TL;DR · 30-second read
The Short Version
Last month, hackers took remote control of the refrigerators in about 700 French supermarkets and pushed them to 50 degrees Celsius, about 122 Fahrenheit and hotter than a heatwave, for about six hours. Stores threw away their fresh and frozen food. One chain said it lost tens of millions of euros in a single day.
France now says a hacking unit tied to Iran’s Revolutionary Guard, a branch of Iran’s armed forces, was responsible.
Why it matters beyond groceries: the huge computer buildings that power artificial intelligence also rely on software-controlled cooling. If the cooling fails, the computers have to slow down or shut off.
France on Monday formally blamed Iran for the Oct. 12 cyberattack that sent refrigeration temperatures soaring in about 700 of the country’s 10,000 supermarkets, the Associated Press reported. Paris prosecutors said Iran’s Islamic Revolutionary Guard Corps (IRGC) was behind the attack. France’s national cybersecurity agency, ANSSI, attributed it to the Shahid Kaveh group, which it describes as an IRGC-affiliated cyber unit. Foreign Minister Jean-Noël Barrot summoned the Iranian ambassador and said France would seek European Union sanctions against those responsible.
In the attack, intruders remotely took control of refrigeration systems overnight. Temperatures reached 50°C (122°F) for about six hours, and stores had to discard fresh and frozen goods. The Intermarché chain reported losses of “tens of millions of euros” in one day. Prosecutor Laure Beccuau has opened a formal judicial investigation and is seeking international arrest warrants for the group’s leader, his two deputies and anyone else identified.
Executive Summary
France has, for the first time, attributed a large-scale sabotage attack on its soil to a foreign state’s military-linked cyber unit. Barrot called it “an attack of unprecedented scale and aggressiveness” and “the first large-scale cyberattack aimed at sabotage on French soil.” The response combines diplomacy (summoning the ambassador), economic pressure (EU sanctions) and criminal law (a judicial investigation into organized cybercrime committed “to serve the interests of a foreign power”).
For infrastructure operators, the attack vector matters as much as the attribution. The target was not data, payment systems or email. It was refrigeration controls, the operational technology (OT) that runs physical equipment, and the attackers used it to destroy inventory at about 7% of France’s supermarkets at once. Within weeks, a separate attempt to overheat French blood banks was stopped, and supermarkets in five other European countries reported fridge and freezer failures that apparently came from cyberattacks.
Cooling is the one system every data center cannot run without, and AI facilities, with their densely packed, high-heat hardware, depend on it more than most. The French case shows that a state-linked actor has chosen remote cooling controls as a sabotage target and succeeded at scale. That moves cooling-system security out of the facilities budget and into the core security model for data center operators and their tenants.
Sabotage, Not Ransom: What Changed on October 12
Most cyberattacks on businesses are about money or information: ransomware that locks files until a payment is made, or theft of customer data. The October 12 attack did neither. The intruders took over refrigeration controllers and drove temperatures up until the stock was ruined. That is sabotage with a physical result, and it is why the French government is treating it as a matter of national security rather than as a criminal incident.
The scale is the key detail. About 700 stores, roughly one in fourteen French supermarkets, were affected during the same overnight window. Coordinated control across hundreds of sites suggests that the attackers had access to systems that are managed remotely and in bulk, not to a single poorly secured shop. French authorities have not said publicly how that access was obtained. The losses at Intermarché alone ran to “tens of millions of euros” in a day, which shows how quickly a cooling failure turns into a balance-sheet event.
The follow-on incidents should be read with care. The blood-bank attempt in France was thwarted and is under investigation. The fridge and freezer failures in Sweden, Belgium, Luxembourg, Ireland and Estonia apparently came from cyberattacks, but they have not been publicly attributed to the same group. Together they describe a cluster of attacks on cooling systems in a short period. They do not yet establish a single coordinated campaign, and nobody should present them as one until investigators do.
