France Blames Iran’s Revolutionary Guards for a Hack That Pushed 700 Stores’ Freezers Above 50C

France formally accused Iran’s Islamic Revolutionary Guard Corps on Monday, Nov. 9, of carrying out a cyberattack in October that took over refrigeration controls at more than 700 supermarket and retail sites, spoiling food worth tens of millions of euros and starting fires. Foreign Minister Jean-Noël Barrot said the France Iran cyberattack was “unprecedented in both its scale and its level of aggression” and promised sanctions at the European level.

The French Foreign Ministry’s attribution statement called it the first cyber-offensive campaign carried out purely for sabotage on French territory. Paris summoned Iran’s ambassador “to lodge a very strong protest,” Barrot told reporters on the sidelines of the G7 foreign ministers’ meeting in Paris, according to AFP.

What happened on Oct. 11-12

During the night of Oct. 11-12, attackers remotely accessed the web interfaces of supermarket refrigeration controllers and started “abnormal, indefinite defrost cycles,” while switching off the temperature alarms meant to warn staff, Paris prosecutor Laure Beccuau said in a statement quoted by AFP. The Guardian reported that thermostats in some freezers were pushed from as low as minus 27C to well over 50C. Thousands of tons of food had to be thrown away, and in some stores the heat set off fires, sprinklers and water damage.

The joint technical report says defrost settings were fixed at high temperatures at about 700 sites, causing heavy stock losses and at least 15 fires. Affected companies were mainly large grocers, including the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups, along with several small butchers, a slaughterhouse and food-processing cooperatives. The report also links the same operation to the targeting of Schneider Electric equipment at several small hydroelectric plants in France, with what it called moderate effects.

The Foreign Ministry estimated food losses at “several tens of millions of euros” and said the attacks caused considerable material damage and were a major blow to national interests.

Who France says did it

France attributed the operation to Shahid Kaveh, an offensive cyber unit affiliated with the IRGC’s Electronic and Cyber Centre. France’s Centre for Coordination of Cyber Crises, which groups the national cybersecurity agency ANSSI, the foreign and domestic intelligence services, the defense procurement agency and the military’s cyber command, published a joint technical report alongside the statement. AFP reported that the center said the unit is better known online as CyberAveng3rs and that it mainly targets industrial equipment in Israel and the United States, as well as France and other European countries.

Beccuau said investigators identified a modus operandi characteristic of the group, including the use of Persian and IP addresses traced to devices in Iran. She opened a judicial investigation into the unit’s chief and two deputies on charges that include attacks on automated data systems by an organized gang, aggravated because they were allegedly committed to serve a foreign power. The cyber crisis center named Hamid Reza Lashgarian, Reza Salarvand and Mahdi Lashgarian, according to AFP. The U.S. Treasury sanctioned Hamid Reza Lashgarian and Mahdi Lashgarian in 2024 over earlier cyberattacks. Iran had not publicly responded to the French accusation in the reports reviewed by The Boston Report.

A wider wave across Europe

The French attack was not isolated. On Nov. 2, grocery stores in at least nine other European countries reported suspected attacks on their freezer systems, as The Boston Report covered at the time. The Guardian reported that hackers also reached control systems at cold stores holding blood products for France’s blood service, EFS, last week, though alarms let technicians disconnect them before products were lost. It is not clear whether those incidents are linked to the October campaign, and France’s attribution covers only the supermarket attacks.

France said Iran has targeted it before, citing the satirical weekly Charlie Hebdo in 2023 and the organization of the Paris 2024 Olympics. The EU sanctioned the Iranian company Emennet Pasargad over those operations in March 2026, according to the Foreign Ministry. Gérôme Billois of the consultancy Wavestone told the Guardian the unit has been active since 2020, mostly against U.S. water systems, and warned that water and electricity could be next.

What comes next

France will ask EU partners to adopt new sanctions on Iranian entities and individuals involved, and said it reserves the right to take further “public and non-public” measures. EU foreign policy chief Kaja Kallas said “our response should be strong,” and noted that EU foreign ministers meet next Monday. U.S. Secretary of State Marco Rubio, who was in Paris for the G7 talks, told reporters the attack “does not surprise us,” AFP reported.

The accusation lands as the U.S.-Iran war and the blockade of Iranian shipping continue, and as European officials warn of more hybrid attacks on critical infrastructure. For the latest alerts on each cyberattack and security threat, see our tracker.

Sources

• France Diplomatie: Déclaration d'attribution à l'Iran de cyberattaques visant la France (Nov. 9, 2026)
• AFP: France says Iran behind 'unprecedented' cyberattacks on fridges
• The Guardian: Iran was behind cyber-attack on French supermarket freezers, Paris says
• CERT-FR: Activités cyber offensives menées par des acteurs iraniens liés au CGRI (PDF)