France Blames Iran’s Revolutionary Guards for Supermarket Fridge Cyberattack and Vows EU Sanctions

France has formally accused Iran’s Islamic Revolutionary Guard Corps of carrying out the cyberattack that turned supermarket refrigerators and freezers across the country into ovens last month, spoiling vast quantities of food and setting some of the equipment on fire. The announcement, made in Paris on Monday, marks the first time a European government has publicly blamed a foreign state for a large-scale sabotage attack on its own soil in the current war with Iran — and it opens a new front in a conflict that has so far been fought mostly with missiles, warships and blockades.

French Foreign Minister Jean-Noël Barrot told reporters that the attack, which struck about 700 supermarkets on the night of 11–12 October, was the work of the Revolutionary Guards’ offensive cyber unit, known as Shahid Kaveh. “I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran,” Barrot said, according to Le Monde. He described the operation as “an attack of unprecedented scale and unprecedented aggressiveness” and “the first large-scale cyberattack carried out for sabotage purposes on French national territory.”

“It represents a major assault on the nation’s interests and on the security of the French people,” Barrot added. “It will not go unpunished.”

France has summoned Iran’s ambassador and says it will propose sanctions against those responsible at European Union level. The Paris prosecutor’s office has opened a judicial investigation into the head of Shahid Kaveh and his two deputies, and according to the Wall Street Journal, prosecutors are seeking international arrest warrants for the three men. There was no immediate comment from Tehran on the allegations, according to CNN, and Iran routinely denies carrying out malicious cyber operations, according to Reuters.

The accusation lands at a delicate moment. It was delivered on the sidelines of a meeting of G7 foreign ministers in Paris, where the United States’ war with Iran — now in its ninth month — dominated the agenda. It also comes as Washington weighs whether to resume airstrikes on Iran or push for a negotiated end to the war, and as American, Russian and Ukrainian negotiators prepare to meet in Abu Dhabi on Tuesday for the first trilateral talks since February. The fridge attack, in other words, is no longer a strange domestic crime story. Paris has now placed it at the centre of the biggest security crisis in Europe and the Middle East.

France Points the Finger: What Paris Announced on Monday

Barrot spoke to reporters on Monday at the G7 gathering in Paris, where foreign ministers from Britain, Canada, France, Germany, Italy, Japan and the United States, along with the European Union, were meeting for two days. According to the Wall Street Journal, Barrot and the US Secretary of State, Marco Rubio, discussed the Iran war and other national security matters on the sidelines of the meeting.

The foreign minister’s statement was unusually direct. Governments rarely name a foreign state as responsible for a cyberattack, and when they do, they usually hedge. Barrot did not. He named the Islamic Revolutionary Guard Corps, the ideological armed force that operates alongside Iran’s regular military, and he named its cyber unit. He said France would “implement sanctions at the European level against all those responsible.”

The Paris prosecutor’s office moved in parallel. In a statement on Monday, it accused Iran of being behind the attack, citing “the use of Farsi and IP addresses pointing to devices located in Iran,” according to CNN. Prosecutors said they had opened an investigation into the head of Shahid Kaveh, a cyber unit affiliated with the Revolutionary Guards, as well as his two deputies and any other individuals responsible.

The European Union’s foreign policy chief, Kaja Kallas, said the response to the attack should be strong, adding that she had only just learned about France’s attribution, according to the specialist publication SecurityAffairs, which reported on the French announcement. An EU official, however, told the Wall Street Journal that the bloc has no immediate plan to impose new sanctions against Iran in response to the allegations — a reminder that turning an accusation into a collective European penalty takes time, and that not every member state will move at the same speed.

France’s cyber crisis coordination centre published a report on Monday saying the attack had targeted refrigeration controllers at about 700 retail sites overnight on 11–12 October, according to the trade publication Insurance Business. The affected retailers included some of France’s biggest supermarket chains — Carrefour, Intermarché and Leclerc — along with smaller operators.

The Night the Fridges Turned Into Ovens

The attack itself was, by the standards of modern cyber warfare, almost absurdly simple — and that is precisely what made it so alarming. Sometime overnight on 11–12 October, hackers gained remote access to the electronic controllers that manage refrigeration in hundreds of French supermarkets. Instead of stealing data or locking systems for ransom, they did something far more physical: they overrode the temperature controls and forced the units into continuous defrost cycles.

