On the night of October 11, attackers remotely manipulated refrigeration systems across roughly 700 French retail sites, raising temperatures and triggering prolonged defrost cycles. The result was spoiled food and at least 15 fires. No one broke a window; someone exploited vulnerable software running on a network-connected controller.
Scale by Design
Centralised systems turn one compromised supplier into a national incident.
France is a nuclear-armed state, a permanent UN Security Council member, Europe’s second-largest economy and a prominent backer of Ukraine. That profile attracts state-linked operators pursuing espionage, political signalling and retaliation, alongside criminal groups drawn by high-value data and ransomware leverage. French data-protection authorities recorded 6,167 personal-data breach notifications in 2025, and cybersecurity firm UpGuard describes France as “most heavily breached large jurisdiction in Europe” by exposed-record volume, which is UpGuard’s own characterization rather than an official ranking.
From Remote Access to Burning Freezers
The supermarket attack targeted equipment, not databases.
Attackers accessed remote-control modules made by Danfoss and Copeland, many running software that no longer received security updates. Rather than exfiltrating data, they manipulated defrost cycles and temperature settings inside stores belonging to IntermarchĂ©, Carrefour, Monoprix, E.Leclerc and CoopĂ©rative U, among other affected sites including butcher shops and food-processing facilities. France’s cybersecurity agency identified the compromised refrigeration-control modules as the point of interference, though the precise initial access method remains incompletely documented.
A Contested Attribution
French officials named an Iranian unit; Tehran called the accusation baseless.
French authorities attributed the operation to the Shahid Kaveh cyber-offensive unit, described as affiliated with Iran’s Islamic Revolutionary Guard Corps, according to Reuters. Officials cited infrastructure links, similarities with previous operations and traces of Farsi found in the attack environment as the basis for that assessment. Iran denied responsibility and called the accusations baseless, leaving the attribution a disputed French government claim rather than an established fact.
Not the Only Number That Counts
By some metrics, France is not even Europe’s most targeted country.
Sophos researcher Rafe Pilling noted that ransomware groups listed more victims in Germany and Italy than in France over the previous year, according to France24. Microsoft’s 2026 Digital Defence Report reportedly identified Ukraine as the European country where customers were most frequently affected by cyber threats. France’s prominence in breach statistics reflects the scale of individual incidents, not necessarily their frequency.
A Technique That Travels
Similar attacks appeared across five other European countries after the French incident.
Following the October disruption, comparable refrigeration intrusions were reported in Belgium, Luxembourg, Finland, Estonia and Sweden. The same vendors and remote-management practices are deployed widely across Europe, which means a technique that works in one market can be adapted elsewhere with limited additional effort. France was first in this reported series; it was not unique.
The Structural Problem
Outdated software and weak supplier oversight remain the core vulnerabilities.
Outdated systems, unpatched software and exposed remote-management interfaces provided the conditions attackers needed. The EU’s NIS2 Directive is designed to impose stronger cybersecurity accountability across critical sectors. France had not fully implemented it at the time of the attack, and the incident exposed infrastructure risks shared by suppliers and operators across the continent.
