Nobody should be surprised that someone found a way to cook a nation’s groceries through a web login page. The surprise is that it took this long. France has now formally blamed Iran for hacks that cranked up temperatures on industrial freezers across the country and elsewhere in Europe.
According to TechCrunch, two waves of attacks in October and early November hit web-based controllers that manage fleets of cold and chilling units at supermarkets and retailers. The hackers broke in remotely and raised temperatures to spoil food. Blood banks were also targeted, though the French Blood Establishment says the attacks were stopped before any blood was lost.
Foreign minister Jean-Noël Barrot said responsibility lies with the Islamic Revolutionary Guard Corps. He called it the first large-scale act of sabotage on French soil and promised consequences. Paris has summoned Iran’s ambassador, plans European-wide sanctions, and has handed the matter to the justice system. Iran’s consulate in New York has not responded to requests for comment.
Here is the part that matters for anyone who cares about security. Researchers warn these controllers are vulnerable to remote hacks, and some affected models from Danish maker Danfoss no longer get security fixes. That means a known weakness, an internet-facing device, and no patch coming. Operators were left holding hardware that vendors had effectively abandoned, yet it was still wired to the public internet.
Note the attribution too. Governments are quick to name a culprit, but the public evidence is thin so far. The U.S. government has linked similar attacks to pro-Iranian hacktivists working for Tehran, likely in retaliation for the U.S. and Israel-led war that killed Iran’s supreme leader in February. Hacktivist branding gives states deniability. It also muddies who is accountable when things break.
This fits a pattern. This year Iran-linked actors have gone after U.S. water providers and caused mass disruption at medical device maker Stryker. The U.S. is reportedly checking whether freezers on military bases were hit, and officials have reportedly tied the freezer attacks to Iran, though the intelligence community has made no formal public attribution.
What does this mean for ordinary people? Your privacy and your safety share the same weak point: cheap, connected equipment that nobody maintains. A controller with a default login and no updates is a gift to any attacker, whether they want your data or your dinner. Vendors sell remote management as convenience, but end-of-support dates rarely come with a warning label, and buyers rarely get a say.
Sanctions will not patch a single device. If Europe wants this to stop, regulators should force vendors to disclose support timelines and push operators to pull critical systems off the open internet. Otherwise the next target will be just as easy to find.