• French intelligence services reportedly link the October 11–12 attacks on supermarket refrigeration systems to Iran's Islamic Revolutionary Guard Corps (IRGC), according to Le Figaro.
  • The attacks affected approximately 700 stores, causing stock spoilage and operational disruption, but attribution remains uncertain as the assessment relies on unnamed sources and does not conclusively tie the French incidents to subsequent European disruptions or earlier U.S. military freezer failures.
  • The incident highlights vulnerabilities in operational technology (OT) and the risks of exposed management interfaces, prompting France's CERT-FR to issue security guidance and coordinate with European and U.S. authorities.

A State-Linked Sabotage Campaign?

French officials reportedly suspect that Iran orchestrated the overnight cyberattacks on supermarket refrigeration systems in October, according to a report from Le Figaro. The newspaper cited intelligence sources as saying that the operation was carried out by the cyber centre of Iran's Islamic Revolutionary Guard Corps (IRGC). The Paris prosecutor's specialist cybercrime section is investigating the incident, which affected approximately 700 stores, according to France's economy minister, who spoke to Parliament on October 13. Attackers manipulated refrigeration settings, causing stock to spoil and forcing emergency technical interventions.

The reported attribution, if confirmed, would mark a significant escalation in state-linked sabotage against civilian commercial infrastructure. However, the evidence reviewed does not establish that the October French attacks, subsequent similar incidents across Europe, and earlier freezer failures at U.S. military commissaries were all part of a single operation. The assessment remains provisional, and U.S. officials have reportedly suspected Iran-linked actors behind the August commissary failures but have not reached a firm conclusion.

A spokesperson for the French interior ministry declined to comment on the Le Figaro report. The IRGC could not be reached for comment. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) did not respond to a request for comment.

Scale and Spread of the Disruption

The October attacks were widespread: France's economy minister told Parliament that roughly 700 stores were affected, with earlier reports citing smaller totals. The compromised equipment included Danfoss AK-SM and AK-SC controllers, as well as Copeland and Dixell XWEB systems, according to a French government alert. The alert warned that exposed administration interfaces and weak passwords were the primary attack vectors, rather than previously publicized software vulnerabilities.

In early November, similar refrigeration disruptions spread to several European countries, including Belgium, Luxembourg, the Netherlands, Sweden, Ireland, and Estonia. Separately, France's blood service confirmed that cold rooms were targeted, but staff intervention prevented any loss of blood products and no health impact was identified. These later incidents have not been conclusively linked to the October perpetrators, and it remains unclear whether they were copycat attacks or part of a broader campaign.

Financial and Operational Fallout

The immediate financial impact has been localized: spoiled inventory, disrupted trading, and recovery expenses for affected retailers. Intermarché and Coopérative U, two of the affected supermarket operators, confirmed substantial numbers of targeted outlets but did not provide consolidated loss estimates. The reviewed reporting does not indicate any attack-driven leadership changes or restructuring at the equipment manufacturers.

Danfoss, whose refrigeration-control equipment was implicated, reported €5.254 billion in first-half 2026 sales, with organic sales growth of 15% and operational EBITA of €802 million. These figures predate the attacks and do not reflect any impact. Copeland, which supplies refrigeration compression and control technologies and employs approximately 18,000 people across more than 40 countries, has not disclosed any quantified attack-related earnings impact. Neither company has issued a statement linking the attacks to a breach of its central systems.

The broader industry issue is the security of operational technology—the systems that control physical equipment. Remote maintenance makes refrigeration easier to manage, but exposed management interfaces can allow relatively simple intrusions to cause irreversible physical losses. Third-party maintenance providers represent another risk concentration: operators in Portugal and Germany described incidents involving external refrigeration-maintenance contractors, suggesting that shared access credentials may warrant investigation.

Regulatory and Political Response

France's CERT-FR issued an alert on October 12, updated on October 13 and 16, identifying affected equipment and urging operators to avoid exposing management interfaces directly to the internet. The guidance calls for protected remote access, configuration reviews, firmware updates, and password changes. A simple reset is insufficient if unsupported equipment remains exposed, the agency warned.

European authorities, including the European Commission, ENISA, Europol, and national agencies, are coordinating and sharing information. U.S. and French investigators are also cooperating on the case. The reported IRGC connection, if substantiated, could add friction to France–Iran relations, but the reviewed reporting does not establish a specific Iranian motive, retaliatory French measures, or sanctions tied to this incident.

What to Watch

The decisive next development would be an attributable French government statement or published evidence explaining the IRGC assessment, along with clarification of whether it applies only to the October French attacks. Until then, the strongest conclusion is that France reportedly suspects Iranian state involvement in that incident, while the broader international pattern remains under investigation. SentinelLABS (NYSE:S) expects further attempts wherever exposed systems and weak access controls remain, and copycat attacks could complicate efforts to determine which incidents belong together.

Correction: An earlier version of this article incorrectly stated that the French blood service reported a loss of blood products. In fact, staff intervention prevented any loss, and no health impact was identified.