France Blames Iranian Revolutionary Guard for Sabotage on Commercial Freezers and Blood Banks

The French government has formally accused Iran of conducting a coordinated cyber sabotage campaign that compromised thousands of internet-connected commercial refrigeration and freezer units across the country and parts of Europe.

French Foreign Minister Jean-Noël Barrot confirmed the attribution during remarks to reporters in Paris on Monday, naming the Islamic Revolutionary Guard Corps (IRGC)—the paramilitary wing of Iran's armed forces—as the perpetrator. Barrot characterized the campaign as an aggressive and unprecedented act of physical sabotage on French territory, stating that it represented a direct assault on national interests and citizen security. French authorities have summoned Iran's ambassador, referred the case to the national judicial system, and announced plans to pursue European Union-wide sanctions against those responsible.

The attribution was first reported by Reuters ahead of Barrot's official briefing and detailed by TechCrunch (https://techcrunch.com/2026/11/09/france-blames-iran-for-mass-hacks-targeting-freezers-in-grocery-stores-and-blood-banks/). According to French officials, the intrusions occurred in two waves throughout October and into November. Intruders remotely gained unauthorized access to web-based supervisory controllers that govern industrial cold chains at retail supermarkets and grocery stores, altering temperature configurations to trigger defrost cycles and spoil perishable goods. Medical blood banks overseen by the French Blood Establishment were also breached during the campaign, though agency officials confirmed the intrusions were contained before any stored blood was ruined.

The attacks highlight ongoing operational vulnerabilities in internet-connected industrial control systems. Threat actors targeted web management interfaces commonly used by facility managers to regulate commercial chillers. Security researchers have previously warned that many such interfaces remain exposed to the open internet without sufficient isolation. In research published in August, industrial cybersecurity firm Claroty demonstrated that supervisory controllers—including Danfoss AK-SM 800A and Copeland XWEB systems—contained critical vulnerabilities that allow remote manipulation of compressors and defrost cycles. Some affected legacy Danfoss units deployed across Europe no longer receive active software security maintenance, complicating efforts to patch the fleet against unauthorized access.

The French findings follow parallel investigations into industrial refrigeration disruptions in the United States. In late August, at least six Defense Commissary Agency supermarkets located on U.S. military bases experienced sudden overnight freezer failures, with units reversing into defrost modes and spoiling stock. While Pentagon investigative units—including the Defense Criminal Investigative Service, Army CID, and the Air Force Office of Special Investigations—have examined suspected Iranian ties, the U.S. intelligence community has not publicly made a formal attribution for the commissary outages.

The European campaign represents an escalation in physical disruption attributed to Iranian-aligned cyber operations this year. U.S. authorities have linked Tehran-backed groups to digital attacks on municipal water utility controllers and disruptive intrusions affecting medical equipment manufacturer Stryker. Representatives for Iran's diplomatic mission in New York did not immediately respond to requests for comment regarding the French government's findings. French and European regulators are now assessing mandatory operational security baselines for connected refrigeration assets as diplomatic sanctions proceed through EU channels.