France blamed an IRGC-linked Iranian cyber unit for hacking refrigeration controllers at about 700 supermarkets in October, spoiling food and sparking at least 15 fires. Here is what happened, the second European wave, whether food is safe and how small businesses can protect their equipment.
Kara
France formally blamed Iran on Monday, Nov. 9, 2026, for the cyberattack that sent supermarket fridge and freezer temperatures soaring across the country in October. French officials say a hacking unit tied to Iran’s Islamic Revolutionary Guard Corps (IRGC) broke into internet-connected refrigeration controllers at about 700 retail sites, spoiling food and sparking at least 15 fires. A second, separate wave hit more than 100 stores across Europe in early November, and France has not blamed anyone for that one yet. Here’s what happened, which stores and equipment were involved, and what it means for shoppers and small businesses.
Overnight on Oct. 11 to 12, attackers took control of the web-based systems that many French supermarkets use to monitor and manage their refrigeration remotely. According to BleepingComputer, they changed defrost settings to high temperatures, which made cooling units heat up instead of keeping food cold. The BBC reported that temperatures in some stores reportedly rose to 50C (about 120F) overnight, forcing shops to throw out tons of chilled and frozen food.
The Associated Press said about 700 of France’s 10,000 supermarkets were affected. A technical report from CERT-FR, France’s national computer emergency team, lists Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché among the victims, along with smaller butcher shops, a slaughterhouse and food-processing cooperatives. The BBC reported that more than 100 Coopérative U stores and 180 Intermarché and Netto stores were hit, and that Monoprix was affected too.
The BBC said the French attack targeted software from Danish engineering firm Danfoss that lets retailers manage cold units from afar. Danfoss has said the affected equipment was obsolete and no longer received software or security updates, according to The Brussels Times. Belgium’s cybersecurity agency, the Centre for Cybersecurity Belgium (CCB), says attackers are going after publicly exposed management screens on Danfoss AK-SC and AK-SM series controllers, as well as Dixell xweb and Copeland xweb devices.
Switzerland’s National Cyber Security Centre narrowed that down further. It named two end-of-life Danfoss products, the AK-SM 800 System Manager and the AK-SC 355, plus the current AK-SM 800A and AK-SM 8xxA family when it runs outdated firmware. Security updates are available for that newer family.
France’s foreign ministry pinned the October attack on Shahid Kaveh, a cyber unit linked to the IRGC’s electronic and cyber center. “I am able to confirm that responsibility for this act lies with the Islamic Revolutionary Guard Corps,” Foreign Minister Jean-Noël Barrot told reporters in Paris, according to TechCrunch. He called it “an attack of unprecedented scale and aggression” and said it would “not go without consequences.”
France summoned Iran’s ambassador and said it will push for European sanctions against those responsible, AP reported. Paris prosecutors have also taken up the case. The Record notes that Shahid Kaveh has previously been linked to attacks on industrial controllers at U.S. water utilities.
Per BleepingComputer, French investigators pointed to several clues:
CERT-FR says the unit operates behind several online “hacktivist” names, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front. Iran had not officially responded as of Monday, and the BBC reported that some Iranian media outlets dismissed the allegations as baseless. It’s worth remembering that attributing cyberattacks is hard, and France hasn’t published every piece of evidence behind its conclusion.
A new round of attacks hit overnight from Nov. 1 to Nov. 2. In Belgium, about 40 Delhaize stores were affected, along with Carrefour, Intermarché and Spar supermarkets, butcher shops and an Ikea store in Mons, The Brussels Times reported. One Delhaize manager in Jette said the store lost its entire stock of frozen food, “60 metres of fridges.”
The CCB says this wave reached Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia. BleepingComputer counted more than 115 stores across six countries, while The Record said businesses in at least 11 European countries were hit, including British meat suppliers. France’s national blood service also reported that temperature and defrost settings were changed at three facilities that store blood products, though TechCrunch reported the attacks were stopped before any blood was spoiled.
France has attributed only the October attacks to Iran. Whether the November wave came from the same group is still unknown. TechCrunch also reported that U.S. officials are looking into whether freezer units on military bases were hacked, though there’s no formal public U.S. attribution.
The affected stores threw out spoiled chilled and frozen products, which is why many shoppers saw empty freezer aisles after the attacks. There’s no sign that the hackers tampered with food itself; the damage came from the equipment warming up. If you shop at an affected chain, food on the shelves now should have come from fresh stock.
Still, a few common-sense checks help any time you buy chilled or frozen food:
The USDA Food Safety and Inspection Service calls 40F to 140F the “danger zone,” where bacteria grow fastest, and says food shouldn’t be left out of refrigeration for more than two hours. If something you bought seems warm or off, take it back to the store.
This story matters most for anyone running a shop, restaurant, cold store or warehouse whose refrigeration can be managed over the internet. In Belgium, cybersecurity firm Approach Cyber found about 700 refrigeration controllers exposed online in mid-October, and around 400 appeared to be running vulnerable software, according to The Brussels Times. The CCB says warnings sent before the November wave helped limit the damage.
Based on guidance from the CCB and Switzerland’s cybersecurity centre, here are the main steps:
If you also run a website for your business, the same basic habits apply there too. Our guide to checking whether your WordPress site is patched against PHP2Shell walks through a similar patch-and-verify routine, and our explainer on the top threats an intrusion prevention system detects covers the network monitoring side.
France now plans to push for EU sanctions, and the criminal case sits with the French justice system. Security agencies say campaigns against these controllers are probably still under way, so more retailers may report incidents. For a look at how another big 2026 security incident played out for ordinary customers, see our breakdown of the Binance hack and what users should do.
France blames Shahid Kaveh, a cyber unit tied to Iran’s Islamic Revolutionary Guard Corps, for the Oct. 11 to 12 attacks on French supermarkets. Iran had not officially responded as of Nov. 9.
About 700 French retail sites were hit in October. A second wave in early November affected more than 100 stores in other European countries, including about 40 Delhaize stores in Belgium.
Yes. French authorities say the October attack caused at least 15 fires, as well as large food losses.
No U.S. supermarkets have been publicly named. TechCrunch reported that U.S. officials are looking into possible hacks of freezer units on military bases, but there’s been no formal public attribution.
The main risk is older or unpatched controllers that are reachable from the internet. Danfoss says the equipment in the French attack was obsolete, and security updates are available for its current AK-SM 800A family.
Five minutes, every Sunday. Free.
Clear, useful guides on money, health, tech, home and everyday life, one small step at a time.
© 2026 StepByStore. All rights reserved.
Disclosure: some articles include sponsored or guest contributions. Commercial links in those articles are marked as sponsored. Learn more in our Editorial Policy.