The effect was immediate and visible. Temperatures inside fridges and freezers that normally sit far below freezing soared. In some stores, temperatures reached 50C, according to reporting at the time. In one store in Normandy, a unit was reported to have reached 80C. Boxes of perished meat and melted ice cream were carted into giant rubbish containers by supermarket staff in the hours after the hack, Reuters reported. Some refrigeration units caught fire. Whole stocks of fresh and frozen produce had to be thrown away.

The total cost could add up to tens of millions of euros nationwide, one French supermarket owner estimated, according to Reuters. A single Delhaize store in Hoeilaart, Belgium — hit in the second wave of attacks a few weeks later — lost 100,000 euros’ worth of produce alone, according to reporting at the time.

The method, as described by French officials and cybersecurity researchers, exploited a weakness that had been hiding in plain sight for years. Many of the affected units were managed by controllers made by the Danish firm Danfoss — models that in some cases had been out of support for years, with one line unsupported since May 2021 and another retired in 2016. France’s cyber agency, CERT-FR, issued an alert about the vulnerable controllers after the October attack. Researchers estimated that about 4,500 Danfoss controllers were still exposed to the internet after the French incident. The firm behind many of the stricken units said several were obsolete or running outdated firmware, which could have made it easy for hackers to break in, Reuters reported.

On 5 November, the US Cybersecurity and Infrastructure Security Agency, the FBI and other American agencies published a fact sheet on the same kind of activity, warning that malicious actors could exploit vulnerabilities in unpatched or internet-accessible controllers “to remotely alter settings and force units into continuous heating and defrost cycles,” according to SecurityAffairs. The agencies listed three ways in: bypassing authentication, injecting code and using weak settings. They warned that operators could lose sight of the real temperatures inside their units — a bad thing to discover only after the food has gone off.

The Evidence Paris Cites — and Its Limits

France has not published the full technical evidence behind its accusation. That matters, and it is worth stating plainly. What Paris has cited, through the prosecutor’s office and through reporting of the investigation, is a cluster of indicators: the use of the Farsi language in the operation, IP addresses pointing to devices located in Iran, shared infrastructure and attack tools, and amplification of the attack by a propaganda outlet linked to the group, according to SecurityAffairs.

Reuters, which first reported on Monday that French officials suspected Iranian state-backed hackers were behind the attacks, was candid about the limits of what could be established independently. “Reuters could not establish exactly how the French made their determination,” the agency wrote, noting that its two sources spoke on condition of anonymity. The French foreign ministry and the Paris prosecutor’s office did not immediately respond to requests for comment at the time of the Reuters report.

That gap between a government’s confidence and the publicly visible evidence is normal in cyber attribution, and it is also the reason attribution is so often contested. Technical indicators such as language traces and IP addresses can be faked, borrowed or routed through third countries. A serious accusation against a foreign state, as SecurityAffairs noted in its analysis of the French announcement, should be treated as an official claim rather than a proven fact until the evidence is shown. Fear and uncertainty can be used to spread distrust, the publication warned, and that risk applies to all sides in such a story.

At the same time, the French claim does not stand alone. The Wall Street Journal reported that US officials confirmed that investigations into the campaign show the hallmarks of Iranian cyber methods, although the investigation is ongoing. The Pentagon is treating a similar incident at American military commissaries in August as a suspected cyberattack, and a person familiar with the matter told Reuters that the Pentagon considers Iran a suspect in that case too, although the investigation is still in progress and Reuters could not establish how the military reached its determination.

The attribution also fits a pattern that French and American officials have been describing for months. According to Reuters, the fridge hacks would be among the most disruptive cyberattacks of the war with Iran that began in February, a conflict that has been marked by scattered incidents of alleged cyber disruption, including disruptions to the Los Angeles transit system in March, to US water treatment plants in July and to ships bound for the United States in August. Shortly after the US and Israel launched strikes against Iran in late February, the US intelligence community issued a flurry of private warnings to American companies and government agencies urging vigilance amid the threat of possible cyberattacks from Iran, according to national security sources and memos reviewed by CNN.

