Tag: France

  • France’s 700-Store Fridge Attack Makes Cooling Controls an AI Data Center Security Issue

    France’s 700-Store Fridge Attack Makes Cooling Controls an AI Data Center Security Issue

    TL;DR · 30-second read

    The Short Version

    Last month, hackers took remote control of the refrigerators in about 700 French supermarkets and pushed them to 50 degrees Celsius, about 122 Fahrenheit and hotter than a heatwave, for about six hours. Stores threw away their fresh and frozen food. One chain said it lost tens of millions of euros in a single day.

    France now says a hacking unit tied to Iran’s Revolutionary Guard, a branch of Iran’s armed forces, was responsible.

    Why it matters beyond groceries: the huge computer buildings that power artificial intelligence also rely on software-controlled cooling. If the cooling fails, the computers have to slow down or shut off.

    France on Monday formally blamed Iran for the Oct. 12 cyberattack that sent refrigeration temperatures soaring in about 700 of the country’s 10,000 supermarkets, the Associated Press reported. Paris prosecutors said Iran’s Islamic Revolutionary Guard Corps (IRGC) was behind the attack. France’s national cybersecurity agency, ANSSI, attributed it to the Shahid Kaveh group, which it describes as an IRGC-affiliated cyber unit. Foreign Minister Jean-Noël Barrot summoned the Iranian ambassador and said France would seek European Union sanctions against those responsible.

    In the attack, intruders remotely took control of refrigeration systems overnight. Temperatures reached 50°C (122°F) for about six hours, and stores had to discard fresh and frozen goods. The Intermarché chain reported losses of “tens of millions of euros” in one day. Prosecutor Laure Beccuau has opened a formal judicial investigation and is seeking international arrest warrants for the group’s leader, his two deputies and anyone else identified.

    Executive Summary

    France has, for the first time, attributed a large-scale sabotage attack on its soil to a foreign state’s military-linked cyber unit. Barrot called it “an attack of unprecedented scale and aggressiveness” and “the first large-scale cyberattack aimed at sabotage on French soil.” The response combines diplomacy (summoning the ambassador), economic pressure (EU sanctions) and criminal law (a judicial investigation into organized cybercrime committed “to serve the interests of a foreign power”).

    For infrastructure operators, the attack vector matters as much as the attribution. The target was not data, payment systems or email. It was refrigeration controls, the operational technology (OT) that runs physical equipment, and the attackers used it to destroy inventory at about 7% of France’s supermarkets at once. Within weeks, a separate attempt to overheat French blood banks was stopped, and supermarkets in five other European countries reported fridge and freezer failures that apparently came from cyberattacks.

    Cooling is the one system every data center cannot run without, and AI facilities, with their densely packed, high-heat hardware, depend on it more than most. The French case shows that a state-linked actor has chosen remote cooling controls as a sabotage target and succeeded at scale. That moves cooling-system security out of the facilities budget and into the core security model for data center operators and their tenants.

    Sabotage, Not Ransom: What Changed on October 12

    Most cyberattacks on businesses are about money or information: ransomware that locks files until a payment is made, or theft of customer data. The October 12 attack did neither. The intruders took over refrigeration controllers and drove temperatures up until the stock was ruined. That is sabotage with a physical result, and it is why the French government is treating it as a matter of national security rather than as a criminal incident.

    The scale is the key detail. About 700 stores, roughly one in fourteen French supermarkets, were affected during the same overnight window. Coordinated control across hundreds of sites suggests that the attackers had access to systems that are managed remotely and in bulk, not to a single poorly secured shop. French authorities have not said publicly how that access was obtained. The losses at Intermarché alone ran to “tens of millions of euros” in a day, which shows how quickly a cooling failure turns into a balance-sheet event.

    The follow-on incidents should be read with care. The blood-bank attempt in France was thwarted and is under investigation. The fridge and freezer failures in Sweden, Belgium, Luxembourg, Ireland and Estonia apparently came from cyberattacks, but they have not been publicly attributed to the same group. Together they describe a cluster of attacks on cooling systems in a short period. They do not yet establish a single coordinated campaign, and nobody should present them as one until investigators do.

