France blames Iran for hacks that spiked freezer temps across Europe

Paris — Thousands of internet-connected industrial freezers and chillers across France and wider Europe were remotely driven above safe temperatures, and France's government on Monday formally blamed Iran's Islamic Revolutionary Guard Corps for the operation, calling it the first large-scale act of sabotage on French soil.

The mechanics were almost mundane, which is exactly the problem. Across two waves of attacks running through October and into November, hackers broke into the web-based controllers that manage fleets of industrial cold and chilling units in grocery stores and retail supermarkets, and pushed the setpoints upward to spoil food and destroy goods.

In scale, thousands of reachable units is no longer a pilot deployment gone wrong. It is a device class exposed by default in every back room, cold store and loading bay that installed it — and, unlike a ransomware event, the damage happens while the refrigeration keeps running.

The intrusions also reached medical blood banks. Officials at the French Blood Establishment said the attacks were stopped before any blood was spoiled, so the loss was averted rather than absorbed.

Security researchers have since warned that these web-based controllers are vulnerable to remote compromise, and that some of the affected models — made by Danish manufacturer Danfoss — no longer receive security fixes. End-of-life hardware that stays reachable from the internet does not retire itself from the network.

What did the government actually say?

Jean-Noël Barrot, France's foreign minister, told reporters in Paris: "I am able to confirm that responsibility for this act lies with the Islamic Revolutionary Guard Corps."

He added: "This was an attack of unprecedented scale and aggression; it represents the first large-scale act of sabotage on our national territory and constitutes a major assault on the nation's interests and the security of the French people." The hacks, he said, will "not go without consequences."

Why now, and why cold storage?

The freezer hacks are the latest in a run of destructive cyberattacks attributed to Iran this year, following a spate of intrusions against U.S. water providers and the mass disruption at Stryker, the U.S. medical device giant.

The U.S. government has linked these attacks to pro-Iranian hacktivists working for Tehran, likely in response to the U.S.-Israel-led war against Iran that killed the country's supreme leader in February.

Washington's own exposure is thinner so far. U.S. officials are reportedly investigating whether freezer units on military bases were hacked, following reports of similar outages and disruption earlier this year. Officials have linked the freezer-related cyberattack to Iran, but the intelligence community has not yet made a formal or public attribution.

What happens next

Reuters first reported France's attribution, citing sources ahead of the foreign minister's remarks. Paris has summoned Iran's ambassador and said it will also issue European-wide sanctions against those who carried out the hacks. Barrot said the matter is now in the hands of the French justice system.

A spokesperson for Iran's consulate in New York did not immediately respond to a request for comment.

What does this change for cold-chain operators?

The practical question for anyone running chilled inventory is blunt: what do you do when the thermostat can be edited from the other side of the world? Three answers follow from what Paris and the security researchers have described.

• Audit the fleet for internet-facing refrigeration controllers, starting with discontinued models — including the Danfoss units no longer receiving security fixes — and pull them behind a firewall or a management network.
• Verify cold chain out of band: manual temperature checks, alarm escalation and a documented response path, so a compromised controller cannot also blind the monitoring that would catch it.
• Decide without waiting for a formal verdict. The U.S. has not publicly attributed, which means operator risk cannot be deferred until a government issues a statement.

France has moved from the question of who did it to the question of what it costs; the unanswered one is how many more cold rooms are still listening to the internet.