France accuses Iran of cyber 'sabotage' in fridge attacks
asserted
France → accuse → attacks
France is accusing Iran of having launched a series of destructive cyberattacks against its critical infrastructure in October.
asserted
France → accuse → October
According to the French National Cybersecurity Agency, ANSSI, Iranian military hackers took over refrigeration controllers at around 700 different retail sites in France, from supermarkets to butcher shops, turning up the temperature in the middle of the night and spoiling millions of dollars' worth of food.
They also targeted several small hydroelectric power plants, resulting in "moderate effects," wrote ANSSI in its press release.
uncertain
ANSSI → accord → release
The hacking campaign was "unprecedented in both its scale and its level of aggression," said French Foreign Minister Jean-Noël Barrot.
asserted
Barrot → say → aggression
He said it "marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation's interests and the security of the French people.
asserted
it → say → people
"
The Paris Prosecutor's Office has opened its own investigation into the Iranian cyber unit, Shahid Kaveh, which the French government is linking to Iran's Islamic Revolutionary Guard Corps.
asserted
government → open → Corps
"The Paris Public Prosecutor's Office is requesting the issuance of international arrest warrants," the office said in a statement.
asserted
office → request → statement
In 2026 alone, hackers have targeted refrigeration controllers from Europe to Israel and the United States.
asserted
hackers → target → Israel
Grocery stores in European countries including Sweden and Ireland were hit in similar attacks last week.
asserted
stores → include → attacks
In a separate incident in France, employees at a major French blood bank had to act fast to save blood samples from heating up when their refrigeration system was hit last week, prompting international calls for the health sector to protect its lifesaving products from spoiling.
asserted
sector → have → products
In Israel in the spring, suspected Iranian hackers going by the name of "Cyber Isnaad Front" claimed responsibility for sabotaging an industrial food processing plant, including infecting its corporate computers with malware, taking over office printers to print out threatening messages and hacking office cameras for use in a propaganda video released in early October.
asserted
hackers → suspect → October
That video included a taunt in French referencing ongoing education-related protests, and came just before the attacks on French supermarket fridges.
asserted
video → include → fridges
Cyber incident response firm Profero attributed the Israel attack to a wing of Iran's Revolutionary Guard Corps.
asserted
Profero → attribute → Corps
Over the summer, commissaries on U.S. military bases also went through something similar, when food spoiled after the temperature shot up inside refrigerators and freezers overnight.
asserted
temperature → go → refrigerators
The French government is the first to formally assign blame for the wave of destructive attacks.
asserted
government → assign → attacks
They were able to identify the hackers through a series of digital clues, including digital infrastructure used by the hackers, connection to a propaganda outlet, and "traces" of the use of Farsi language in the attack, according to ANSSI.
uncertain
They → identify → ANSSI
While NPR and others have reported that U.S. officials suspect Iran may have been behind the attacks on U.S. military bases in August, the Pentagon has not made any official statement, even to conclude that the disruptions were in fact the result of a cyberattack.
uncertain
disruptions → report → cyberattack
"Consistent with our policy and to preserve the integrity of the process, the DOD [Office of Inspector General] Criminal Investigative Service does not discuss ongoing investigations," Mollie Halpern, a spokesperson for the Department of War Office of the Inspector General wrote in an email to NPR.
asserted
Halpern → preserve → NPR
Attacks fit Iranian hackers' modus operandi
asserted
Attacks → fit → operandi
If Iranian hackers are behind the attacks across Europe, the U.S. and Israel, cybersecurity experts say that would fit with what they know about Iranian hackers' strategy and goals.
asserted
they → say → strategy
"Iran's cyberattacks against refrigeration systems likely represents the IRGC attempting to reassert Iranian power abroad through both physically and psychologically disruptive operations," Alex Orleans, the head of threat intelligence at cybersecurity firm Sublime Security, told NPR.
asserted
Orleans → represent → NPR
"Such activities continue to provide tangible and cost-effect results given how Iran's national resources remain tied down in the war."
asserted
resources → continue → war
"Also, Shahid Kaveh, the IRGC cyber unit that the French specifically attributed the disruptive attacks to, is repeating a pattern here," Orleans says.
asserted
Orleans → attribute → pattern
He referenced a series of cyberattacks on American water treatment plants in August, which most experts believe were linked to Iran, as precedent.
asserted
experts → reference → precedent
The U.S. government has still not officially attributed those attacks.
asserted
government → attribute → attacks
"This unit has once again refined its tradecraft through attacks on Israeli targets before shifting their targeting to the same systems in the West," Orleans says.
asserted
Orleans → refine → West
For those tracking Shahid Kaveh and the other Iranian cyber units that operate alongside it, these attacks fit squarely into their modus operandi.
asserted
attacks → track → operandi
"Shahid Kaveh group is an offensive cyber unit responsible for some of the greatest hits of Iranian offensive cyber [operations]," says Ari Ben Am, an adjunct fellow at the Foundation for the Defense of Democracies' Center on Cyber and Technology Innovation.
asserted
Am → say → Innovation
One group tied to Shahid Kaveh is the Cyber Av3ngers, he explains, which the U.S. government linked to cyberattacks on Israeli-made systems in U.S. water treatment facilities in the winter between 2023 and 2024.
asserted
government → tie → 2023
The French government also cited other cyberattacks carried out on behalf of the IRGC against French interests, including against the satirical French magazine Charlie Hebdo and another against digital kiosks used at the Paris Olympics in 2024.
asserted
government → cite → 2024
Challenges in securing operational technology
Cybersecurity experts say the attacks on refrigeration controllers have highlighted a yearslong difficulty with securing operational technology, the machines that control physical processes in the real world — from water pumps to cooling systems.
asserted
that → secure → systems
These machines are often outdated and riddled with vulnerabilities, and are very difficult to patch because operators can't afford to shut them down and disrupt critical services including healthcare and transportation.
asserted
operators → riddle → healthcare
Additionally, the machines are often left exposed to the open internet — often at least in part due to contractual requirements with vendors that want to maintain those systems remotely.
asserted
that → leave → systems
That combination of factors makes it a complicated problem to solve.
asserted
it → make → factors
Iran has yet to respond to the accusations.
asserted
Iran → have → accusations
However, Monday's accusation by the French government may lead other affected countries to take action as well.
uncertain
accusation → lead → action
During Monday's G7 meeting in Paris, Secretary of State Marco Rubio was asked by journalists whether the U.S. shared information with the French to help with their attribution of the Iranian hacks.
asserted
U.S. → ask → hacks
Rubio said he couldn't comment, but noted that the "French are quite capable."
"What kind of sickos are these people?" he asked.
asserted
he → say → sickos
"They attack refrigerators.
asserted
They → attack → refrigerators
France is not even involved in this, really," referring to the war between the U.S. and Iran, which began in February.
asserted
which → involve → February
…and 2 more, not listed.
The Aporia