    Why Cooling Controls Belong in the AI Data Center Threat Model

    The case for the headline rests on one mechanism: in October, attackers reached the software layer that tells cooling equipment what to do, and they used it to cause physical damage at scale. Data centers depend on the same category of system. Chillers, pumps, air handlers and the liquid-cooling loops that are increasingly common in AI deployments are all governed by controllers and building management systems. These are often networked, and they are often reachable by vendors for remote monitoring and maintenance. No data center was reported as affected, and nothing public indicates that the same products were involved. The lesson concerns the class of system, not a specific vulnerability.

    The consequences would also differ in kind. A supermarket cold room that hits 50°C loses its stock over hours. An AI data hall packs far more heat into each rack than a conventional server room, so its margin after cooling stops is much shorter. A sustained cooling failure forces hardware to throttle or shut down. For an operator selling capacity under service-level agreements, that means outages, penalties and possible damage to accelerators that are expensive and slow to replace.

    Responsibility for these risks is split across several groups. Operators often treat cooling controls as a facilities matter, owned by engineering teams and vendors rather than security staff. Cooling equipment suppliers and their remote-service channels sit inside the trust boundary. Colocation and AI-cloud tenants usually have little visibility into either. The French attack is a concrete case for closing that gap: map every remote path into cooling controls, separate those networks from internet-facing systems, add temperature alarms that do not depend on the controller that might be compromised, and rehearse manual fallback.

    Attribution, Sanctions and Deterrence

    France’s attribution rests on ANSSI’s analysis, and the prosecutor cited specific indicators: the attackers’ use of Farsi and IP addresses linked to devices in Iran. Language and network origin can be spoofed or routed through other machines, which is why government attributions usually draw on wider intelligence that is not published. ANSSI’s full technical case is not public. Even so, a formal attribution backed by a judicial investigation, named targets and international arrest warrants is a significant step, and it builds on ANSSI’s earlier attribution of attacks against Charlie Hebdo in 2023 and the Paris Olympics organization in 2024 to a separate IRGC-affiliated group, Shahid Shoostari.

    The response follows a familiar pattern for state-linked cyber operations: diplomatic protest, sanctions and indictments that may never lead to an arrest. Whether that deters future attacks is an open question. Barrot’s promise of “any other measures needed” leaves room for further action. For infrastructure owners, the practical conclusion is that the response to an attack does not remove the exposure. A sanctions list does not secure a chiller controller.

    The Cost Question Moves to Contracts and Coverage

    An attack that destroys physical goods, has a cost measured in tens of millions of euros for one retailer, and is formally attributed to a state’s armed forces raises questions that insurers, lenders and customers will ask of every operator that runs cooling-dependent infrastructure. These include how cyber and business-interruption policies treat sabotage attributed to a state, what uptime commitments say about cooling-control compromise, and who carries the loss when a vendor’s remote-access channel is the way in.

    For AI infrastructure, where a single facility can hold a large stock of costly accelerators, these are underwriting and contract questions, not abstract ones. Operators that can document how their cooling controls are segmented, monitored and backed up will be better placed in those negotiations than operators that cannot.

    Background

    Iran’s Islamic Revolutionary Guard Corps is a branch of the country’s armed forces with its own intelligence and cyber capabilities. France’s national cybersecurity agency, ANSSI, has attributed several attacks on French targets since 2020 to IRGC-affiliated groups, including attacks on the satirical newspaper Charlie Hebdo in 2023 and on the organization of the Paris 2024 Olympic Games. The October refrigeration attack is the first that French officials have described as large-scale sabotage on French soil.

    Commercial refrigeration and data center cooling both rely on networked controllers that set temperatures, run compressors and pumps, and raise alarms. Operators and equipment vendors often monitor and maintain these controllers remotely. That connectivity makes large estates efficient to run, but it also gives attackers a route to cause physical harm from a distance. The risk grows as AI deployments concentrate more heat, and more costly hardware, in each data hall.

    Sources

    Source: France blames Iran for a cyberattack that heated supermarket refrigerators (AP News): France attributes the Oct. 12 refrigeration sabotage of about 700 supermarkets to an IRGC-affiliated cyber unit and seeks EU sanctions.

