Iran's IRGC Hacked French Supermarket Fridges — a Low-Tech Attack with High-Cost Consequences

France attributes a cyberattack on ~700 supermarket refrigeration units to Iran's Revolutionary Guard, marking a new frontier: state-sponsored sabotage of civilian food infrastructure.

France's Foreign Minister Jean-Noël Barrot formally attributed the October cyberattack on French supermarket refrigeration systems to Iran's Islamic Revolutionary Guard Corps. The hack targeted roughly 700 of France's approximately 10,000 supermarkets, remotely manipulating cooling units to spoil food and, in some cases, setting temperatures so high the units caught fire. Barrot called the attack "unprecedented in both its scale and its level of aggression" and pledged EU-level sanctions against those responsible.

The Paris prosecutor's office opened a judicial investigation naming the head of Shahid Kaveh — an offensive cyber unit under the IRGC's Electronic and Cyber Center — along with two deputies and potentially other individuals. The attack was launched overnight on October 11-12. It was technically simple, exploiting internet-connected industrial cooling controllers, but operationally effective: hundreds of stores pulled products from cold storage and discarded spoiled inventory wholesale. The implications extend beyond grocery losses. Similar incidents hit French supermarkets again last week, and authorities reported a failed attempt to hack cooling units at blood banks — a target whose compromise could endanger lives, not just lettuce. Supermarkets in other European countries and the United States have reported analogous breaches, though it remains unclear whether all incidents share a common origin. This attack represents a strategic pivot. Iran's cyber operations have historically targeted energy infrastructure, government networks, and dissidents. Hitting civilian food supply chains is a deliberate escalation: it imposes visible, quotidian disruption on ordinary consumers while staying below the threshold of armed conflict. The message is that no infrastructure is off-limits. The vulnerability exposed is structural. Industrial Internet of Things (IIoT) devices — refrigeration controllers, HVAC systems, building management platforms — are mass-deployed with minimal cybersecurity hardening. Most run on legacy protocols never designed for internet exposure. The attack surface is enormous: tens of thousands of connected units across Europe, many with default credentials or no encryption. France's response — sanctions and judicial investigations — follows the standard diplomatic playbook. But sanctions against IRGC-affiliated cyber units have limited deterrent value when Iran already operates under heavy sanctions regimes. The harder question is whether European governments and retailers will invest in securing IIoT infrastructure before the next attack targets something more critical than cold storage. The 20-year trajectory is clear. As industrial control systems proliferate and remain poorly secured, state and non-state actors will increasingly target mundane infrastructure — not for intelligence, but for disruption. The fridge hack is a proof of concept. The blood bank attempt was the escalation signal.