France blames Iran for cyberattack on supermarket fridges

France formally accused Iran of orchestrating an unprecedented cyberattack that crippled refrigeration networks across roughly 700 supermarkets, summoning Tehran's ambassador and vowing to push for European Union sanctions in what officials described as the first large-scale act of cyber sabotage on French soil.

The operation, launched in the early hours of October 12, 2026, forced commercial cooling units into uncontrolled defrost cycles, driving internal temperatures to 50 degrees Celsius for about six hours. Perishable stocks were ruined, at least 15 fires broke out in overheated equipment, and the Intermarché chain alone reported losses of tens of millions of euros in a single day, according to the Paris prosecutor's office and statements from French ministers. Major retail locations affected included Intermarché, Coopérative U, and E. Leclerc.

Media additions

Attribution and evidence

Paris prosecutor Laure Beccuau said a formal judicial investigation was opened on Monday, November 9, 2026, into suspected organized cybercrime aggravated by the circumstance of having been committed to serve the interests of a foreign power. Investigators cited the use of Farsi in the attack infrastructure and IP addresses traced to devices located inside Iran. The national cybersecurity agency, ANSSI, attributed the intrusion to a unit called Shahid Kaveh, described as a cyber offensive group affiliated with Iran's Islamic Revolutionary Guard Corps. A joint report by French intelligence and cyber agencies noted that the hackers worked through front groups masquerading as vigilante hackers, including CyberAveng3rs and Cyber Isnaad Front.

"This is an attack of unprecedented scale and aggressiveness. It is the first large-scale cyberattack aimed at sabotage on French soil, and it represents a major threat to our national interests and the security of the French people. That is why it will not go unanswered."

Jean-Noël Barrot, French Foreign Minister, via Associated Press

The judicial probe targets the leader of Shahid Kaveh, two deputies identified as Hamid Reza Lashgarian and Mahdi Lashgarian, and an associate named Reza Salarvand. According to reporting from The Express Tribune, the Paris prosecutor's office is seeking international arrest warrants.

Diplomatic fallout

Foreign Minister Jean-Noël Barrot, speaking on the sidelines of G7 talks in Paris, said the Iranian ambassador was summoned to strongly protest against this extremely serious act. Barrot pledged to pursue sanctions at the European level against all those responsible and to take any other measures needed to deter future attacks. European Union foreign policy chief Kaja Kallas confirmed that G7 ministers had been briefed on the attribution, noting that so far, the international community did not know who was behind the incident, according to NewsCord.

Wider pattern of disruption

The October 12 incident was not isolated. Following the French supermarket hacks, a second wave of cyberattacks hit more than 100 establishments across Europe, including supermarkets in Sweden, Belgium, Luxembourg, Ireland, and Estonia where freezers and fridges suffered failures that forced businesses to dispose of ruined food. In France, a separate cyberattack targeted several blood banks, attempting to raise storage temperatures to dangerous levels before being thwarted by authorities. ANSSI also disclosed that another IRGC-linked unit, Shahid Shoostari, has been tied to previous operations against France since 2020, including attacks on the satirical newspaper Charlie Hebdo in 2023 and the Paris Olympic Games organization in 2024, according to The Baltimore Sun and PBS.

Technical exposure

The attackers used web interfaces to remotely take control of commercial refrigeration systems, triggering abnormal, unlimited-duration defrost cycles while disabling security alerts on sensors, the Paris prosecutor's office said.

Transatlantic dimension

The refrigeration sabotage followed a series of digital disruptions reported during the broader conflict, including hacks against the Los Angeles transit system in March, United States water treatment plants in July, and ships bound for the United States in August.

What to watch next

• EU Foreign Affairs Council meeting — scheduled for next Monday, where ministers will discuss coordinated sanctions.
• International arrest warrants — the Paris prosecutor's office has requested them for the Shahid Kaveh leadership.
• Blood-bank investigation, ANSSI and prosecutors are still probing the attempted temperature manipulation at French blood banks.
• Cross-border attribution, authorities in Sweden, Belgium, Luxembourg, Ireland and Estonia are analyzing whether their recent fridge failures share technical indicators with the French case.

Iran's mission to the United Nations did not respond to requests for comment. Tehran routinely denies carrying out malicious cyber operations.