  • SoftBank’s 5 GW France Plan Makes Grid Access the First Test of AI Buildout

    SoftBank’s 5 GW France Plan Makes Grid Access the First Test of AI Buildout

    TL;DR · 30-second read

    The Short Version

    SoftBank, the Japanese investment giant, is backing a plan to build huge computer centers for artificial intelligence in France. At full size, they could draw about as much electricity as five large nuclear reactors produce.

    Running flat out all year, they would use roughly a tenth of the electricity France consumes today.

    The hard part is not announcing a plan this big. It is securing the power lines, the land and the lenders needed to make it real.

    White & Case said in an announcement published June 4, 2026, that it advised SoftBank Group on an investment to build 5 gigawatts (GW) of AI data center capacity in France. A gigawatt is 1,000 megawatts, roughly the output of one large nuclear reactor.

    Executive Summary

    SoftBank Group, the Japanese technology investor, is putting capital behind 5 GW of AI data center capacity in France. That scale ranks the plan among the largest AI data center plans in Europe and makes it a significant test of how much AI computing the country can host.

    The number matters because data center capacity is measured by the electricity a facility can draw. A 5 GW target is therefore also a claim on high-voltage connections, substations and suitable land, as well as on the capital needed to pay for them.

    The central question is whether grid access, sites and financing can support that scale on a workable timetable. Power comes first because the other two depend on it heavily: a site without a firm connection has limited value, and a project without secured power is harder to finance.

    Why Grid Access Comes First

    Simple arithmetic shows the size of the task. If 5 GW ran at full power for all 8,760 hours in a year, it would consume about 43.8 terawatt-hours of electricity. A terawatt-hour is a billion kilowatt-hours, the unit on a household bill scaled up. France consumes roughly 450 terawatt-hours a year, so the theoretical maximum equals about a tenth of national demand. Real use would be lower because data centers do not run at full load all the time, but the comparison shows why this is a national-scale grid question and not just a local planning matter.

    France starts from a stronger position than many European markets. Its nuclear-heavy power system produces largely low-carbon electricity, and the country has been a substantial net exporter of power in recent years. But national supply does not guarantee delivery to a specific site. Electricity has to reach each campus through transmission lines and substations, and that connection work must be studied, approved and built. RTE, the French transmission operator, and the equipment supply chain behind it are therefore central to any schedule.

    That sequence is the practical reason grid access is the first test. Developers can buy land and order servers, but a facility cannot serve AI workloads at scale until the power arrives. For a plan of this size, the pace at which firm grid capacity becomes available could set the pace of the buildout, and that affects suppliers, future tenants and investors alike.

    Sites and Financing Follow the Power

    Sites at this scale have to satisfy several requirements at once: proximity to high-voltage infrastructure, enough land, a workable cooling approach, fiber connections and local planning approval. Five gigawatts could be one very large campus or a portfolio spread across several locations, and the choice has real consequences. Concentration can bring economies of scale but places a heavy load on one part of the grid. Dispersal spreads that load but multiplies the permits and construction programs to be managed.

    Financing is closely tied to those decisions. Lenders to large infrastructure projects generally look for evidence that the main risks are under control, including secured land, permits, a dated power connection and creditworthy customers. AI data centers add a further variable because the chips inside them can become outdated much faster than the buildings and electrical systems around them. Each of these milestones can improve a project’s access to capital, which is why a capacity figure alone says limited things about how financeable a plan is.

    A plan of this size would normally be expected to arrive in phases, not as a single delivery. For anyone assessing it, the useful measures will be energized capacity, signed customers and financing closed for each stage. Those figures show progress in a way a headline total cannot.

    What the Plan Means for France and Its Neighbors

    If built at or near full scale, the plan could create substantial demand for transformers, switchgear, cooling systems, construction labor and fiber. It could also give European companies more AI computing capacity closer to home, which can matter for latency, meaning the delay in moving data, and for customers with data-location requirements. Some buyers may also weigh the fact that the backer is a non-European investor, though the implications would depend on how the facilities are owned and operated.

