Hackers Are Now Causing Fires in Supermarkets

France says Iranian hackers attacked over 700 supermarkets, disrupting refrigeration systems and starting at least 15 fires through cyberattacks.

France has officially attributed a series of disruptive cyberattacks in October to Iranian state-backed hackers. According to reports, the attacks targeted more than 700 supermarkets and other retail locations across the country. The attackers focused on refrigeration systems, causing widespread equipment failure that led to significant food spoilage. Most alarmingly, French authorities stated that these digital intrusions directly sparked at least 15 physical fires. This incident marks a significant escalation, moving beyond data theft or simple disruption into the realm of tangible, real-world destruction. The targeting of the civilian food supply chain demonstrates a willingness by nation-state actors to cause widespread societal chaos and physical danger, blurring the lines between cyber espionage and kinetic warfare.

The attackers likely achieved this physical impact by compromising the operational technology (OT) that manages the stores' infrastructure. These systems, often called Industrial Control Systems (ICS) or Building Management Systems (BMS), control everything from HVAC to lighting and refrigeration. By gaining remote access, the hackers could have manipulated the refrigeration units in ways that bypassed safety mechanisms. For example, they could have forced compressors to run continuously without cooling cycles or disabled thermal overload protectors, causing the electrical components to overheat and ignite. This is a classic example of a cyber-physical attack, where a breach in the digital world is intentionally used to cause a destructive effect in the physical world. Unlike ransomware that encrypts data, this type of attack weaponizes the very equipment a business relies on for its daily operations.

While cyberattacks with physical consequences are not new—the Stuxnet worm that damaged Iranian nuclear centrifuges is a famous example—this incident represents a disturbing shift in targeting. Previous high-profile attacks focused on strategic national assets like nuclear facilities or power grids. The French supermarket attacks, however, targeted a "soft" civilian sector: the food supply chain. This suggests a broadening of what state-sponsored groups consider acceptable targets for disruptive operations. The goal appears to be less about strategic military advantage and more about creating public fear, economic damage, and political pressure. It signals that any organization with connected physical systems, no matter how seemingly mundane, can become a pawn in geopolitical conflicts, dramatically expanding the threat landscape for businesses everywhere.

For CTOs, CISOs, and IT leaders, this event is a critical wake-up call. The long-debated convergence of IT and OT is no longer a future concern; it is a present and active danger. The security posture of a company cannot end at its servers and databases. It must extend to every internet-connected device that controls a physical process. This requires a fundamental shift in security strategy, starting with a complete inventory of all OT assets and a rigorous assessment of their vulnerabilities. Strict network segmentation between IT and OT networks is no longer optional, but an absolute necessity to prevent attackers from pivoting from a compromised email account to a factory floor or a refrigeration unit. Incident response plans must also be updated to account for scenarios involving physical harm and equipment damage, requiring coordination between security teams and facilities or operations staff. The era of treating OT as a separate, air-gapped domain is over, and the cost of inaction can now be measured in physical destruction.

This event proves that cyberattacks are no longer just about data theft or ransomware. State-sponsored actors are now causing physical damage, including fires, in civilian infrastructure like the food supply chain. This elevates the threat model for any organization with connected operational technology (OT).

The attack resulted in direct financial losses from spoiled goods and physical damage from fires. It highlights a critical business risk where insecure operational technology can lead to catastrophic failures, supply chain disruption, and potential legal liability. Companies must now budget for securing OT systems.