Freezers in hundreds of major retail stores across France suddenly surged to 50°C overnight. There was no ransom note, nor were any files encrypted. Compressors stalled from severe overheating, defrost heaters ran continuously, and tonnes of fresh goods were destroyed. The financial fallout was immediate and immense; retail conglomerate Ahold Delhaize publicly forecast a revenue hit of up to €250 million and a €100 million blow to operating profits following the campaign. Similar disruptions soon spread across distribution networks in Belgium, the Netherlands, Sweden, and Germany. The threat escalated further when attackers targeted the French Blood Establishment (EFS), attempting to force cold-storage units holding transfusion and medicinal plasma from –30°C to an astonishing 110°C.
Technical inquiries by agencies including the French ANSSI and the UK NCSC exposed a sobering operational reality. The perpetrators deployed no zero-day exploits. Instead, they targeted exposed remote management interfaces originally opened for routine maintenance and telemetry. Commercial equipment providers confirmed the exposure stemmed from third-party vendor components outside their direct operational control. By interfacing directly with these field controllers, the attackers manually overrode operating thresholds and forced continuous defrost cycles across multiple sites.
The geopolitical reality of the campaign was confirmed on 9 November 2026, when French authorities—including ANSSI, military cyber command, and intelligence agencies—officially attributed the attacks to the Iranian Revolutionary Guard Corps (IRGC) cyber unit Shahid Kaveh (also known as CyberAv3ngers). With over 700 French stores impacted and at least 15 physical fires reported, French officials described the campaign as an unprecedented act of physical sabotage. Extortion was completely absent; the sole objective was disrupting critical cold chains and biomedical storage to induce societal vulnerability, bypassing IT encryption entirely to inflict direct physical destruction on operational hardware.
The critical failure point in these incidents lies within the fundamental communication structure of field-level assets. Once the attackers navigated the remote management path, every instruction delivered to the controllers complied entirely with industrial protocol specifications.
Level 1 industrial controllers inherently trust traffic arriving across established communication channels. The underlying legacy protocols lack native mechanisms to confirm whether an individual parameter change originates from an authorised engineer or an external adversary abusing exposed interfaces. Because the session is active, the controller treats high-risk write commands as routine engineering tasks.
The hardware simply executes the instruction. In these facilities, controllers activated heating elements precisely as told, burning out compressors and threatening critical stock. The incidents exposed the fatal assumption underlying current operational security: treating ingress network connectivity as an implicit grant of physical control.
Breached remote maintenance pathways and exposed field interfaces are no longer edge cases; they are operational constants. In an ecosystem reliant on outsourced service providers and distributed monitoring, expecting every remote perimeter and credential to remain permanently uncompromised is unfeasible.
When external access failure is treated as inevitable, the final viable line of defence moves to the physical boundary of the machine itself. Control commands must undergo independent verification at the Level 1 endpoint before reaching the hardware actuation layer.
This reflects the core intent of least privilege in IEC 62443 and NIST SP 800-82. Even when an active remote session is established, instructions that alter set-points or override operating logic must present dynamic, single-use proof of execution rights verified independently at the controller. Unauthorised write commands are dropped immediately ahead of the physical asset, severing the link between compromised management paths and operational destruction.
Ripping out active field controllers across distributed facilities to install security-hardened replacements is economically and operationally impossible. Unplanned downtime and fleet-wide recommissioning costs present unacceptable burdens to commercial and industrial operations. Operational resilience requires non-intrusive validation layers deployed directly in-line with legacy controllers and existing serial or fieldbus wiring.
The European refrigeration incidents prove that managing remote ingress channels cannot guarantee machine safety. True resilience requires decoupling network access from command execution rights. By enforcing dynamic authorisation directly at the field endpoint for every individual packet, operations insulate their core machinery against compromised pathways and hostile physical manipulation.
[Test Attack Interception in Practice]
Explore how compromised remote access and unauthorised set-point modifications are mitigated at the field controller level.
👉 Explore the Interactive MITRE Matrix Simulator
--------------------
swIDch will continue its quest to innovate and pioneer next-generation authentication solutions. To stay up-to-date with the latest trends sign up to our newsletter and check out our latest solutions.