Top-Secured cyber watch: independent analysis based on the official statement of CERT-FR · ANSSI and on the press. Top-Secured is not affiliated with this company and will never ask you for your bank details or passwords.
France has officially attributed to Iran the attack that, on the night of 11 to 12 October 2026, altered the settings of refrigeration controllers at retail sites across the country. The C4 report published by CERT-FR names the Shahid Kaveh unit of the Revolutionary Guards and describes goods losses and fires. For any company, the lesson is about connected equipment left reachable from the internet.
What happened
On 9 November 2026, the French Ministry for Europe and Foreign Affairs attributed to Iran a cyberattack it describes as the first purely sabotage-driven offensive on French soil. It names the Shahid Kaveh unit, attached to the cyber centre of the Islamic Revolutionary Guard Corps (IRGC), announces that Iran’s ambassador will be summoned and says France will propose new European sanctions. The same day, CERT-FR published the report of the Cyber Crisis Coordination Centre (C4), which brings together ANSSI, COMCYBER, DGA, DGSE and DGSI.
According to that report, the refrigeration controllers of about 700 retail sites were compromised during the night of 11 to 12 October 2026. Their defrost settings were set to high temperatures, causing large losses of goods and, in at least 15 cases, fires. The C4 lists among those affected the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups, as well as small butchers, a slaughterhouse and food-processing cooperatives. The ministry puts the food losses at several tens of millions of euros, by its own estimate.
How the attackers operated
The report does not say exactly how the controllers were breached. It states that the operators used FOFA, a tool that indexes devices reachable from the internet, and that the same infrastructure was scanning Schneider Electric equipment over the Modbus protocol (TCP port 502), notably in small hydroelectric plants, where effects were moderate. The C4 also links the Revolutionary Guards to earlier attacks against Charlie Hebdo (2023) and a video display company during the Paris 2024 Games.
What to do now
- List every controller, PLC and supervision interface (refrigeration, HVAC, energy, access control), including those installed by a maintenance provider.
- Test from the outside which ones answer on your public addresses, e.g.
nmap -Pn -p 502,80,443,8080 <your-public-range>. - Close: no industrial protocol and no controller web page directly on the internet; remote access only through a VPN with multi-factor authentication, providers included.
- Change default passwords and remove unused accounts.
- Monitor: alerts on setpoint changes and temperature drift, plus a saved copy of the settings to restore them quickly.
Our take
A refrigeration controller is a small server, and attackers search for them just as they search for forgotten web servers. The inventory of what faces the internet must include these devices, and remote maintenance must go through the same doors as the rest of the network.
Sources
- CERT-FR — Activités cyber offensives ciblant la France menées par des acteurs iraniens liés au CGRI (CERTFR-2026-CTI-009)
- France Diplomatie — Déclaration d’attribution à l’Iran de cyberattaques visant la France
- The Hacker News — France Blames Iran for Sabotage Attack on Refrigeration Controllers at About 700 Retail Sites
How we choose, verify and write our analyses →
Check before you click, and check what your servers expose — free, no intrusion:
Worried your servers are exposed? Our team audits, patches and monitors Linux and cloud infrastructure 24/7.
Talk to an expert Our managed server services →
