On the night of 11 October, temperature controllers inside several hundred French supermarkets stopped following their setpoints. Units holding frozen goods at minus 27 degrees were pushed past 50 degrees Celsius, and in some stores the heat was enough to start fires, which set off sprinklers and left the aisles under water. France's foreign minister, Jean-Noel Barrot, put a name to the operation on 9 November 2026, telling a press conference during the G7 meeting in Paris that the Islamic Revolutionary Guard Corps was responsible. As of 10 November 2026, the retail industry's working assumption is that a thermostat is now an attack surface, and that the first casualty of a hacked chiller is not data but on-shelf availability.
Seven hundred stores and a setpoint nobody watched
The timeline is short and unusually specific. According to reporting by The Guardian, hackers overrode the temperature settings of thousands of freezers, refrigerators and cold rooms across up to 700 French supermarkets and shops on 11 and 12 October. Paris prosecutor Laure Beccuau said investigators recognised the tradecraft of Shahid Kaveh, a cyber unit tied to the IRGC, including the use of Farsi and IP addresses traced to infrastructure inside Iran. Barrot called the operation unprecedented in scale and aggression, said the Iranian ambassador had been summoned, and promised sanctions at European level. EU foreign affairs chief Kaja Kallas told reporters that the bloc's foreign affairs council would take the attribution up the following week.
The second wave was smaller but wider: dozens of stores in other European countries were affected in early November, and eleven countries have now reported refrigeration problems. On 10 November, Australia's home affairs minister, Tony Burke, confirmed that security agencies were reviewing risks to Australian supermarkets. His formulation is worth keeping: if you have a connected device, you potentially have a hackable device. Europe has now seen what that means for refrigeration.
The stockout that never reached a shelf
Retailers normally treat a stockout as a replenishment failure. A shelf goes empty because a distribution centre shipped short, a truck arrived late, or a store associate did not work the back stock. Every one of those causes is internal, and every one of them is fixable by tightening the same loop: order, deliver, replenish, audit. The October attacks break that loop at its first link, because the goods were in the building the whole time. They were simply no longer sellable.
That distinction matters for how availability is measured. A store's on-shelf availability number is typically computed from POS scans against a planogram, or from a manual gap audit on a sample of SKUs. Neither method can distinguish between a product that was never delivered and a product that was destroyed in place. In a cold-chain event, both show up as a zero, and the operational response to a zero is to reorder, which is precisely the wrong move when the receiving cold room is also compromised.
Why the availability dashboard stayed green
Refrigeration telemetry usually sits with facilities management, not with the commercial team that owns availability. The two systems are wired to different alarms and different on-call rotas. A temperature excursion raises a maintenance ticket; an empty shelf raises a replenishment ticket. During the October event, the sequence ran in the opposite direction from what the dashboards assume: the shelf emptied because the case failed, not the other way round. Stores that recovered fastest were the ones where a human noticed the temperature alarm and disconnected the unit before the compressor ran itself to destruction.
The blood bank case is the control group
The most instructive detail in the French account is not a supermarket at all. The Guardian reports that attackers also reached the control system of cold storage at Etablissement Francais du Sang, the national blood service, and set temperature and thaw thresholds to extreme values. Technicians received the alert and cut the cold rooms off in time, and no products were lost. Same intrusion pattern, different outcome, and the variable that changed was the speed of a human response to an alarm that was actually routed to someone who could act on it.
| Target | What was reported | Availability outcome |
|---|---|---|
| French supermarkets, 11 to 12 October | Up to 700 stores, setpoints pushed from minus 27C to above 50C, fires and sprinkler water damage | Thousands of tonnes discarded; shelves empty with stock physically present |
| European stores, early November | Dozens of stores in a second, smaller wave; eleven countries reporting refrigeration issues | Localised outages, no consolidated loss figure published |
| French national blood service | Storage thresholds set to extreme values, alarm raised | Units disconnected in time, no product lost |
| French bank branch network | Reported losses above 100 million euros at one regional operation | Not an availability event, but the same campaign |
Three data joins that would have caught it sooner
The useful lesson for a retail operations or category team is not to buy another security product. It is to join three datasets that already exist in most chains and are almost never read together: refrigeration telemetry by case and store, the SKU-to-case mapping from the planogram, and the availability or gap audit by SKU. Joined, they answer a question no single system can: which SKU zeros coincide with a temperature excursion in the same case, in the same hour.
For a brand selling through third-party retail, the practical version of this is narrower. You cannot see a retailer's telemetry. What you can see is your own sell-out collapsing in a cluster of stores that share a fixture type, a delivery window or a distributor, while the order book stays flat. That pattern, stock down and shipments unchanged, is the signature of goods that were lost rather than goods that were never sent, and it is worth putting in front of the retailer as a question rather than a claim.
What the loss number will and will not tell you
Estimates for spoiled product currently sit in the tens of millions of dollars, and the French government has not published a consolidated figure. Treat any single number with care: it likely bundles product loss, fire and water damage, staff hours and lost sales, which behave very differently in an insurance claim and in a category P&L. For planning purposes the more useful exercise is to model your own exposure, meaning how many of your SKUs sit in cases with remote setpoints, and how many days of cover you hold in a store that cannot sell them.
FAQ
Does this change how stockout should be defined?
It adds a category. A shelf can be empty because nothing was delivered, or because what was delivered is no longer sellable. Both read as a zero at the till, but only the first belongs in a replenishment review. The second belongs with facilities, quality and insurance, and needs its own label in the availability report so it is not counted against the buying team.
Is there evidence that any of this affected stock outside France?
Eleven European countries have reported refrigeration problems and a second wave hit dozens of stores in early November, but no authority has published a consolidated loss figure. Australia's government said on 10 November that agencies were reviewing risks to local supermarkets, which is a review rather than a reported incident.
Can a retailer detect this from sales data alone?
Partly. A cluster of stores going to zero on the same fixture type within the same hours, while shipments and order books stay flat, is a strong signal. It will not tell you the cause, and it arrives late, so it works as a corroboration tool rather than an alarm.
What is the single cheapest control?
Routing temperature alarms to someone empowered to disconnect a case, and logging that decision. The blood service case suggests the difference between a loss and no loss was minutes of human response, not the sophistication of the defence.
