoss thermal controllers into destructive defrost loops
Technical assessments released by France's National Cybersecurity Agency (ANSSI) and the General Directorate for Internal Security (DGSI) detailed how the attackers gained access to decentralized food retail networks during an offensive carried out over the weekend of October 11–12, 2026.
Rather than infiltrating centralized corporate networks, the perpetrators identified publicly reachable IP addresses linked to Danfoss AK-CC series refrigeration case controllers and supervisory gateway modules commonly installed in grocery outlets. Utilizing default credentials and unpatched remote-access vulnerabilities, the intruders injected malicious configuration scripts that overrode safety thresholds.
By forcing the equipment into perpetual defrost cycles, the heating coils—normally activated for only brief intervals to clear frost buildup—ran at peak electrical load for consecutive days. Grocery workers arrived in the morning to find frozen food completely melted, milk spoiled on shelves, and smoke pouring from secondary utility rooms. Danfoss confirmed it has cooperated fully with European cyber defense authorities, dispatching emergency security firmware patches and advising retailers to isolate all industrial IoT controllers behind strict virtual private networks (VPNs).
French Foreign Minister Jean-Noël Barrot summons Iranian ambassador and urges EU sanctions
The diplomatic reaction in Paris was swift and severe. French Minister for Europe and Foreign Affairs Jean-Noël Barrot summoned Iran's ambassador to France, Mohammad Amin-Nejad, to the Quai d'Orsay to lodge a formal diplomatic condemnation.
"This cyberattack constitutes an intolerable and dangerous aggression against French civilian infrastructure and the food supply of our citizens," Barrot said in a televised address on Monday. "France will not tolerate foreign military intelligence units weaponizing digital networks to threaten our public safety and economy."
Barrot added that France is mobilizing its European Union partners to institute sweeping, targeted sanctions against the Shahid Kaveh unit and the IRGC's digital leadership, emphasizing that civilian commercial infrastructure must remain an untouchable red line under international cyber norms. The Iranian Embassy in Paris rejected the accusations, dismissing them as "politically motivated fabrications."
Lingering questions over broader European infrastructure vulnerability
As French authorities seek international arrest warrants, cybersecurity agencies and European retailers face pressing security concerns:
- Extradition hurdles: Given that the named IRGC commanders reside in Iran, actual custody appears unlikely unless the suspects travel to jurisdictions honoring Interpol arrest warrants.
- Broader European exposure: Similar anomalous refrigeration incidents reported in Sweden, Belgium, and Luxembourg are currently under investigation to determine if the same IRGC campaign extended across borders.
- Industrial IoT hardening: Security researchers warn that hundreds of thousands of commercial IoT controllers—from supermarket chillers to water pumps—remain exposed to automated scanning and state-sponsored attacks worldwide.