Shahid Kaveh: The Unit in the Crosshairs

Shahid Kaveh is not a household name, but in the world of industrial cyber sabotage it has a record. According to the Wall Street Journal, French authorities attributed the attack to the Shahid Kaveh offensive cyber unit, which sits under the Electronic and Cyber Warfare Command of Iran’s Islamic Revolutionary Guard Corps.

The group has previously conducted large-scale campaigns targeting industrial equipment, mainly in Israel and the United States but also against European countries, the Journal reported. It claimed responsibility for a cyberattack in November 2023 targeting the Israeli company Unitronics, which manufactures industrial control systems used in the United States and Europe. The group also said it was behind a sabotage campaign against Israeli refrigeration systems in March and April 2026 — a detail that, if accurate, would make the French supermarket attack the second time this year that the same unit has gone after fridges.

The choice of target is consistent with the group’s apparent speciality: the industrial control systems that run the physical world — the pumps, valves, motors and thermostats that keep factories, water plants and food chains running. These systems were designed in an era when they were never expected to be reachable from the internet, and many of them still are not properly protected. For an attacker, they offer something that stealing data does not: visible, physical, photogenic damage, achieved from a keyboard thousands of miles away.

French authorities said this was not Iran’s first cyberattack against France. According to the Wall Street Journal, Iran targeted the French satirical weekly Charlie Hebdo in 2023 and the Paris Olympic Games in 2024. In March 2026, the European Union adopted sanctions against the Iranian entity Emmenet Pasargad, which the French government accused of taking part in cyberattacks against France.

A Wider Campaign Across Europe and America

The French attack did not stay French. On the night of 1–2 November, a second wave of suspected cyberattacks hit supermarket refrigeration systems in at least six other European countries: Belgium, Luxembourg, Sweden, Ireland, the Netherlands and Estonia. In Belgium, about 40 Delhaize stores and 15 Carrefour stores were affected, along with stores from other chains. In Sweden, the Coop chain reported problems at a handful of its roughly 800 stores, while ICA said a limited number of its stores were affected. In Ireland, 13 SuperValu stores were hit. In the Netherlands, at least 17 companies were affected. In Estonia, a single Selver outlet was struck and the attack was stopped within about ten minutes.

Barrot spoke only about the French case, and nothing official yet ties the second wave to Iran, according to SecurityAffairs. But the pattern was strikingly similar: evaporators switched to defrost mode, temperatures soaring, food destroyed. Some reports put the number of countries affected in the second wave at nine. No one has claimed responsibility for the November attacks, and no government has named a suspect for them.

Refrigeration used by French blood banks was also targeted in the second wave, according to Reuters, prompting staff to move blood to different cold storage units. According to the Wall Street Journal, the attack on the blood banks was thwarted before it caused damage.

The campaign may not be confined to Europe at all. In August, refrigerators in at least half a dozen American military commissaries went out of commission, Reuters reported last month. Pentagon investigators are treating the malfunctions as a suspected cyberattack and are working with French officials to get to the bottom of what happened. A person familiar with the matter said the Pentagon considers Iran a suspect in the August commissary hacks, but the investigation is still in progress. Reuters could not independently establish whether there was any link between the refrigeration incidents at US military bases in August, the hacking campaign in France and the more recent wave of refrigeration hacks that struck Europe.

Governments across the continent are still investigating how hackers managed to gain control of refrigeration units at supermarkets in at least half a dozen European countries, the Wall Street Journal reported. On Monday, a spokesman for Dutch police said investigators were still seeking to determine who hacked into refrigerators in the Netherlands.

The uncertainty cuts both ways. Pro-Russian groups have claimed some of the November incidents, according to SecurityAffairs, and if French investigations confirm Iran’s role in the October attacks, those claims could face a serious credibility problem — the groups may have tried to take credit for someone else’s operations. Still, their involvement in some incidents remains possible. In today’s hybrid warfare, SecurityAffairs noted, uncertain attribution, strategic ambiguity and information manipulation make it increasingly difficult to separate real attacks from propaganda.