    The risks are also clear. Large new loads compete with other electricity users, including industry and electrified transport, for grid connections and network upgrades. Local communities may raise questions about land use, water and cooling. And like every AI buildout, this one depends on demand for computing remaining strong enough to fill the capacity once it is complete. None of these issues undercuts the plan on its own, but each will shape how much of the 5 GW is delivered and when.

    Background

    SoftBank Group is a Japanese technology investor known for its Vision Fund and, more recently, for its role in large-scale AI infrastructure, including the Stargate venture in the United States with OpenAI and Oracle. Its French investment extends that infrastructure focus into Europe.

    France has actively sought AI investment, including through the AI Action Summit it hosted in Paris in February 2025. Its main selling point for energy-intensive computing is a nuclear-heavy electricity system with a large supply of low-carbon power, although individual projects still need local grid connections, suitable land and permits.

    Sources

    Source: White & Case advises SoftBank Group on investment to build 5GW of AI data center capacity in France, White & Case LLP’s announcement of its advisory role on the investment.

  • SoftBank’s 3.1GW France Phase Shows Gigawatt AI Is a Factory Problem

    SoftBank’s 3.1GW France Phase Shows Gigawatt AI Is a Factory Problem

    TL;DR · 30-second read

    The Short Version

    SoftBank, the Japanese investor behind many of the world’s biggest artificial intelligence bets, plans to spend up to 75 billion euros on computer warehouses for artificial intelligence in northern France.

    At full size they would use about as much electricity as five large nuclear reactors produce. The first stage is due by 2031.

    The surprise: SoftBank and a French electrical company will also build factories at the port of Dunkirk to make the buildings’ metal housings and power equipment. At this scale, producing the equipment fast enough is part of the challenge, not just finding the electricity.

    SoftBank plans to develop and operate up to 5 gigawatts (GW) of AI data center capacity in France, with an investment of up to €75 billion ($87.5bn), Data Center Dynamics reported on May 30, 2026. The first phase, costing an initial €45 billion ($52.5bn), aims to deliver 3.1GW in the Hauts-de-France region by 2031, with initial campuses planned at Dunkirk (Loon-Plage), Bosquel and Bouchain.

    State-owned utility EDF is partnering on the project and providing the site of a former power plant at Bouchain. Separately, SoftBank will work with Schneider Electric on an industrial production cluster at the Port of Dunkirk: a SoftBank-operated plant making data center enclosures and a Schneider site integrating data center power modules. Financial terms of the Schneider partnership were not disclosed.

    Executive Summary

    SoftBank’s France plan is one of the largest AI data center commitments announced in Europe, and French economy minister Roland Lescure described it as a first for the group in Europe. The headline figures are ceilings — up to 5GW and up to €75 billion — but the first phase carries firmer markers: 3.1GW, €45 billion, three named sites and a 2031 target date.

    The detail that matters most for the industry is not the investment total but the factory cluster at Dunkirk. SoftBank is not only buying data center capacity; it is setting up its own enclosure manufacturing and pairing it with Schneider Electric’s power-module integration next door. That signals the project’s pace is expected to depend on how fast physical equipment can be produced and installed, alongside how fast France’s grid can connect the load.

    Two open questions will decide whether the plan lands on schedule: whether gigawatt-scale grid connections in Hauts-de-France can be delivered by 2031, and how SoftBank funds this alongside its other large commitments.

    The Dunkirk Factory Is the Tell

    A data center at this scale is less a single building than an assembly of standardized parts: enclosures (the prefabricated shells that house equipment), switchgear, transformers, uninterruptible power supplies and the power modules that package them. Delivering 3.1GW across three campuses in roughly five years means installing that equipment at a volume few projects have attempted. SoftBank’s answer is to build the supply chain beside the project: its own plant to manufacture enclosures and a Schneider Electric facility to integrate power modules, both at the Port of Dunkirk, where one of the first campuses (Loon-Plage) is also planned.

