France has accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of carrying out a cyberattack that disrupted refrigeration systems at approximately 700 commercial sites across the country, causing substantial food losses and fires. Paris has summoned Iran’s ambassador and said it will seek European-level sanctions against those responsible.
French Foreign Minister Jean-Noël Barrot announced the attribution on Monday, 9 November, describing the operation as unprecedented in its scale and aggressiveness. The attacks took place overnight on 11 and 12 October, when hackers gained remote access to refrigeration controls at supermarkets and other food businesses, altering their operating settings and disabling safety alerts.
The allegation marks a significant escalation in the diplomatic dispute between Paris and Tehran, as France links damage to civilian commercial infrastructure to an Iranian military organisation. The accusation is based on a joint technical assessment by French intelligence and cyber agencies, while a judicial investigation into the alleged perpetrators is under way.
The French government’s report identifies the IRGC’s Electronic and Cyber Centre as the organisation behind the operation and names its offensive cyber unit, Shahid Kaveh, as the alleged executor.
How the supermarket systems were disrupted
According to the Paris prosecutor’s office, the attackers remotely accessed industrial refrigeration controllers through web interfaces. They then initiated abnormal defrost cycles designed to run indefinitely, raising temperatures inside refrigerated units while disabling the safety alerts that should have warned staff when conditions became dangerous.
The resulting disruption affected around 700 retail sites across France, according to the French authorities. The victims included major supermarket operators such as Intermarché, Carrefour, E.Leclerc, Casino, Metro and Coopérative U. Smaller butcher shops, a slaughterhouse and food-processing businesses were also among the affected locations.
The consequences extended beyond spoiled stock. The joint report issued by French cyber and intelligence agencies recorded fires at at least 15 locations, while the Paris prosecutor’s office described roughly 20 fire outbreaks associated with the attack.
Employees were left dealing with damaged refrigeration equipment and large quantities of perishable food that could no longer be sold. A French supermarket owner previously estimated that the nationwide financial losses could reach tens of millions of euros, although this was an industry estimate rather than an official final assessment.
The incident demonstrated how a cyberattack on industrial equipment can cause physical damage and disrupt ordinary commercial activity without targeting payment systems or customer databases.
France sets out its attribution evidence
The technical attribution was published in a joint report by France’s Centre for Coordination of Cyber Crises, known as C4. The body brings together the National Cybersecurity Agency of France (ANSSI), military cyber command, the Directorate General for Armament, the foreign intelligence service and the domestic security service.
The report said investigators had identified a series of indicators linking the refrigeration operation to Shahid Kaveh, an offensive cyber unit affiliated with the IRGC’s Electronic and Cyber Centre.
Among the indicators was the use of digital infrastructure that French agencies said had also been involved in reconnaissance against industrial equipment made by Schneider Electric. The agencies identified similarities between the techniques used in those operations and methods previously associated with Shahid Kaveh.
Investigators also found that the attackers used the FOFA scanning tool, which can identify internet-connected devices, and recovered traces of the Persian language within the attack infrastructure. The French report said an online channel associated with the unit, CyberbanNews, had circulated material about the operation from 13 October, shortly after the refrigeration attack.
The report also identified online personas associated with the unit, including CyberAveng3rs and Cyber Isnaad Front. Such groups have presented themselves publicly as hacktivist organisations, while French authorities allege that they are among the digital identities used by the Iranian cyber unit.
These findings form the basis of France’s state attribution. They are the conclusions of the French authorities and have not been independently established through a public forensic investigation by an international body.
The Paris prosecutor’s office has opened a judicial investigation targeting the alleged leadership of Shahid Kaveh, its deputies and any other individuals identified during the inquiry. Reuters reported that prosecutors had also requested international arrest warrants for those believed to have carried out the operation.
Paris threatens European sanctions
Barrot said the Iranian ambassador had been summoned to the French foreign ministry to receive a formal protest. He also announced that France would pursue sanctions at the European level against those responsible.
The proposed response could add another source of tension between European governments and Tehran, already under pressure over the wider conflict involving Iran and the United States.
France’s report places the refrigeration operation within a broader pattern of cyber activity attributed to Iranian-linked units. It separately identifies another IRGC-affiliated unit, Shahid Shoostari, in connection with earlier operations targeting French interests, including a cyberattack against Charlie Hebdo and an attempted disruption involving digital display infrastructure connected with the 2024 Paris Olympic and Paralympic Games.
The two units should not be conflated: the French report specifically attributes the October refrigeration campaign to Shahid Kaveh.
Iran’s mission to the United Nations did not respond to Reuters’ requests for comment on the allegations. Tehran has routinely denied conducting malicious cyber operations. No immediate Iranian response to the French government’s specific accusation had been reported by the time of publication.
A wider warning over vulnerable cold-storage systems
The French attacks have been followed by further incidents affecting commercial refrigeration systems elsewhere in Europe. Reuters reported that a second wave had hit more than 100 establishments during November, while refrigeration equipment used by French blood banks was also affected.
The blood-bank incidents prompted staff to transfer some stored blood to alternative cold-storage units. French authorities said the samples were not damaged.
However, France’s cybersecurity agency cautioned against automatically treating the later incidents as part of the same campaign. ANSSI chief Vincent Strubel said that, although the methods appeared similar, there was not enough evidence at that stage to establish that the same attacker was responsible.
The US Federal Bureau of Investigation has separately warned of malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems around the world. It said weaknesses in internet-accessible or unpatched controllers could allow attackers to change system settings, potentially causing inventory losses and equipment damage.
Cybersecurity specialists have also pointed to the exposure of industrial equipment as a central problem. Saher Naumaan, a senior threat researcher at Proofpoint, told Reuters that the incidents reflected less a demonstration of extraordinary hacking capability than “how exposed these systems are”.
The warning is relevant well beyond supermarkets. Food distribution networks, warehouses, processing facilities and other operators depend on refrigeration and industrial controls to maintain safe temperatures and protect valuable stock. Weakly protected equipment can turn a digital intrusion into a physical and financial emergency.
For France, the immediate challenge is to pursue the investigation and diplomatic response while helping businesses strengthen vulnerable systems. For other European governments, the attacks have raised questions about the protection of infrastructure that is essential to daily life but is often less visible than financial networks or government computer systems.
The French attribution has placed an Iranian military-linked cyber unit at the centre of the investigation. Whether the later incidents across Europe are connected remains unresolved, but the October attack has already exposed the consequences of leaving critical commercial equipment accessible to remote attackers.
