France Blames Iran for Cyberattacks That Spoiled Millions in Grocers' Food

Freezers at hundreds of French supermarkets heated up to roughly 120 degrees Fahrenheit in mid-October, spoiling millions of dollars' worth of food — and France now says Iran carried out the attack.

According to multiple reports, the French government attributes the intrusion to Shahid Kaveh, a hacking unit inside Iran's Islamic Revolutionary Guard Corps (IRGC, the country's dominant military and security force). Shahid Kaveh has documented ties to two hacktivist personas — CyberAveng3rs and Soldiers of Solomon — both of which have publicly claimed responsibility for the attacks.

The attribution isn't based on claims alone. Investigators found that whoever targeted the refrigeration units used the same equipment-scanning methods against industrial systems that Shahid Kaveh commonly deploys. That technical fingerprint, matched against the unit's known behavior, is what anchored the French government's conclusion.

For grocery distributors and retailers, the financial mechanics are blunt: the attack didn't steal data, it destroyed perishable inventory at scale. Hundreds of stores lost full freezer cases — product that carries thin margins and fast inventory turns, meaning the loss hits both the balance sheet and the replenishment cycle.

What came after the French attacks?

A second wave of cyberattacks followed, hitting European supermarket refrigeration systems at dozens of locations across seven countries: Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. The same failure mode repeated — refrigeration units heating up rather than shutting down. Investigators have not linked this second incident to Shahid Kaveh or the IRGC unit, leaving that wave unattributed.

The French attacks also fit a broader pattern of grocery-sector incidents. Last month, Ahold Delhaize — the Dutch-Belgian retail group with major U.S. and European operations — shut down its websites across both regions for several days following a cyber incident. The two events aren't linked in the source reporting, but together they mark a stretch of sustained targeting across the grocery supply chain.

What are regulators warning about?

The FBI and several U.S. government agencies have now warned that cybercriminals may be targeting industrial refrigeration systems worldwide. The joint advisory came from:

• The FBI
• The Cybersecurity and Infrastructure Security Agency (CISA, the U.S. agency overseeing critical infrastructure cyber defense)
• The Department of Justice
• The U.S. Department of Health and Human Services
• The U.S. Department of Agriculture
• The U.S. Department of Transportation

The agencies said they are aware of "malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems globally." The mention of the cold chain — the temperature-controlled logistics network that moves food and pharmaceuticals from producer to shelf — signals the concern extends beyond retail stores to distribution infrastructure.

The attack vector, according to the FBI, is unsophisticated. "Attackers are getting in through controllers that are unpatched, reachable from the internet or still using the default passwords listed in the manufacturer's manual," said Brett Leatherman, FBI assistant director and head of FBI cyber investigations.

What does this mean for distributors?

Three exposures stand out in Leatherman's description, and each maps to a fixable gap:

• Unpatched controllers — refrigeration and cold-chain monitoring devices running outdated firmware
• Internet-reachable systems — industrial equipment exposed directly to the public internet
• Default credentials — passwords never changed from the manufacturer's manual

None of these require advanced tooling to exploit. That's the uncomfortable takeaway for wholesalers and retailers holding millions in perishable stock: the barrier to entry for this class of attack is low, and the inventory damage is immediate and uninsured-adjacent in many cases.

For food distribution specifically, the attack surface sits at the least-glamorous layer of the network — the controllers running compressors and cold rooms, often installed years ago and managed as facilities equipment rather than IT assets. The French case shows that gap converts directly into spoiled product.

With one attack wave attributed to an Iranian state-linked unit, a second still unattributed across seven European countries, and a six-agency U.S. warning now on record, refrigeration security has moved from facilities maintenance to a board-level supply chain risk.