France has formally accused Iran of carrying out an unprecedented cyberattack on commercial refrigeration systems across the country, blaming hackers linked to the Islamic Revolutionary Guard Corps (IRGC) for compromising controllers at roughly 700 retail sites last month and deliberately raising temperatures in the middle of the night.

The campaign, described by French officials as the first known state-linked operation of its kind against food-supply infrastructure, spoiled millions of dollars' worth of food and, in a handful of cases, triggered fires inside stores. Paris responded this week by summoning Iran's ambassador, issuing arrest warrants for several suspected operatives and vowing retaliation.

What Happened

According to the French government, attackers gained remote access to internet-connected refrigeration management systems — devices used by supermarkets and grocery chains to monitor and adjust cold-storage temperatures — at around 700 separate retail locations. Rather than encrypting data or demanding ransom, the intruders simply turned the thermostats up, letting chilled and frozen goods thaw overnight when stores were empty and staff were off duty.

The result was significant financial loss rather than physical danger in most cases, but authorities confirmed that some incidents caused fires — reportedly when overheating equipment or failed components came into contact with flammable material. No injuries have been reported.

"This is a new form of attack, and it is unprecedented," a French official said, according to multiple outlets. Reuters reported that Paris has "vowed retaliation," while The Record, which covers cybersecurity, noted that French authorities explicitly linked some of the incidents to fires.

Who Is Blaming Whom

France attributes the operation to actors working on behalf of the IRGC, the branch of Iran's military tasked with protecting the Islamic Republic's political system and which oversees much of the country's cyber-operations. The accusation places the attack within a broader pattern of Iranian-linked intrusions against Western infrastructure, including water utilities, ports and — most prominently — Albanian government systems in 2022, which prompted Tirana to sever diplomatic ties with Tehran.

US Secretary of State Marco Rubio weighed in sharply, calling the perpetrators "sickos" in comments carried by US outlets — an unusually blunt characterization from a senior American diplomat and a sign that Washington is prepared to amplify Paris's attribution.

Iran has not publicly responded to the specific allegations in detail, and no evidence dossier has been released to the public. Independent security researchers have not yet verified the scope of the 700-site figure, and attributing cyber-operations to state actors with certainty typically requires intelligence that governments do not disclose.

Why Refrigerators?

Industrial refrigeration controllers are a mundane but attractive target for state-linked hackers. They are frequently connected to the internet for remote monitoring by maintenance contractors, often run on default or weak credentials, and are rarely covered by the same security standards as payment systems or customer databases.

The attack's design — maximizing economic damage and disruption rather than stealing data — fits a pattern of "sabotage-lite" operations intended to impose costs without crossing the threshold of lethal force. Food spoilage and store closures create insurance claims, supply-chain churn and public unease, all of which generate headlines for the attacker at comparatively low cost.

"Turning up the temperature on a fridge is not a dramatic act of war, but hitting 700 stores at once is a demonstration of capability that every retailer in Europe will now have to think about."

A European Problem

French media and international outlets including Le Monde and France 24 framed the operation as an attack on European commerce rather than a purely French matter, noting that the targeted infrastructure spans retail chains with operations beyond France's borders. The New Arab and other regional outlets emphasized the diplomatic dimension, focusing on the summoning of Iran's ambassador in Paris.

The episode arrives at a delicate moment. European capitals have been debating whether to trigger snapback sanctions on Tehran over its nuclear program, and France has been among the harder-line voices. A confirmed, publicly attributed cyberattack on civilian food infrastructure gives Paris political cover for a more confrontational posture — and gives Washington another data point in its case for coordinated pressure on the IRGC.

What Comes Next

• Retaliation: French officials have promised a response, though they have not specified whether it will be diplomatic, economic, cyber or legal in nature.
• Arrest warrants: Warrants have reportedly been issued for suspected operatives, a largely symbolic move that nonetheless formalizes Paris's attribution.
• Regulatory pressure: Expect scrutiny of how commercial refrigeration and building-management systems are secured, particularly devices exposed directly to the public internet.
• Insurance and liability: Retailers are likely to face questions about whether connected cooling systems met reasonable security standards — a debate that echoes earlier fights over payment-terminal and IoT security.

The Bigger Picture

The fridge attacks illustrate a widening frontier in state-sponsored cyber-operations: the targeting of civilian infrastructure that is neither classified nor obviously strategic, but whose disruption produces disproportionate economic and psychological effects. Unlike attacks on power grids, which governments treat as potential acts of war, an assault on supermarket cooling systems sits in a legal and strategic gray zone.

For France, the accusation is also a domestic message — a signal to voters and retailers that the government is treating cyber-defense as core national security rather than a technical afterthought. For Iran, if the attribution holds, the operation represents a low-cost way to remind Europe that its commercial infrastructure is reachable. And for the rest of the world's grocers, the lesson is uncomfortably literal: the internet of things has reached the freezer aisle, and so have the people who want to turn it off.