Why Cooling Controls Belong in the AI Data Center Threat Model
The case for the headline rests on one mechanism: in October, attackers reached the software layer that tells cooling equipment what to do, and they used it to cause physical damage at scale. Data centers depend on the same category of system. Chillers, pumps, air handlers and the liquid-cooling loops that are increasingly common in AI deployments are all governed by controllers and building management systems. These are often networked, and they are often reachable by vendors for remote monitoring and maintenance. No data center was reported as affected, and nothing public indicates that the same products were involved. The lesson concerns the class of system, not a specific vulnerability.
The consequences would also differ in kind. A supermarket cold room that hits 50°C loses its stock over hours. An AI data hall packs far more heat into each rack than a conventional server room, so its margin after cooling stops is much shorter. A sustained cooling failure forces hardware to throttle or shut down. For an operator selling capacity under service-level agreements, that means outages, penalties and possible damage to accelerators that are expensive and slow to replace.
Responsibility for these risks is split across several groups. Operators often treat cooling controls as a facilities matter, owned by engineering teams and vendors rather than security staff. Cooling equipment suppliers and their remote-service channels sit inside the trust boundary. Colocation and AI-cloud tenants usually have little visibility into either. The French attack is a concrete case for closing that gap: map every remote path into cooling controls, separate those networks from internet-facing systems, add temperature alarms that do not depend on the controller that might be compromised, and rehearse manual fallback.
Attribution, Sanctions and Deterrence
France’s attribution rests on ANSSI’s analysis, and the prosecutor cited specific indicators: the attackers’ use of Farsi and IP addresses linked to devices in Iran. Language and network origin can be spoofed or routed through other machines, which is why government attributions usually draw on wider intelligence that is not published. ANSSI’s full technical case is not public. Even so, a formal attribution backed by a judicial investigation, named targets and international arrest warrants is a significant step, and it builds on ANSSI’s earlier attribution of attacks against Charlie Hebdo in 2023 and the Paris Olympics organization in 2024 to a separate IRGC-affiliated group, Shahid Shoostari.
The response follows a familiar pattern for state-linked cyber operations: diplomatic protest, sanctions and indictments that may never lead to an arrest. Whether that deters future attacks is an open question. Barrot’s promise of “any other measures needed” leaves room for further action. For infrastructure owners, the practical conclusion is that the response to an attack does not remove the exposure. A sanctions list does not secure a chiller controller.
The Cost Question Moves to Contracts and Coverage
An attack that destroys physical goods, has a cost measured in tens of millions of euros for one retailer, and is formally attributed to a state’s armed forces raises questions that insurers, lenders and customers will ask of every operator that runs cooling-dependent infrastructure. These include how cyber and business-interruption policies treat sabotage attributed to a state, what uptime commitments say about cooling-control compromise, and who carries the loss when a vendor’s remote-access channel is the way in.
For AI infrastructure, where a single facility can hold a large stock of costly accelerators, these are underwriting and contract questions, not abstract ones. Operators that can document how their cooling controls are segmented, monitored and backed up will be better placed in those negotiations than operators that cannot.
Background
Iran’s Islamic Revolutionary Guard Corps is a branch of the country’s armed forces with its own intelligence and cyber capabilities. France’s national cybersecurity agency, ANSSI, has attributed several attacks on French targets since 2020 to IRGC-affiliated groups, including attacks on the satirical newspaper Charlie Hebdo in 2023 and on the organization of the Paris 2024 Olympic Games. The October refrigeration attack is the first that French officials have described as large-scale sabotage on French soil.
Commercial refrigeration and data center cooling both rely on networked controllers that set temperatures, run compressors and pumps, and raise alarms. Operators and equipment vendors often monitor and maintain these controllers remotely. That connectivity makes large estates efficient to run, but it also gives attackers a route to cause physical harm from a distance. The risk grows as AI deployments concentrate more heat, and more costly hardware, in each data hall. Source: France blames Iran for a cyberattack that heated supermarket refrigerators (AP News): France attributes the Oct. 12 refrigeration sabotage of about 700 supermarkets to an IRGC-affiliated cyber unit and seeks EU sanctions.Sources