France Blames Iran for Hacks That Heated Supermarket Freezers and Threatened Blood Stores

On Monday, November 9, 2026, the French government formally blamed Iran for cyberattacks on internet-connected industrial refrigeration and freezer units in France and across Europe, and summoned Iran's ambassador over the incidents.

Foreign Minister Jean-Noël Barrot said in Paris that responsibility lies with Iran's Islamic Revolutionary Guard Corps. He described the campaign as an attack of unprecedented scale and the first large-scale act of sabotage on French national territory. TechCrunch reported the accusation, along with the ambassador summons and the French position that the matter now rests with the French justice system.

The intrusions targeted web-based controllers, the browser-accessible software that staff use to monitor and adjust industrial cooling at grocery stores and supermarkets. Attackers broke into those controllers remotely in October and into November, then raised temperatures to spoil food. Reuters reported in October that the temperatures were pushed as high as 50 degrees Celsius (122 degrees Fahrenheit), that the French chain Intermarché had 150 stores targeted, and that the overheated units sparked fires. A BBC report from early November put the reach at shop freezers in seven European countries and fridges and freezers in hundreds of supermarkets.

Medical storage was also targeted. Refrigerators at three regional blood banks in France were hit by a cyberattack overnight between Sunday and Monday, around November 2, according to Reuters. The French Blood Establishment said the attacks were stopped before any blood was spoiled.

On the equipment side, some of the affected web-based freezer controllers were made by the Danish company Danfoss, and some affected models no longer receive security fixes. That detail matters for operators who cannot simply patch their way out of exposure. A controller that has reached end of security support, meaning its maker no longer issues updates for it, remains reachable from the internet for as long as it stays connected.

The U.S. government is reportedly investigating whether freezer units on military bases were hacked in similar incidents. The U.S. intelligence community has not made a formal public attribution to Iran.

The broader context here is architectural. Remote management of cold-chain equipment is valuable because it lets one operator watch thousands of compressors, condensers and temperature setpoints from a single console, much as a building manager might watch every thermostat from one screen. The same property makes that management interface an attractive single point of control. In this case the consequence was physical rather than data-centric. The attackers did not need to steal anything to cause harm. They only had to change a setpoint and wait for the product to warm. Operational technology (OT) teams have long treated these devices as isolated plant equipment, but many now sit on the same IP networks and browser front ends as the rest of the enterprise, with the same exposure to credential theft and unpatched firmware.

In my view, the questions that matter most for practitioners are mundane ones: whether these controllers were internet-facing when they should not have been, whether default or reused credentials were in play, and how long an end-of-support model can remain in service before the cost of replacing it is weighed against the risk. Those questions are not yet answered, and attribution to a state actor does not settle them. Government attribution, sanctions and judicial proceedings run on a different timescale from the patch cycle that operators control.

The more hopeful reading is that cold-chain telemetry is what allowed these intrusions to be noticed, traced and disclosed within weeks. The same remote visibility that created the exposure can be hardened with network segmentation, multi-factor authentication, signed firmware and contractual support commitments that last for the life of the equipment. The technology that made supermarkets and blood banks easier to run can be made harder to abuse. The work now is to make that hardening routine rather than a response to the next headline.