France blames Iran Revolutionary Guards for supermarket fridge cyberattacks

France on Monday formally accused Iran's Islamic Revolutionary Guard Corps of orchestrating a cyberattack that disabled refrigeration systems at hundreds of supermarkets across the country last month, marking the first time Paris has publicly attributed a large-scale sabotage operation on its soil to Tehran.

The announcement, made by Foreign Minister Jean-Noël Barrot during G7 talks in Paris, triggered the immediate summoning of Iran's ambassador and a vow to pursue European Union sanctions. "This is an attack of unprecedented scale and aggressiveness," Barrot said. "It is the first large-scale cyberattack aimed at sabotage on French soil, and it represents a major threat to our national interests and the security of the French people. That is why it will not go unanswered."

Media additions

The October attack

In the early hours of October 11–12, hackers remotely seized control of temperature-management software used by major French retailers, driving refrigerator and freezer temperatures to 50°C (122°F) for roughly six hours while stores were closed. The heat spoiled millions of euros worth of fresh and frozen goods; in at least 15 locations, units caught fire or melted, according to a joint report by French intelligence and cyber agencies cited by CBC.

The assault hit approximately 700 commercial sites — mostly supermarkets but also butcher shops, a slaughterhouse and food-processing factories. Major chains reported widespread disruption: more than 100 Coopérative U stores, 180 Intermarché and Netto outlets, and roughly 5% of Monoprix's 490 stores. Intermarché alone estimated losses of "tens of millions of euros" in a single day.

Retailer	Stores affected	Source
Coopérative U	More than 100	MyJoyOnline, BBC
Intermarché / Netto	180 (MyJoyOnline, BBC) / 300+ (Yahoo)	MyJoyOnline, BBC, Yahoo
Carrefour	80	Times Now, Yahoo
Monoprix	~5% of ~490 stores	Times Now, Yahoo
E.Leclerc	Hit (no store count given)	Times Now, BBC

Attribution and evidence

Paris prosecutor Laure Beccuau opened a judicial investigation on Monday targeting Shahid Kaveh, an offensive cyber unit affiliated with the IRGC's Electronic and Cyber Centre. The probe names the unit's leader and two deputies — identified in the French intelligence report as Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand, and seeks international arrest warrants for all three.

Investigators said they linked the intrusion to Shahid Kaveh by matching the attack pattern to previous operations by the group and by recovering traces of Farsi language in the attack infrastructure, alongside IP addresses traced to devices in Iran. The unit has also operated under front names including "CyberAveng3rs" and "Cyber Isnaad Front," according to the French report.

French authorities have not disclosed the full technical basis for their attribution. TRT World and Vijesti both note that Reuters could not independently establish how France reached its conclusion. Microsoft, however, had privately tied Iran to the October refrigerator hacks at least two weeks before the public announcement, according to three people familiar with the matter cited by CBC; Microsoft declined to comment.

Vulnerable infrastructure

The targeted software, supplied by Danish engineering firm Danfoss, allows retailers to manage refrigeration units remotely. Cybersecurity experts told Reuters the attack was relatively easy to execute because many units were obsolete or running outdated firmware. "The seemingly straightforward nature of the refrigerator hacks, and their repetition across multiple countries, prompted speculation about who might be responsible," TRT World reported.

A spreading campaign

The October assault was not isolated. A second wave struck more than 100 establishments across Europe in early November, hitting supermarkets in Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia and Finland. French blood banks were also targeted in a separate attempt last week to raise storage temperatures to dangerous levels; staff moved blood products to alternative cold storage before damage occurred.

Two Russian-aligned hacktivist groups claimed responsibility for some of the November attacks, though few experts found the claims credible. The BBC and Times Now both report that it remains unclear whether the European incidents are connected to the French campaign.

Transatlantic dimension

The sabotage of European supermarket refrigerators was preceded by a similar incident in the United States. In August, refrigeration units failed at at least six military commissaries, including Fort Huachuca in Arizona and Naval Station Newport in Rhode Island, spoiling food. The Pentagon's inspector general and the Army's Criminal Investigative Division are investigating the malfunctions as a suspected cyberattack and are working with French law enforcement. U.S. Investigators reportedly consider Iran a suspect, though the investigation remains ongoing and no public link has been established between the U.S. Military incidents and the European campaigns.

Diplomatic fallout

Barrot said France would "implement sanctions at the European level against all those responsible for this attack" and take "any other necessary and proportionate measures" to respond and deter future operations. He noted that the Foreign Affairs Council would meet the following Monday and that G7 ministers had been informed of the attribution.

Iran's mission to the United Nations did not respond to requests for comment from multiple outlets. Tehran routinely denies carrying out malicious cyber operations.

Broader context

The October hacks are described by French officials and TRT World as among the most disruptive cyberattacks of a shadow conflict with Iran that began in February. That period has seen alleged Iranian digital disruption against the Los Angeles transit system in March, U.S. Water treatment plants in July, and ships bound for the United States in August. The refrigerator campaign also unfolds amid heightened concerns over Russia's suspected sabotage operations in Europe and the global rise of AI-powered cyberattacks targeting operational technology.

What to watch next

• EU sanctions process: The Foreign Affairs Council meeting next Monday will test whether member states back France's push for coordinated restrictive measures.
• Judicial proceedings: The Paris prosecutor's request for international arrest warrants moves to judicial authorities; execution depends on international cooperation.
• Transatlantic investigation: Ongoing U.S. Military and French law enforcement coordination may clarify whether the August commissary incidents, the October French campaign and the November European wave share a common operator.
• Technical remediation: Retailers and Danfoss face pressure to patch or replace vulnerable refrigeration management systems across Europe.
• Iran's response: Tehran has not yet commented; any denial or counter-accusation will shape the diplomatic trajectory.

For now, the episode stands as a stark demonstration of how mundane commercial infrastructure, supermarket freezers, can be weaponized in state-backed sabotage, blurring the line between criminal hacking and acts of war.