France Blames Iran-Linked IRGC Unit for Attacks on 700 Supermarket Fridges

Cyberattackers linked to Iran's Islamic Revolutionary Guard Corps sabotaged refrigeration systems in roughly 700 French grocery stores during the night of 11–12 October, raising temperatures inside fridges and freezers by as much as 50 degrees Celsius. France now attributes the operation to Shahid Kaveh, an affiliate of the IRGC's cyber unit, and Foreign Minister Jean-Noel Barrot said Paris is considering retaliation.

Barrot warned that France is "not ruling anything out" in its response. Speaking to Franceinfo radio, he said possible measures include barring responsible individuals from European territory and freezing their assets. Paris is also preparing to propose new European sanctions against Iranian individuals and entities allegedly involved.

What did the attacks hit?

The operation struck major chains including Intermarche, E. Leclerc, Carrefour, Monoprix and Cooperative U. The disruption caused food spoilage, fires and damage estimated at tens of millions of dollars, according to findings presented by French authorities.

Investigators traced Farsi language use and internet protocol addresses pointing to devices in Iran. The Paris Prosecutor's Office said the cyberattacks were carried out in the interests of a foreign power, identified as Iran.

The attackers gained remote access to refrigeration controllers supplied by Danish engineering company Danfoss and Italian manufacturer Dixell. Through web interfaces, they initiated continuous defrost cycles and disabled safety alerts designed to warn operators when temperatures crossed critical thresholds. The manipulation heated refrigeration units, compromised food storage and triggered fires in some locations.

Paris chief prosecutor Laure Beccuau said investigators are seeking international arrest warrants connected to the operation.

How serious is the precedent?

France's Ministry for Europe and Foreign Affairs described the incident as an unprecedented cyber campaign in terms of its scale and aggressiveness. It called the operation the first cyber offensive against French territory conducted purely for sabotage. The ministry said the attacks threatened critical infrastructure, violated international law and could not be justified.

France summoned Iran's ambassador on November 10. Tehran rejected the allegations the same day, describing them as baseless and malicious. Iran's Foreign Ministry accused France of making repeated allegations to divert attention from its policies toward Iran and West Asia, and said the accusations aimed to damage its international image.

France has previously attributed cyber operations to Iranian-linked actors, including attacks on the satirical publication Charlie Hebdo in 2023 and the Paris Olympics in 2024. Those allegations led to European sanctions in March 2026 against the Iranian private company Emennet Pasargad.

How far did the campaign spread?

During November, retailers in Belgium, Luxembourg, the Netherlands, Finland, Ireland and Sweden reported losses after similar refrigeration systems were targeted. French blood banks were also hit on November 2. The French Blood Establishment said temperature and defrost settings in cold-storage units holding blood products and samples had been altered to excessively high levels.

The incidents have sharpened European concern over attacks on essential services. A separate wave of hoax bomb threats has disrupted passenger flights across the region, forcing several aircraft into emergency landings.

For retailers, the case exposes a concrete vulnerability: standard web-connected refrigeration controllers from mainstream suppliers can be turned into instruments of destruction. France's next steps will likely combine diplomatic action with a push for wider European measures against those named by investigators, and Barrot's warning leaves further action against Tehran open.