    Schneider CEO Olivier Blum made the logic explicit, calling prefabricated power modules “a key lever to combine speed, scalability and energy optimization.” Prefabrication moves electrical assembly and testing from a muddy construction site into a factory, where it can be done in parallel with civil works and repeated at volume. Co-locating that production with a campus, at a port, shortens the path from assembly line to installation and could plausibly serve the inland sites at Bosquel and Bouchain as well.

    This is why the headline fits: at gigawatt scale, the bottleneck is not only megawatts from the grid but units off a production line. For equipment makers, contractors and other European developers, the implication is that the largest buyers may increasingly lock in dedicated manufacturing capacity rather than compete for it on the open market. SoftBank has not said what share of the project’s equipment the cluster will supply, so the scale of that effect remains to be seen.

    France’s Grid Pitch Meets a Gigawatt Test

    The French government is selling power as the country’s advantage. Lescure cited “fast access to the most reliable electrical grid in Europe” and a government that works with local authorities to fast-track strategic projects. France’s largely nuclear generation fleet gives it a stable, low-carbon supply base that many European markets lack, and EDF’s direct involvement puts the national utility inside the project rather than across the negotiating table.

    Generation and grid connection are different problems, though. A 3.1GW first phase is a very large new load concentrated in one region, and each campus needs high-voltage transmission capacity delivered on time. The choice of Bouchain, a former power plant site provided by EDF, is significant here: retired generation sites often come with existing high-voltage infrastructure and industrial zoning, which can shorten connection work. Neither SoftBank nor EDF has said how much grid capacity is available at any of the three sites or when it will be energized.

    The 2031 date is therefore the real test of the minister’s claim. If France can connect gigawatt-scale AI campuses on that timeline, it strengthens its case as Europe’s preferred AI infrastructure location. If connections slip, the factory cluster could end up producing equipment faster than the grid can power it.

    The Financing Question Behind the Headline Number

    “Up to €75 billion” describes a ceiling, not committed capital. The firmer figure is the €45 billion first phase, which leaves an implied 1.9GW and €30 billion for later phases with no disclosed timing or locations.

    The funding context is demanding. According to Data Center Dynamics, SoftBank carries more than $130 billion in debt and took a $40 billion bridge loan in March to fund its latest OpenAI investment. TD Cowen analysts point to further planned outlays, including $16 billion for Stargate and $9 billion for the acquisitions of ABB Robotics and DigitalBridge. SoftBank has also pitched a 10GW data center at a former nuclear enrichment site in Ohio and expects to take a robotics data center construction business, Roze AI, public at a target valuation of $100 billion.

    None of this means the France plan cannot be funded; large infrastructure is routinely financed at the project level with outside equity and debt. But SoftBank has not said how this project will be capitalized, and the scale of its concurrent commitments makes the funding structure a fair question for anyone planning around the 2031 date.

    What It Means for Europe’s AI Map

    France has spent the past year positioning itself as Europe’s AI infrastructure hub, and a commitment of this size from one of the sector’s most active investors strengthens that case. It also gives Hauts-de-France, an industrial region with port access and legacy energy sites, a central role in that strategy.

    For competing European locations, the lesson is that power availability alone is no longer the whole pitch. SoftBank’s package pairs a state utility partner, a reused power plant site and a local manufacturing base. Regions trying to win similar projects may be judged on whether they can offer all three.

    Background

    SoftBank Group, founded by Masayoshi Son, is one of the most active investors in AI infrastructure. It is a major backer of OpenAI and its Stargate data center program, has pitched a 10GW data center at a former nuclear enrichment site in Ohio, and plans to take a robotics data center construction business, Roze AI, public. Schneider Electric is a French multinational supplying power and cooling equipment to data centers, and EDF is France’s state-owned electricity company, which operates the country’s nuclear fleet.

    France has spent recent years courting AI data center investment under President Emmanuel Macron, pitching its low-carbon, nuclear-heavy electricity supply and faster permitting for strategic projects. The industrial Hauts-de-France region in the north, home to the Port of Dunkirk and several legacy energy sites, has become a focal point of that effort.

    Sources

    Source: SoftBank plans up to 5GW data center buildout in France, investment of up to €75bn — Data Center Dynamics on SoftBank’s French AI data center plan and its Dunkirk production cluster with Schneider Electric.