French Foreign Minister Jean-Noël Barrot accused Iran’s Islamic Revolutionary Guard Corps (IRGC) on Monday of carrying out the October cyberattacks that overheated commercial refrigerators and freezers across hundreds of supermarkets in France. Speaking in Paris following a G7 foreign ministers meeting, Barrot announced that the government had summoned the Iranian ambassador and would seek European Union sanctions against those responsible.
Barrot said responsibility for the intrusion “lies with the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran.” Speaking to reporters, the BBC reported, he described the operation as “unprecedented in both its scale and its level of aggression” and said the Iranian envoy was called in to “lodge a very strong protest against this extremely grave act”.
According to Barrot, the disruption “marks the first large-scale cyber-attack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people”. He added that France would take any necessary and proportionate public or private measures to respond and deter future attempts.
Iranian authorities had not issued an official response by Monday evening, though several domestic Iranian media outlets dismissed the French allegations as baseless.
Paris Prosecutor Seeks Arrest Warrants for Shahid Kaveh Unit
Alongside the diplomatic protest, Paris Prosecutor Laure Beccuau announced that her office opened a formal judicial investigation into the commander and two deputies of an offensive cyber unit known as Shahid Kaveh, as well as other unidentified suspects. Beccuau stated that the Shahid Kaveh group is affiliated with the IRGC’s Electronic and Cyber Center and comprises hackers believed to be employed directly by the Iranian government.
According to The Record, the Paris Prosecutor’s Office has requested international arrest warrants for the suspects and described the supermarket intrusions as part of a broader destabilization campaign against French interests dating back at least six years.
While the BBC noted that French officials had not publicly detailed all of their attribution methods, Xinhua, citing a statement from the Paris Prosecutor’s Office reported by Le Monde, said investigators identified an attack pattern characteristic of Shahid Kaveh, including “the use of Farsi and IP addresses linked to devices located in Iran.” Separately, Reuters reported via CBC News that Microsoft had privately linked Iran to the October refrigerator hacks at least two weeks ago, citing three people familiar with the matter.
Spoiled Food, Equipment Fires, and Targeted Blood Banks
The initial cyberattack took place on Oct. 11 and Oct. 12, when hackers gained access to remote temperature-management software supplied by Danish engineering company Danfoss. The software lets grocery chains monitor and adjust their cold-storage units from a distance. By raising the temperatures overnight, the attackers spoiled tons of chilled and frozen food worth millions of euros across roughly 700 French stores, according to Al-Monitor and the Los Angeles Times.
Major French retailers hit by the breach included E.Leclerc, Carrefour, Coopérative U, Monoprix, and Intermarché along with its Netto discount chain. Specific store tallies and peak temperatures varied across outlets: the BBC reported that more than 100 Coopérative U locations and 180 Intermarché and Netto stores were affected, whereas Al Jazeera, citing French news agencies, reported at least 300 Intermarché and Netto stores, more than 100 Coopérative U locations, 80 Carrefour supermarkets, and roughly 5 percent of Monoprix’s 490 outlets. In some supermarkets, fridge temperatures rose to 50 degrees Celsius (120 degrees Fahrenheit) overnight according to the BBC and Al Jazeera, while Al-Monitor reported temperatures reaching up to 80 degrees Celsius.
In several stores, the extreme heat melted equipment and sparked fires that set off overhead sprinklers, causing additional water damage, The Guardian and Al Jazeera reported. Both The Guardian and Al-Monitor also reported that hackers accessed the temperature control systems of three French blood banks and cold-storage facilities holding blood products in November, though staff detected and stopped those intrusions before major damage occurred.
Wider European Wave and U.S. Military Base Inquiries
A second wave of cyberattacks on Nov. 2 disrupted refrigeration units at more than 100 stores across other parts of Europe. The BBC reported that supermarkets in seven countries were affected, naming Belgium, Luxembourg, Sweden, Ireland, the Netherlands, Estonia, and Finland, while Al-Monitor reported that at least 11 European countries experienced disruptions, adding Germany, Italy, Portugal, and Spain. French officials and the BBC noted it is not yet publicly known whether the November European wave is directly linked to the October attacks in France.
Two Russian-aligned hacktivist groups claimed responsibility for the freezer disruptions on Nov. 4, but cybersecurity specialists and investigators largely dismissed their claims.
Investigators are also examining earlier incidents outside Europe. In August, refrigerators at a small number of U.S. military bases malfunctioned and spoiled food supplies, which Reuters reported is being investigated as a potential deliberate cyberattack. On Monday, the Pentagon stated it was “aware of speculation regarding a potential cyber incident” and confirmed that U.S. military investigators are looking into the August malfunctions.
The attribution comes amid heightened diplomatic tensions between Paris and Tehran. The BBC noted that several Iranian politicians and commentators have argued in recent weeks that Iran should expand retaliation beyond the Middle East if the United States and Israel resume the war started earlier in 2026. The Guardian also reported that Iran-linked hackers were previously blamed in August for a cyberattack that shut down a power plant in the United Kingdom, and that France recently dropped its prior opposition to EU-wide sanctions against the IRGC as it prepares to push for new European penalties alongside the Paris prosecutor’s criminal probe.