What happened
During the night of October 11–12, 2026, attackers compromised industrial refrigeration controllers in France and changed defrost settings to high temperatures. CERT-FR says the October 11–12 sabotage altered defrost parameters at about 700 French retail sites, caused at least 15 fires and produced major inventory losses. The same report names Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché among affected retailers and notes moderate effects on Schneider Electric equipment at small hydroelectric installations.
On October 13, 2026, CyberbanNews amplified the refrigeration attack, according to CERT-FR. CERT-FR cites Modbus on TCP port 502 reconnaissance, use of the FOFA scanner, CyberbanNews amplification on October 13 and Farsi traces in attack infrastructure as attribution evidence. On November 9, 2026, France formally attributed the October sabotage to Shahid Kaveh and announced diplomatic and sanctions action. France described it as the country’s first cyber-offensive campaign conducted purely for sabotage on national territory.
On November 5, 2026, US government partners issued global hardening guidance for industrial refrigeration and cold-chain systems. The US government advisory identifies authentication bypass, arbitrary code injection and weak configurations as attack paths against refrigeration controllers. No device-specific malicious IP addresses, domains, hashes or controller logs were published in the cited French attribution report. Attribution posture: France attributes the October 11–12 sabotage to Iran’s Shahid Kaveh unit, while the separate November attacks remain unattributed. The cited source did not publish the specific operational detail described as Confirmed initial access vector.
Why this matters now
The material change is authoritative attribution of physical sabotage, not a new claim that refrigeration systems are exposed. France now describes a state-linked campaign that changed control parameters, caused fires and damaged inventory. That raises the executive consequence from ordinary IoT hygiene to safety, continuity and geopolitical risk, particularly where environmental controls are remotely administered or use unsupported equipment.
The affected operating model extends beyond supermarkets. Cold storage, healthcare, food processing, refrigerated transport and small energy facilities all depend on controllers whose cyber failure can alter physical conditions or remove operator visibility. Security teams cannot close this risk with a network scan alone; operations must define safe setpoint ranges, local override procedures, isolation boundaries and tested manual monitoring when remote control becomes unavailable.
The decision for security leaders
Assign the OT security leader and operational owner to produce one exposure inventory covering refrigeration controllers, cold-chain monitoring, building-management links, remote support paths and end-of-life equipment. The inventory must distinguish internet reachability, vendor remote access and internal business-network access because each demands a different containment method and operational approval.
Require engineering and operations to demonstrate that unsafe parameter changes generate independent alerts and cannot silently persist. Remote access that remains necessary should be placed behind updated security controls, limited by device and IP allowlists, logged, reviewed and supported by tested local procedures. Where equipment cannot support those controls, leadership should approve a time-bound replacement or isolation exception.
Evidence of closure
- External scanning shows no public controller administration interfaces.
- Network diagrams show dedicated OT segmentation for environmental controllers.
- Setpoint testing proves unsafe changes generate independent alerts.
- Continuity testing proves temperatures remain monitored during remote-management loss.
The Security.io assessment
The French attribution is unusually authoritative: it combines an interministerial technical assessment, a foreign-ministry statement and a documented physical-impact record. The cited sources did not establish the initial access vector used against the French refrigeration controllers. Default credentials, vulnerable firmware and exposed interfaces remain plausible risk mechanisms described in guidance, not established facts for every compromised device.
Unit 42 counted 1,853 internet-exposed devices in France during October 1–15, 558 during October 16–31 and 316 during November 1–6; those observations measure exposure, not vulnerability or compromise. The decline indicates remediation activity but does not prove closure. Security.io would raise concern further if subsequent attacks are attributed to the same unit, if new sectors report physical effects, or if authorities publish evidence of continued access after isolation work.
Questions for the morning meeting
- Which refrigeration, cold-chain or environmental controllers remain reachable from the public internet?
- Can operations maintain safe temperatures if controller visibility or remote management is lost?
- Who can authorise rapid isolation without creating a food, medical or transport safety failure?