France blames Iran unit for attacks on retail refrigeration systems

France has attributed a claw-back sabotage campaign to Iran’s Islamic Revolutionary Guard Corps (IRGC), naming the Shahid Kaveh unit as the operator behind an October attack that targeted refrigeration controllers at about 700 French retail sites. The group reportedly gained remote access to Danfoss and Dixell controllers via web interfaces, triggering abnormal defrost cycles with no time limits and disabling temperature-probe safety alerts.

The French prosecutor estimates the operation caused food losses worth tens of millions of euros and, in at least 15 instances, fires. The incident was linked to earlier reconnaissance against Schneider Electric equipment at small hydroelectric facilities, with Iran-linked indicators such as Persian-language traces and IP addresses implicated in the activity.

France’s cyber security and diplomatic authorities say four indicators tie Shahid Kaveh to the assault and note the attack’s observers overlapping with reconnaissance of the same Schneider Electric gear. The attack affected large retailers including Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, along with smaller food plants and a slaughterhouse.

In its attribution and parallel actions, France’s Foreign Ministry said it would summon Iran’s ambassador and seek sanctions, while the Paris prosecutor’s office opened a judicial inquiry against the unit’s head and deputies, with international arrest warrants requested.

CERT-FR’s alert warned that several remote refrigeration controllers across the Danfoss AK-SM/AK-SC, Copeland xweb and Dixell xweb families had been compromised or exposed to ongoing campaigns, and recommended removing internet exposure, reassessing defrost ranges, and restoring access only through secure networks. The agency also urged adherence to maker guidance, firmware updates, and robust password practices.