Hacked supermarket fridges: Belgian government split over the Iran lead

On November 12, two Belgian ministers delivered two different messages. Interior Minister Bernard Quintin told the Belga news agency that security services see signs of “possible links to known Iranian actors” behind the cyberattacks on refrigeration systems in the country's supermarkets. “Iran attacked France and perhaps Belgium too,” he added, according to VRT. In a written response, his colleague Foreign Minister Maxime Prévot argued the opposite: the available data is not enough to officially hold Iran responsible. The federal prosecutor's office, which is investigating, could not confirm the interior minister's remarks.

In Belgium, many stores had to throw away tens of thousands of euros' worth of food, and the Delhaize in Boortmeerbeek emptied its fridges in early November. France, for its part, took the step on November 9: it attributes the attack on its supermarkets to a unit of Iran's Revolutionary Guards.

What Paris blames on the Iranian unit Shahid Kaveh

On the night of October 11 to 12, the refrigeration controllers at about 700 French retail sites were targeted. According to franceinfo, the attackers reached Danfoss controllers, then Dixell and Copeland ones. According to the Paris prosecutor's office, they took control of them remotely through web interfaces, launched defrost cycles with no time limit and disabled the temperature sensor alerts. The result: major losses of goods and at least fifteen fires, according to French security services cited by AFP.

The Foreign Ministry names the Shahid Kaveh group, a cyber-offensive unit attached to the Revolutionary Guards' Electronic and Cyber Center. “This is an attack of unprecedented scale and unprecedented aggressiveness,” said Minister Jean-Noël Barrot, who is calling for EU sanctions. Iran's ambassador was summoned to the Quai d'Orsay (the French foreign ministry) on November 10. The Paris prosecutor's office opened a judicial investigation targeting the unit's head and two of his deputies, notably for organized-group attacks on computer systems on behalf of a foreign power, and requested international arrest warrants. The investigation has been handed to the Office anti-cybercriminalité (the French anti-cybercrime office) and the DGSI (France's domestic intelligence service).

What does the accusation rest on? Paris prosecutor Laure Beccuau cites the use of Farsi and IP addresses pointing to devices located in Iran. Next details other clues: the use of the FOFA scanning tool, part of the unit's toolkit; mass reconnaissance in April 2026 over Modbus, an industrial protocol with no authentication or encryption; and the publicizing of the attack on October 13 by CyberbanNews, an outlet associated with the unit. On November 10, Iran's Foreign Ministry “categorically” rejected France's “baseless accusations.”

Elsewhere in Europe, no culprit named

In early November, at least eleven European countries experienced similar incidents, according to AFP, with no attribution so far. In Switzerland, a butcher in Köniz, near Bern, told SRF he found his freezer at 50 to 70 degrees, and three Volg stores noticed altered settings. In France, ANSSI (France's national cybersecurity agency) director general Vincent Strubel notes that the attack on the cold rooms of the Établissement français du sang (the French blood establishment) follows a similar modus operandi, though nothing allows him to say it is the same attacker.

Bernard Quintin asked the Foreign Ministry to back the French request for EU sanctions, and the Defense Ministry to study military intelligence countermeasures.

What operators of refrigeration equipment can do

Whoever is behind it, French and Swiss authorities point to the same way in: control interfaces reachable from the internet. ANSSI had already noted that basic security weaknesses had been exploited, including equipment exposed directly to the internet and weak passwords. The Swiss platform Cybercrimepolice.ch recommends in particular to:

• secure remote access to refrigeration controllers and install their security updates;
• place these controls on a separate network;
• monitor temperatures with a measuring device independent of the system being controlled;
• report any suspicious tampering to the police.

It remains to be seen whether the EU's Twenty-Seven will follow Paris on sanctions, and whether Belgium will name a culprit once its federal prosecutor's investigation is complete.