European refrigeration cyberattacks expose risks for Gulf retailers

France has accused an Iran-linked cyber unit of orchestrating attacks on supermarket refrigeration systems, intensifying concerns over vulnerabilities in connected retail infrastructure across the UAE and wider Gulf Cooperation Council.
French cybersecurity authorities identified Shahid Kaveh, a unit affiliated with Iran’s Islamic Revolutionary Guard Corps, as responsible for the October 12 attack that disrupted refrigeration at approximately 700 supermarkets. France has summoned Iran’s ambassador and indicated that it would pursue European sanctions against those responsible.
The attribution marks a significant development in an investigation that has expanded following another wave of refrigeration disruptions across Europe on November 2. However, investigators have not established whether the subsequent incidents involved the same perpetrators, and no comparable attack on Gulf supermarkets has been publicly confirmed.
Paris prosecutors have opened an investigation into suspected organised cybercrime undertaken in the interests of a foreign power. French authorities are seeking international arrest warrants for suspected participants, while examining the financial and operational consequences for affected retailers.
The attacks exposed weaknesses in remotely managed refrigeration equipment, which allows operators and maintenance contractors to monitor temperatures, adjust settings and diagnose faults through internet connections.
Attackers manipulated refrigeration controllers to activate defrosting functions and increase temperatures, compromising chilled and frozen merchandise. Some systems reportedly reached 50 degrees Celsius, forcing retailers to discard food that could no longer be considered safe for sale.
During the French incidents, attackers extended defrosting cycles from approximately one hour to eight hours, delaying the detection of abnormal temperatures and allowing substantial damage before technicians intervened.
Intermarché estimated that the French disruption caused losses running into tens of millions of euros. Individual businesses also faced equipment damage, emergency maintenance expenses and interruptions to normal trading.
The second wave affected retailers in Belgium, Sweden, Ireland, Luxembourg, Estonia and other European markets. Carrefour, Delhaize, ICA, Coop and SuperValu were among the operators reporting refrigeration problems.
Ireland’s Musgrave Group confirmed disruption affecting refrigeration systems at 13 SuperValu outlets. Products were withdrawn as a precaution, although distribution centres and deliveries were not affected.
Belgian retailers also reported substantial disruption, with Carrefour identifying approximately 15 affected outlets and Delhaize acknowledging problems across several dozen stores.
For retailers operating across the UAE, Saudi Arabia, Qatar, Kuwait, Bahrain and Oman, the incidents illustrate how cyber intrusions can translate directly into physical inventory losses without compromising conventional payment systems or customer databases.
The implications are particularly relevant to supermarkets, food distributors and hospitality operators that depend on uninterrupted temperature control for perishable merchandise.
Cybersecurity researchers at Palo Alto Networks’ Unit 42 have examined the European attacks and identified internet-exposed refrigeration controllers as an important security concern. Their findings underline the risks associated with operational technology connected to external networks.
Separate research by Advanced Cyber Defence Systems identified substantial numbers of accessible refrigeration controllers worldwide even after the initial French attacks. The findings suggested that warnings about exposed equipment had not immediately resulted in comprehensive remediation.
Danish engineering company Danfoss, whose refrigeration technology featured in affected installations, has acknowledged security concerns involving older systems and advised customers to apply appropriate updates and strengthen protections.
Other refrigeration equipment, including systems associated with Dixell, was also targeted during the French incidents. France’s National Cybersecurity Agency acknowledged compromises affecting additional controller technology.
The Cloud Security Alliance has highlighted the potential for simultaneous failures across multiple retail locations when businesses rely on similar equipment, software configurations and remote management arrangements.
Such exposure can complicate insurance assessments because losses may encompass spoiled inventory, equipment repairs, business interruption and additional expenditure required to restore refrigeration operations.
The incidents also raise questions about responsibility between retailers, refrigeration contractors, equipment manufacturers and technology providers when externally managed systems are compromised.
Cybersecurity guidance from the United States Cybersecurity and Infrastructure Security Agency recommends restricting remote access to industrial control systems, separating operational networks from ordinary business networks and maintaining layered security protections.
These measures include stronger authentication, controlled vendor access, software maintenance and monitoring arrangements capable of identifying unauthorised changes to equipment settings.
For Gulf operators, determining whether refrigeration controllers are directly accessible through the internet would provide an initial indication of potential exposure. Independent temperature alarms and established emergency procedures can also help limit damage when automated controls malfunction.
European investigators are examining the circumstances surrounding the intrusions, including the methods used to access controllers and the extent of disruption across affected businesses.