Level 1 — Absolute Beginner

A supermarket has big fridges. The fridges keep food cold. Cold food stays safe to eat. Warm food becomes bad very fast. So the fridges are very important.

Modern fridges in shops are connected to the internet. A computer controls the temperature. This is useful. A worker can check the fridges from far away. But it is also a danger. Bad people can try to enter the computer too.

In October, someone did this in France. They entered the fridge computers at about 700 shops. They made the fridges warm. They also turned off the warning alarms. So nobody knew there was a problem.

A lot of food went bad. About twenty fires started. The government of France says a group from Iran did it. France is angry. It called the ambassador of Iran to come and talk. Iran has not answered yet.

fridge

A machine that keeps food cold so it stays fresh.

temperature

How hot or cold something is.

internet

The worldwide network that connects computers to each other.

computer

A machine that follows instructions and stores information.

alarm

A loud sound or message that warns people about a problem.

danger

The chance that something bad will happen.

government

The group of people who run a country.

ambassador

The person who represents their country inside another country.

Level 2 — Elementary

Most people never think about the machines that keep food cold, but supermarkets depend on them completely. A chilled cabinet has to hold a narrow range of temperatures all day and all night. If it rises for a few hours, meat, fish and dairy products have to be thrown away. If it rises for longer, there is a risk of illness.

To manage this, shops fit electronic controllers to their refrigeration systems. These controllers set the temperature, run the regular defrost cycles that melt ice off the cooling parts, and send an alert when something goes wrong. Many of them can be reached over the internet, which lets an engineer check a hundred shops from one office. It also means that anyone else who finds a way in can reach them too.

During the night of 11 October, someone did. French investigators say attackers reached the control systems at around 700 supermarket sites, including shops belonging to the Systeme U, Intermarche and E.Leclerc chains. They started defrost cycles with no time limit, so the machines kept heating instead of cooling, and they switched off the sensor alerts that would have warned staff. The result, according to the Paris prosecutor's office, was heavy food losses and about twenty fires.

On 9 November, French Foreign Minister Jean-Noel Barrot said the attack came from a cyber unit called Shahid Kaveh, which prosecutors link to the electronic and cyber centre of Iran's Revolutionary Guards. He described the operation as being of unprecedented scale and aggression. France has summoned Iran's ambassador and says it will ask the European Union for sanctions. Prosecutors have opened a formal inquiry naming the unit's leader, his two deputies and others not yet identified.

chilled cabinet

The open refrigerated shelving where a shop keeps cold food.

dairy

Food made from milk, such as cheese, butter and yoghurt.

controller

A small computer that manages how a machine behaves.

defrost cycle

A planned warming period that melts ice off a cooling system.

sensor

A device that measures something and reports what it finds.

investigator

Someone whose job is to find out how something happened.

prosecutor

A state lawyer who decides whether to bring criminal charges.

sanctions

Penalties that countries impose to punish another country.

Level 3 — Intermediate

Critical infrastructure is usually imagined as power stations and water treatment works, but a country's food supply rests on something far more mundane: the cold chain, the unbroken sequence of refrigerated storage and transport that keeps perishable food below a safe temperature from farm to shelf. Break any link in that chain for long enough and the food behind it becomes waste at best and a public health problem at worst. What happened in France in October is a demonstration of how exposed that chain has quietly become.

The vulnerability is a side effect of efficiency. Supermarket refrigeration is managed by electronic controllers, made by firms such as Danfoss, Dixell and Copeland, which regulate temperature, schedule the defrost cycles that clear accumulated ice from the evaporator coils, and raise alarms when readings drift outside their limits. Because a chain may operate hundreds of stores, these controllers are typically reachable through web interfaces so that a small central team can monitor everything remotely. That convenience converts a maintenance problem into an attack surface. French reporting notes that a previously disclosed authentication weakness existed in one widely used Danfoss system, the AK-SM 800A, though investigators have not established that it was the route used here, and the precise means of entry remains publicly unconfirmed.

During the night of 11 October, attackers altered cooling settings at roughly 700 supermarket sites, among them stores operated by Systeme U, Intermarche and E.Leclerc. The method was elegant in a way that should worry anyone responsible for industrial equipment. Rather than switching the refrigeration off, which would have been obvious, they initiated defrost cycles with no time limit, so the systems actively heated themselves while appearing to perform a routine function, and they disabled the sensor alerts that exist precisely to catch such a drift. The Paris prosecutor's office reports substantial food losses and around twenty fires. Officials have been careful about scope: the head of the French cybersecurity agency ANSSI, Vincent Strubel, said that similar incidents affecting French blood service sites were not attributed to the same attacker, and French authorities have warned against assuming every refrigeration failure belongs to this operation.

