Cyber Sabotage: French Retailers Report $Millions in Spoiled Food After Iranian Hacks

Approximately 700 retail locations in France experienced a sudden spike in temperature overnight in October, causing millions of dollars worth of perishable goods to spoil. The French government announced on Monday that it is holding Iranian military hackers responsible for the destructive campaign. According to the French National Cybersecurity Agency, ANSSI, the attackers accessed refrigeration controllers in supermarkets, butcher shops, and other small retailers. The intruders increased the cooling units' temperature settings, leading to widespread food loss across the country.

ANSSI also reported that several small hydroelectric power plants were targeted during the same period. The agency described the impact on these facilities as having moderate effects. French Foreign Minister Jean-Noël Barrot stated that the operation marks the first large-scale cyberattack aimed at sabotage on French national territory. He characterized the incident as a major attack on the nation's interests and the security of its citizens.

The Paris Prosecutor's Office has opened a formal investigation into Shahid Kaveh, a cyber unit linked to Iran's Islamic Revolutionary Guard Corps. The prosecutor's office is seeking international arrest warrants for the group. ANSSI identified the hackers by analyzing digital infrastructure used during the attacks, connections to a propaganda outlet, and traces of the Farsi language in the code.

This incident is part of a wider pattern of attacks on refrigeration systems that have occurred across Europe, the United States, and Israel in 2026. In early November, grocery stores in Sweden and Ireland suffered similar disruptions. In France, a major blood bank recently had to manually save blood samples after its refrigeration system was compromised, prompting calls for stronger protection of medical supplies. In Israel, suspected Iranian hackers claimed responsibility for sabotaging a food processing plant in the spring, infecting computers and hijacking office cameras for propaganda videos.

U.S. military bases also faced issues over the summer when food spoiled after refrigerators and freezers heated up overnight. While U.S. officials suspect Iran was behind those August disruptions, the Pentagon has not issued an official statement. Mollie Halpern, a spokesperson for the Department of War Office of the Inspector General, wrote in an email that the agency does not discuss ongoing investigations to preserve their integrity.

Cybersecurity experts say the attacks align with known Iranian tactics. Alex Orleans, head of threat intelligence at Sublime Security, noted that Iran uses these operations to reassert power abroad through physically and psychologically disruptive actions. He observed that Shahid Kaveh has refined its methods by targeting Israeli systems before shifting focus to Western infrastructure. Ari Ben Am, an adjunct fellow at the Foundation for the Defense of Democracies, described Shahid Kaveh as a unit responsible for some of the most notable Iranian offensive cyber operations. He pointed to previous attacks on Charlie Hebdo and digital kiosks at the 2024 Paris Olympics as part of this group's history.

Experts highlight that securing operational technology remains a challenge. These machines, which control physical processes like cooling and water pumping, are often outdated and difficult to patch without shutting down critical services. Many are exposed to the open internet due to vendor contract requirements for remote maintenance. This combination of vulnerabilities makes them attractive targets for state-sponsored actors.

Iran has not yet responded to the French accusations. During a G7 meeting in Paris, U.S. Secretary of State Marco Rubio was asked if the U.S. shared information with France to help attribute the hacks. Rubio declined to comment on the specifics but stated that the French are quite capable. He expressed surprise that the attackers targeted refrigerators, noting that France is not directly involved in the U.S.-Iran war that began in February. Rubio concluded that the news did not surprise him given the group's history of actions around the world.

The French government is the first to formally assign blame for the wave of destructive attacks. The identification of the hackers relied on specific digital clues, including infrastructure usage and language traces. The campaign affected a wide range of commercial sites, from large supermarkets to small local shops, disrupting supply chains for working families who rely on these stores for fresh produce and meat. The investigation into Shahid Kaveh continues as the prosecutor's office pursues legal remedies.