The War Backdrop: Attribution Lands as Washington Weighs Its Next Move

None of this is happening in a vacuum. The war between the United States and Iran began in late February 2026, when American and Israeli strikes opened a conflict that has since spread across the Gulf, the Red Sea and cyberspace. The Strait of Hormuz has been closed to much commercial traffic, the United States has imposed a naval blockade, and both sides have traded strikes for months. Iran’s supreme leader was killed in the early weeks of the war, according to reporting at the time, and the conflict has reshaped the politics of the region.

On Sunday, President Donald Trump told CNN that fresh American strikes on Iran were “highly unlikely” if talks to end the war made progress, while warning that three American aircraft carriers were “fully locked and loaded” and that the United States could knock down 38 Iranian bridges “in literally one hour” if it chose to. The Wall Street Journal noted that the French attribution “comes as the Trump administration is in the midst of deciding whether to restart airstrikes on Iran or push for a negotiated deal to end the war.” Iran has warned that it would expand its retaliations beyond the Middle East if the United States resumed its attacks.

The diplomatic calendar is crowded. American, Russian and Ukrainian negotiators are due to meet in Abu Dhabi on Tuesday and Wednesday for the first trilateral talks on Ukraine since February, with the US envoys Steve Witkoff and Jared Kushner expected to meet both sides. G7 foreign ministers are in Paris through Tuesday, testing whether the Democrats’ victories in last week’s American midterm elections will change anything about the Trump administration’s foreign policy. And in Turkey, the COP31 climate summit has just opened against a backdrop of disagreement over emissions and finance.

Into this crowded calendar, France has now dropped a formal accusation against a state with which the West is, in effect, at war — an accusation that, if accepted, would make the fridge attacks an act of war by another means, carried out not with a missile but with a few lines of code aimed at a thermostat.

Analysis: Why It Matters

A line crossed: sabotage on home soil

There is a reason Barrot reached for the language of the unprecedented. States spy on each other constantly, and they hack each other constantly too. What they have historically been more careful about is sabotage — attacks designed not to steal information but to break things — carried out on the territory of a country that is not formally at war with them. France and Iran are not formally at war. The United States is at war with Iran; France is not. Yet according to Paris, an Iranian military unit reached into French supermarkets and set fire to French equipment.

That distinction matters because it is the distinction on which the rules of peacetime behaviour rest. If a state can sabotage civilian infrastructure in another country and face nothing worse than a diplomatic protest, then the line between war and peace dissolves a little further, and every country with internet-connected infrastructure becomes a potential battlefield. Barrot’s insistence that this was “the first large-scale cyberattack carried out for sabotage purposes on French national territory” is best read as an attempt to draw that line again, in public, before it disappears entirely.

Attribution is a political act, not just a technical one

It is worth asking why France chose to make this accusation now, a month after the attack, and why it chose to make it at a G7 meeting rather than in a quiet diplomatic note. The timing is unlikely to be accidental. The technical investigation will have taken weeks; the decision to go public will have been taken when the political moment was right.

One reason is leverage. France wants European sanctions, and sanctions need a public case. A private attribution does not move 27 governments; a public one, delivered by a foreign minister at a gathering of the world’s richest democracies, does. Another reason is deterrence. By naming the unit, naming its commanders and seeking arrest warrants, Paris is telling Tehran — and every other state watching — that sabotage on French soil carries a personal cost for the people who order it, not just a diplomatic one for the country that sponsors it.

A third reason is the war. The United States is deciding whether to escalate or negotiate with Iran, and its European allies have been, by most accounts, sceptical of further military action and anxious about being drawn into a conflict they did not choose. A public Iranian sabotage attack on European soil strengthens the hand of those in Washington who want a harder line, and it complicates the hand of those in Europe who want distance. Whether France intended that effect or not, it is an effect the announcement will have, and it is one reason the timing — on the eve of the Abu Dhabi talks and in the middle of the G7 meeting — deserves attention.

None of this means the attribution is wrong. It means only that attribution, in statecraft as in science, is never purely a matter of evidence. The evidence and the politics arrive together, and the honest reader should hold both in mind at once.

Why supermarkets? The logic of visible, deniable disruption

Of all the targets an attacker could choose, a supermarket fridge seems almost comically modest — until you think about what it achieves. “Disrupting refrigeration is highly visible, relatively tangible and potentially scalable,” Rafe Pilling, a senior director of threat intelligence at the security firm Sophos, told the Wall Street Journal. That is a precise summary of the appeal.

