France Links Freezer Cyberattack to Iran-Backed Hackers

By Daniel Okafor

Some supermarket refrigerators caught fire after attackers raised their temperatures, in an incident France attributed to hackers operating under Iran’s Islamic Revolutionary Guard Corps, a key branch of Iran’s military establishment.

The French announcement marked the first state-linked attribution for a cyberattack on this type of refrigerated system. It also showed how default credentials can turn a small digital opening into disruption across a physical food supply chain.

France’s foreign minister called the incident an act of “unprecedented scale and unprecedented aggression.” The minister promised Europe-wide sanctions against those responsible. No political message accompanied the attack.

Rafe Pilling, a senior director at Sophos, a cybersecurity firm, said the attackers used default passwords to reach freezer controls. “The attacks themselves were not particularly complex,” he said. The method resembled an unlocked service entrance more than a sophisticated digital break-in.

How did the attack disrupt supermarkets?

Attackers turned some refrigerator temperatures so high that the units caught fire. In the hours after the hack, supermarket employees dumped piles of perished meat and melted ice cream into rubbish containers, turning a control-system breach into visible waste.

The disruption made headlines around the world. Unlike earlier Iranian-linked messaging operations, the freezer attack caused disruption without displaying a slogan or broadcasting a deepfake report.

What links the freezer attacks together?

The French case followed attacks on industrial freezers at an Israeli food production plant in May. A wave of freezer malfunctions also spoiled food at US military bases in August. Authorities reportedly treated those failures as a suspected hack.

The May and August incidents carried no official Iranian attribution. The French announcement was the first to implicate a state in this form of attack.

Pilling said there was now a presumption of a link between the French attacks and a wave of rogue defrosting hacks across Europe the previous week.

Why do state-linked hackers target infrastructure?

Iranian-linked hackers have used cyber operations to deliver explicit political messages. In 2023, a state-backed group interrupted TV streaming services in the UAE to broadcast a deepfake report on the Gaza war.

That same year, hackers affiliated with Iran displayed “down with Israel” on screens of water-control equipment made by an Israeli firm. Those cases ended with visible political messaging. The freezer attack had no message. Its effect came from spoiled food, fires and France’s threat of sanctions.

Pilling said hostile cyber operations against the West tend to come from China, Russia, Iran and North Korea. He described their main aims:

• China focuses on industrial espionage and mass data gathering.
• Russia focuses on disrupting enemy infrastructure and spreading disinformation.
• North Korea focuses on hacking crypto exchanges because it needs money.
• Iran focuses on projecting power and signaling political displeasure.

Against that pattern, Pilling said Iran generally uses cyberattacks to project power internationally and signal its political displeasure with regional and international adversaries. The freezer breach therefore served as a geopolitical signal, not merely an attempt to spoil food.

What warning did the UK issue?

The UK’s national cybersecurity centre warned that the country was in the foothills of a new level of cyber threat and should expect a huge rise in incident volume. It identified AI as the main concern because the technology can highlight previously unforeseen flaws in IT systems and help attackers plan and carry out attacks.

The reported freezer attacks did not depend on AI. Their vulnerabilities were relatively easy to find and exploit. Geopolitics, not artificial intelligence, supplied the motive. The combination of capable technology and tense global relations made those weaknesses more dangerous.

France’s attribution gives investigators a state-linked lead. The suspected European defrosting wave will test whether they can identify the same operators, while the UK warning points to a broader increase in cyber incidents.