Attribution came on 9 November, when Foreign Minister Jean-Noel Barrot publicly blamed a unit named Shahid Kaveh, described by prosecutors as an offensive cyber unit connected to the electronic and cyber centre of Iran's Islamic Revolutionary Guard Corps. The evidence cited is circumstantial but conventional in this field: an attack pattern associated with the unit, traces of Farsi in the intrusion, and internet addresses linked to devices inside Iran. Barrot called the operation unprecedented in scale and aggression, and France has summoned Iran's ambassador and signalled that it will pursue European sanctions. The investigation, conducted by France's Anti-Cybercrime Office and the domestic intelligence service DGSI, has produced a judicial inquiry into organised computer attacks and dangerous damage, aggravated by the allegation that the perpetrators acted for a foreign power. It names the unit's leader, his two deputies and other individuals not yet identified. Iran had not publicly responded at the time of writing.

Level 4 — Advanced

Discussions of critical national infrastructure tend to gravitate towards the dramatic: generating stations, water treatment, air traffic control. The October operation against French food retail is instructive because it targeted something nobody had thought to classify as critical at all. The cold chain, meaning the continuous refrigerated custody of perishable goods from producer through distribution to retail shelf, is a piece of infrastructure in every meaningful sense, yet it is owned in fragments by commercial firms, maintained to commercial standards, and secured, as it turns out, considerably less rigorously than a water utility would be. An adversary looking for leverage over a European state found it not in the grid but in the dairy aisle.

The mechanism of exposure is worth setting out precisely, because it generalises. Supermarket refrigeration is governed by embedded controllers from vendors including Danfoss, Dixell and Copeland, which hold temperature setpoints, schedule periodic defrost intervals that clear ice from evaporator coils, and generate alarms when sensed values exceed configured bounds. A chain operating several hundred outlets cannot dispatch an engineer to each site, so these controllers expose web management interfaces reachable across the public internet. The economics are irresistible and the security consequence is structural: every efficiency gain of this kind migrates a device from an isolated mechanical context into a globally addressable one. French reporting has noted a previously disclosed authentication flaw in the Danfoss AK-SM 800A, a widely deployed unit, while cautioning that investigators have not established it as the vector in this case. The entry method, notably, remains publicly unconfirmed, which is itself a finding worth dwelling on three weeks later.

What the attackers did with that access displays an understanding of the equipment that goes well beyond opportunism. Disabling refrigeration outright would have produced an immediate, legible failure. Instead, on the night of 11 October, they commanded defrost cycles with no terminating condition at roughly 700 sites, including stores of the Systeme U, Intermarche and E.Leclerc chains, so that the systems applied heat while reporting the performance of an entirely ordinary maintenance routine, and they suppressed the sensor alarms whose sole purpose is to detect precisely that excursion. The consequence, per the Paris prosecutor's office, was extensive stock loss and approximately twenty fires. It is worth noting how carefully French officials have bounded their claims: Vincent Strubel, who heads the cybersecurity agency ANSSI, stated that comparable incidents at French blood service sites were not attributed to this actor, and authorities have discouraged the reflex of assigning every subsequent refrigeration fault to the same campaign. That restraint is unusual and deserves credit.

Formal attribution followed on 9 November, when Foreign Minister Jean-Noel Barrot named Shahid Kaveh, characterised by prosecutors as an offensive cyber unit attached to the electronic and cyber centre of Iran's Islamic Revolutionary Guard Corps. The evidentiary basis is the standard triad of this discipline, and its limitations should be understood rather than glossed: a tradecraft pattern previously associated with the unit, Farsi-language artefacts within the intrusion, and network addresses resolving to devices in Iran. None of these is individually conclusive, since patterns can be imitated, language artefacts planted and addresses proxied; together, and in the hands of the Anti-Cybercrime Office and the DGSI, they constitute the kind of case on which states routinely act without ever obtaining courtroom certainty. France has acted accordingly, summoning Iran's ambassador, declaring an intent to seek European sanctions, and opening a judicial inquiry into organised computer attacks and dangerous damage, aggravated by the allegation of service to a foreign power, which names the unit's commander, his two deputies and further unidentified persons. Barrot's description of the operation as unprecedented in scale and aggression is probably accurate as regards the civilian food supply. Tehran had issued no public response as of writing. The lasting significance lies less in the diplomacy than in the demonstration: a state-linked actor has shown that a fortnight's worth of a nation's chilled food can be destroyed remotely, without a single explosion, by instructing thermostats to do something they were designed to do.