Threat watch / Campaign
Supermarket refrigeration controllers attacked in France, then across Europe
Since the night of October 11 to 12, attackers have remotely changed settings on refrigeration controllers in hundreds of French supermarkets, then in stores in several other European countries on November 1 to 2. Food was spoiled and, in France, at least 15 fires broke out. On November 9, France attributed the October attack to Shahid Kaveh, an offensive cyber unit of Iran's Revolutionary Guards.
- Sector
- Retail
- Way in
- Exposed or misconfigured
- Product or vendor
- Danfoss, Copeland, Dixell, Schneider Electric
- food losses in France, as estimated by the French government[8]
- Tens of millions of euros
- How it happened
- Through remote controllers for refrigeration (Danfoss AK-SM and AK-SC, Copeland xweb, Dixell xweb), reached over the internet. CERT-FR says management interfaces were exposed to the internet. ANSSI's director general told the Senate the French attacks came from basic security failures, such as equipment exposed directly on the internet, and the press reports he also named weak passwords. Danfoss says most affected systems were older products that no longer receive updates. In the Netherlands, a Danfoss spokesperson says systems were not on a secure network and used default passwords. The honeypot firm Lupovis saw login attempts with factory-default credentials on Danfoss AK-SM controllers from October 20 to 30. In Belgium, attackers entered individual supermarket systems, not contractors' systems.[1][2][4][5][6][7] Checked 9 Nov 2026
- What was stolen
- No data theft is reported. The attacks changed settings: continuous defrost cycles and temperature setpoints raised, reportedly to 50 °C in some French and Swedish stores.[3][4][5][6] Checked 9 Nov 2026
- Who was impacted
- France: about 700 of 10,000 supermarkets according to the finance minister, including 300 Intermarché and Netto stores and 80 of Coopérative U's 2,000 stores, with refrigerated cases out of service and food thrown away. French authorities count at least 15 fires, and besides supermarket chains (Casino, Leclerc, Coopérative U, Metro, Carrefour, Intermarché) small butchers, a slaughterhouse and cooperative food plants were hit. Schneider Electric equipment at several small French hydroelectric plants was targeted at the same time, with moderate effects. November 1 to 2: stores in Belgium, Luxembourg, Sweden, Estonia, Ireland, Finland, Portugal, Italy and the Netherlands, including at least 17 Dutch businesses.[2][4][6][9] Checked 9 Nov 2026
- Threat actor
- Shahid Kaveh →
Timeline
- Overnight from October 11 to 12, French store teams find freezers warming. CERT-FR publishes an alert on "numerous compromises" of remote controllers for refrigeration (Danfoss AK-SM and AK-SC, Copeland xweb, Dixell xweb). [1][3]
- The finance minister tells Parliament that about 700 of France's 10,000 supermarkets are affected. The Paris prosecutor's office opens an investigation. Danfoss says most affected systems are older products without updates. [2][4]
- ANSSI's director general Vincent Strubel tells a Senate committee the attacks came from basic security failures, starting with refrigeration equipment exposed directly on the internet. [7]
- Overnight into November 2, a second wave hits stores in Belgium, Luxembourg, Sweden, Estonia, Ireland, Finland, Portugal, Italy and the Netherlands. Danfoss says its products were involved. [5][6]
- The same night, cold rooms at three sites of the French blood service EFS are tampered with through a supplier. EFS has its own entry in Watch. [7]
- As of November 3, no group has claimed the second wave. Belgium's federal prosecutor has opened a criminal investigation. [6]
- France attributes the October attack to Iran. The foreign ministry names Shahid Kaveh, an offensive cyber unit of the Revolutionary Guards' electronic and cyber centre, and calls it the first cyber campaign run purely for sabotage on French soil. The joint report of the French cyber crisis centre (ANSSI, DGSE, DGSI, DGA, COMCYBER) cites "a body of evidence": the same infrastructure used to scan Schneider Electric equipment since April 2026, the FOFA scan tool, a claim relayed on CyberbanNews from October 13, and traces of Farsi. France will summon Iran's ambassador and propose new EU sanctions. [8][9]
- The Paris prosecutor's office opens a judicial investigation targeting the head of the Revolutionary Guards' cyber centre and two Shahid Kaveh commanders, and requests international arrest warrants. As of Monday evening, Iran had not responded, according to The Record. [9][10][11]
- On franceinfo, Foreign Minister Jean-Noël Barrot says that beyond summoning the ambassador and EU sanctions, France "rules nothing out", including measures it will not make public. Asked whether Iran was also behind the attacks on an EFS refrigeration contractor, Crédit Mutuel Arkéa and the public finance directorate, he says he cannot answer while investigations are ongoing. [12]