Stores in Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia lost normal refrigeration overnight on November 2 and 3, SentinelOne said. About three weeks earlier, roughly 700 French stores were hit, Economy Minister Roland Lescure told Parliament. On November 9, France blamed that wave on Shahid Kaveh, a cyber unit of Iran's Revolutionary Guard. The attackers appear to have used the stores' own control panels to alter temperature and defrost settings.
SentinelOne says nobody is established as responsible for the November cases. Claims by NoName057(16) and Z-Pentest are unverified. French agency ANSSI said on October 21 that open admin access and weak passwords were the French weak points, not the flaws named in early coverage. Whether the same holds in November is not known. SentinelOne adds that a shared controller model or a similar temperature change cannot name an operator.
A supervisory controller lets staff watch freezers, read alarms and change settings from afar. If it sits on the public internet with a weak password, a stranger can do the same. So who is behind it matters less than who can reach the controller. CERT-FR says to take affected units offline, check insurance terms first if that cuts the contractor's data feed, and allow access only through a VPN, a private encrypted link. Buyers can ask contractors who can log in, and how.