A fridge attack is visible in a way that most cyberattacks are not. Stolen data is invisible; a spoiled supermarket aisle is not. Shoppers see it, shopkeepers count it, local newspapers photograph it. It is tangible: it destroys real goods, costs real money and, in the worst cases, starts real fires. And it is scalable: the same vulnerability, the same controller, the same few lines of code can be used against hundreds of sites at once, in several countries at once, without any additional effort.

It is also, crucially, deniable. A missile has a launch site and a radar track. A cyberattack routed through compromised devices, using commodity tools and a language trace, can be attributed — but only by governments willing to stake their credibility on intelligence they cannot fully show. For a state that wants to signal capability and impose costs without triggering a military response, that ambiguity is the point. The attack says: we can reach into your daily life, and you cannot be entirely sure it was us. France’s announcement is an attempt to remove the second half of that sentence.

Europe’s exposed plumbing: the lesson of the controllers

Strip away the geopolitics, and the fridge attacks tell a simpler and more uncomfortable story: the machinery of everyday life is connected to the internet, and much of it was never designed to be. The controllers that manage supermarket refrigeration were built to be monitored remotely by engineers, not defended against hostile states. Many run software that their manufacturers stopped supporting years ago. Some sit behind default passwords. Thousands remain directly reachable from the public internet.

The fixes, as SecurityAffairs noted, are dull and they work: keep controllers off the internet, and if remote access is needed, put an updated firewall in front of it; separate industrial devices from office networks; change default passwords; add phishing-resistant multifactor authentication; patch firmware and replace devices the maker no longer supports; limit who can change settings to an approved list of devices and IP addresses; keep tested backups offline; turn on logging and read the logs.

The reason those fixes have not been applied everywhere is also dull: they cost money, they require expertise that small operators do not have, and until last month, nobody thought a supermarket fridge was a military target. That calculation has now changed, and not only for supermarkets. The same class of controllers manages heating, ventilation, water treatment, cold storage for medicines and blood, and countless other systems that societies assume will simply work. The fridge attacks are best understood as a demonstration — a proof, delivered at the cost of some spoiled food, that the demonstration can be repeated against more consequential targets.

What to watch next

1. The sanctions proposal. France says it will seek EU-level sanctions against those responsible. Watch whether the proposal moves quickly, which names appear on it, and whether any member state resists. The EU official who told the Wall Street Journal that the bloc has no immediate plan for new sanctions is a reminder that agreement is not automatic.
2. The arrest warrants. Paris prosecutors are seeking international arrest warrants for the head of Shahid Kaveh and his two deputies. Watch whether Interpol circulates them, whether any of the three travels, and whether the warrants become a live diplomatic irritant or a symbolic gesture.
3. Iran’s response. Tehran has not yet commented. Watch whether it denies the accusation outright, as it routinely denies malicious cyber operations, or whether it answers with a counter-accusation, a diplomatic protest, or a further demonstration of its own. Watch also whether the ambassador summoned in Paris is expelled or recalled.
4. The second wave. The November attacks on supermarkets in at least six other European countries remain unattributed. Watch whether France’s attribution extends to them, whether other governments make their own attributions, and whether the pro-Russian groups that claimed some of the incidents are shown to have been taking credit for someone else’s work.
5. The American thread. The Pentagon’s investigation into the August commissary hacks is still open. Watch whether Washington formally attributes those incidents to Iran, and whether the CISA fact sheet of 5 November is followed by mandatory security requirements for the operators of internet-connected industrial controllers.
6. The war calendar. The Abu Dhabi talks on Ukraine begin on Tuesday, and the question of fresh American strikes on Iran remains open. Watch whether the French attribution hardens positions in Washington, complicates the diplomacy in Abu Dhabi, or becomes a bargaining chip in the negotiations over Iran’s future.

The fridges, in the end, were never really the story. They were the message — and on Monday, France sent one back.

Sources

• CNN — France blames Iran for ‘unprecedented’ supermarket fridge cyberattack
• Reuters — French officials suspect Iran is behind refrigerator hacks, sources say
• The Wall Street Journal — France, U.S. Suspect Iran Was Behind Cyberattack on European Fridges
• SecurityAffairs — France blames Iran for supermarket fridge attacks