Cyber-attacks on supermarket refrigeration systems: CyCERT warning to Cypriot businesses
Hackers linked to Iran struck approximately 700 supermarkets in France by disrupting refrigeration systems. Cyprus's Digital Security Authority has called on companies to strengthen their defences immediately.
Hackers paralysed supermarket refrigeration systems across nine countries — Cyprus at the centre of European concern
On 12 October, hackers launched a coordinated cyber-attack on approximately 700 supermarket outlets in France, gaining remote access to refrigeration control systems and activating defrost functions during the night. This is reported by Philenews, citing statements from senior Cypriot officials.
The result was the overheating of refrigerators and freezers, the destruction of large quantities of foodstuffs — meat, ice cream and other perishable products ended up in massive bins — and, in some cases, the outbreak of fires. A French supermarket owner estimated that the financial cost could reach tens of millions of euros at national level. The company managing many of the affected units reported that several of the systems were running on outdated or obsolete software, a fact that may have facilitated the attackers' entry.
New wave of attacks across nine countries
On 2 November 2026, a new wave of similar incidents was recorded in at least nine European countries: Belgium, Sweden, the Netherlands, Estonia, Ireland, Finland, Luxembourg, Portugal and Italy. In Sweden, a store manager in Stockholm told Reuters that freezers reached 50 degrees Celsius, resulting in the total destruction of supplies.
Among the targets were refrigeration units used by French blood banks; workers were forced to transfer part of their supplies to other cold storage facilities. The same report mentioned targeting of equipment at small hydroelectric installations in France, extending the threat beyond the food sector.
CyCERT calls on Cypriot businesses to strengthen defences
On 7 November, the Digital Security Authority (CyCERT) issued a notice addressed to all companies in the Republic of Cyprus. The Authority warned that an evolving cyber-attack campaign is targeting Operational Technology and Industrial Control Systems (OT/ICS) in European Union member states. The notice clarified that it is preventative in nature and does not confirm a corresponding incident in Cyprus.
CyCERT noted that the attackers appear to have exploited legitimate operations of control systems that were accessible from the internet and protected with default or weak credentials. Given that corresponding automation, telemetry and control infrastructure (SCADA, BMS, PLC) is used in the country, the Authority called on "all critical and important entities" to proceed immediately with inspection and fortification.
The specific measures recommended by CyCERT:
- Restricting remote access exclusively via VPN and with multi-factor authentication (MFA)
- Changing default or weak access passwords
- Updating software and firmware of systems
- Separating IT and OT networks
- Continuous monitoring of operations and temperatures, with an active incident response plan
Commissioner for Communications Marios Pieris emphasised that the protection of critical digital and industrial infrastructure is "a collective responsibility and a fundamental pillar of the country's cyber-resilience". The director of the Deputy Ministry for Research, Innovation and Digital Policy, Marios Tziapouris, provided technical analysis as part of the same statement.
France: attribution of responsibility to Iran's Shahid Kaveh unit
On 9 November, French authorities attributed the October attack to the Shahid Kaveh cyber-operations unit, which they link to Iran's Islamic Revolutionary Guard Corps. French intelligence and cyber-security services reported that they identified common elements between the digital infrastructure used in the attacks and previous operations by the same group.
Among the findings were the use of specialised tools for detecting industrial systems, references to internet networks connected to the group, and traces of Persian language in the code. The French government described the attack as "unprecedented in its scale and aggressiveness", according to an official statement, and announced that it would pursue the imposition of new European sanctions against Iranian individuals and organisations.
The attribution of responsibility concerns specifically the October attacks in France; it has not been confirmed that the same group is responsible for the incidents recorded in the other eight European countries in November.
The "72-hour kit" and the fragility of daily life
Cyber-attacks are no longer limited to data theft or electronic fraud; they can directly strike basic infrastructure that has been taken for granted for decades, Philenews notes. CyCERT assured that it is closely monitoring developments and is in contact with national and European authorities for assessing the threat, exchanging information and strengthening the protection of infrastructure and businesses in the country.
Source: Philenews