OT / ICS Security

Attacks on refrigeration systems: France points to Iran, CISA and FBI warn after second wave in Europe

On November 9, 2026, the Paris Prosecutor’s Office and ANSSI attributed the October attack on refrigeration systems at approximately 700 French supermarkets to a group linked to Iran’s Revolutionary Guard Corps (IRGC). Simultaneously, CISA, the FBI, and three other U.S. agencies called for the securing of refrigeration controllers.

What happened

According to the Associated Press, the Paris Prosecutor’s Office determined that the Islamic Revolutionary Guard Corps (IRGC) was behind the October 12 attack, launching an investigation into organized cybercrime committed in the interest of a foreign power. ANSSI identified the Shahid Kaveh group, described as a cyber unit linked to the IRGC. Investigators found that attackers used Farsi and IP addresses associated with devices in Iran; prosecutors are seeking international arrest warrants.

The October attack remotely compromised refrigeration systems in approximately 700 of 10,000 French supermarkets. Temperatures reached 50°C for roughly six hours, with the Intermarché chain estimating losses at “tens of millions of euros” in a single day. Since November 2, similar incidents have been reported by retailers in Belgium, Sweden, Ireland, Estonia, the Netherlands, and Portugal. The perpetrators of this second wave have not been identified.

CISA, FBI, HHS, USDA, and DOT issued joint recommendations for industrial refrigeration and cold chain monitoring systems. They cite Danfoss StoreView and Copeland/Dixell XWEB, highlighting risks: authentication bypass, code injection, poor configuration, and internet-exposed controllers. Attackers can force continuous heating and defrosting, risking fire, inventory loss, and food safety hazards. According to Censys data cited by The Hacker News, the number of internet-visible StoreView installations dropped from 3,004 to 708 between October 9 and November 5, while XWEB dropped from 3,708 to 2,420.

Key findings

  • October 12 attack: Attributed by ANSSI to IRGC-linked Shahid Kaveh; ongoing prosecutorial investigation.
  • Second wave: Since November 2 across several EU countries – perpetrators unknown; SentinelLABS considers pro-Russian groups a plausible but unconfirmed hypothesis.
  • Devices: Including Danfoss StoreView, AK-SM, and AK-SC, and Copeland/Dixell XWEB; in France, ANSSI pointed to exposed administrative interfaces and weak passwords.
  • Exposure: Over 3,000 StoreView and XWEB installations remain visible online (Censys, November 5, 2026).

Why it matters

SafeWave CommentaryAttribution changes the nature of the case: France describes sabotage in the interest of a foreign state, targeting retail rather than traditional critical infrastructure. Retail chains and logistics companies in Poland use the same controller families and remote service models. Industrial food production, processing, and wholesale distribution fall under NIS2, so these systems should be included in risk assessments. Actions: Inventory refrigeration controllers and temperature monitoring systems across all locations, including those maintained by third-party service providers; remove them from direct internet access and change default passwords; route remote technician access through controlled channels with MFA and individual accounts; replace end-of-life controllers; set alerts for sudden changes in temperature settings or defrost modes. We described the first wave in our analysis of the attack on French supermarket refrigeration systems. More in the OT / ICS Security area.