French authorities blame an Iranian Revolutionary Guard cyber unit for attacks that caused millions of euros in food losses and at least 15 fires. Paris is seeking European sanctions and international arrest warrants.
France has accused Iran’s Islamic Revolutionary Guard Corps of carrying out a major cyberattack that disrupted refrigeration systems at approximately 700 supermarkets across the country. The October attack caused tens of millions of euros in food losses and started at least 15 fires, according to French authorities.
Foreign Minister Jean-Noël Barrot announced the findings on Monday, November 9, 2026, during diplomatic meetings in Paris. He said the French government would seek European sanctions against those responsible and summon Iran’s ambassador to protest the attack.
The announcement followed an investigation into the October 11-12 incident, when hackers remotely manipulated refrigeration equipment at hundreds of grocery stores. The systems reached temperatures as high as 50 degrees Celsius, or 122 degrees Fahrenheit, forcing businesses to discard large quantities of refrigerated and frozen food.
French officials described the operation as an unprecedented act of digital sabotage against civilian infrastructure. The investigation remains active as authorities work to identify the individuals involved and determine whether additional attacks across Europe are connected.
How Hackers Disrupted Supermarket Refrigeration
The attackers did not need to enter supermarkets or physically damage refrigeration equipment. Instead, they exploited weaknesses in internet-connected systems that allow businesses to monitor and control temperatures remotely.
Investigators found that hackers gained access through web-based management interfaces. Once inside, they changed equipment settings to trigger abnormal defrost cycles that continued far longer than normal.
These cycles caused temperatures inside refrigerated units to rise sharply. The attackers also disabled safety alerts intended to warn employees when temperatures exceeded acceptable limits.
The disruption lasted approximately six hours at some locations. By the time employees discovered the problems, stores had already lost substantial quantities of meat, dairy products, frozen foods and other perishable goods.
France’s national cybersecurity agency, ANSSI, reported that refrigeration controllers at approximately 700 retail sites were compromised. The agency confirmed that the attacks caused at least 15 fires in addition to extensive merchandise losses.
Several major supermarket chains were affected, including Carrefour, Intermarché, E.Leclerc, Coopérative U, Casino and Metro. Independent food businesses also reported disruptions.
The damage extended beyond supermarkets. French cybersecurity officials identified affected butcher shops, a slaughterhouse and cooperative food-processing facilities.
The Intermarché chain reported losing tens of millions of euros worth of products during the disruption. Some stores were forced to empty entire refrigerated sections, leaving customers facing bare shelves while replacement inventory was arranged.
Investigators also discovered attacks against Schneider Electric equipment used at small hydroelectric installations in France. Authorities linked those incidents to the same campaign but reported more limited effects on the targeted equipment.
France Identifies Iranian Revolutionary Guard Cyber Unit
French investigators attributed the supermarket attacks to Shahid Kaveh, a cyber operations unit affiliated with the Electronic and Cyber Center of Iran’s Islamic Revolutionary Guard Corps.
The group has previously been associated with attacks against industrial control systems. Such systems manage physical equipment, including pumps, electrical machinery and refrigeration devices.
ANSSI said its attribution was based on several technical indicators. These included characteristics of the attackers’ infrastructure, distinctive software tools, Persian-language activity and communications associated with the group.
The Paris prosecutor’s office also reported finding internet addresses connected to devices in Iran. Investigators believe these technical traces support their identification of the suspected attackers.
Paris prosecutor Laure Beccuau announced a judicial investigation into suspected organized cybercrime, property destruction and offenses committed to benefit a foreign government. The investigation targets the suspected leader of Shahid Kaveh, two deputies and other individuals who may be identified.
French authorities have requested international arrest warrants for several suspects. The allegations have not resulted in criminal convictions, and Iranian authorities had not immediately responded publicly to the accusations when they were announced.
Barrot said the findings demonstrated a serious threat to French infrastructure. Speaking during the G7 foreign ministers’ meetings, he described the operation as unprecedented because of its scale and destructive effects.
The French Foreign Ministry said the cyberattacks represented the country’s first large-scale campaign conducted specifically to sabotage infrastructure through digital means.
Similar Attacks Strike Other European Countries
The October attack was followed by additional refrigeration disruptions at supermarkets elsewhere in Europe. Incidents were reported in early November in Belgium, Luxembourg, Sweden, Ireland and Estonia.
Some affected stores had to remove refrigerated merchandise after equipment temperatures increased unexpectedly. The disruptions raised concerns that hackers were targeting vulnerabilities shared by refrigeration systems used across multiple countries.
On November 2, grocery stores in several European nations experienced suspected cyberattacks against freezer management systems. However, French authorities have not established that all the European incidents were carried out by Shahid Kaveh or directed by Iran.
That distinction is important because similar methods do not necessarily establish common responsibility. Investigators must compare technical evidence, access methods and the infrastructure used during each incident.
French blood banks were also targeted in a separate attempted cyberattack in early November. The attackers tried to interfere with temperature controls used to preserve blood products and medical samples.
Security personnel detected the attempted manipulation before blood products or samples were damaged. French prosecutors and cybersecurity investigators are examining that incident as well.
Authorities have not publicly established that the attempted blood bank attack and every supermarket incident outside France were part of one coordinated Iranian operation.
FBI Warns Businesses About Internet-Connected Equipment
The attacks have prompted warnings about the security of equipment that controls critical temperatures. These devices are widely used in supermarkets, warehouses, food-processing facilities and medical storage operations.
The FBI recently warned organizations about malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems worldwide. The agency said exposed or outdated controllers can allow unauthorized users to change equipment settings.
Federal officials advised organizations to remove refrigeration controllers from direct public internet access. They also recommended placing remote access behind properly configured firewalls and maintaining current software security updates.
The warnings reflect a broader problem involving operational technology. Equipment designed to manage physical processes can become vulnerable when connected to networks without adequate security protections.
Unlike ordinary data theft, attacks against industrial controllers can cause immediate physical damage. Manipulating temperatures may destroy food, damage machinery or threaten products that require tightly controlled storage conditions.
The French incidents demonstrate how cyberattacks can affect everyday services without directly attacking conventional computer networks. Grocery stores depend on digital controllers to maintain food safety, making interruptions potentially expensive even when customer payment systems remain operational.
France Seeks European Sanctions Against Iran
France is preparing a diplomatic response alongside its criminal investigation. The government plans to ask European Union partners to impose additional sanctions on individuals and organizations involved in the attacks.
The Foreign Ministry said France would also consider other necessary and proportionate measures to discourage future cyber operations. Officials have not provided a complete description of possible additional responses.
On Tuesday, November 10, Barrot said France was not ruling out further action, including measures that might not be publicly disclosed. He emphasized that the government intended to prevent similar attacks against French infrastructure.
European Union foreign policy chief Kaja Kallas indicated that the allegations could be discussed at the November 16 meeting of EU foreign ministers. Any new European sanctions would require action through the bloc’s established procedures.
France has previously attributed other cyber operations to groups associated with Iran’s Revolutionary Guard. French cybersecurity authorities linked a separate unit, Shahid Shoostari, to attacks involving the satirical publication Charlie Hebdo and attempted interference with systems connected to the 2024 Paris Olympics.
The latest investigation raises questions about how businesses can protect equipment that was not traditionally treated as a major cybersecurity risk. Refrigeration controllers may be installed for years, making regular software maintenance and secure remote access especially important.
French authorities are continuing their investigation and seeking cooperation from international partners. The immediate priority is identifying those responsible for the October sabotage while determining whether the later European incidents share the same origin.
IMAGE: Source Own work Author AG20044018 CC4