The key facts

  • France has for the first time officially accused the IRGC of a cyberattack on its territory; the October 11–12 attack affected about 700 supermarkets
  • A judicial investigation has been opened against the head of the Shahid Kaveh group and his deputies; international arrest warrants have been requested
  • Similar attacks on November 2 affected supermarkets in seven more European countries; a connection to the October attack has not been confirmed

Official accusation and Paris's reaction

On November 9, France officially accused Iran of orchestrating cyberattacks on supermarket refrigeration equipment. Foreign Minister Jean-Noël Barrot, speaking after a meeting of G7 ministers in Paris, said that responsibility lies with the Islamic Revolutionary Guard Corps (IRGC) and called the attack 'unprecedented in scale and level of aggression' — according to him, it was the first major act of sabotage on the country's national territory. He promised to push for EU-level sanctions against everyone involved and noted that the case has been referred to the French judiciary. This was reported by BBC News and TechCrunch.

What happened in October

The attack took place on the night of October 11–12: attackers gained remote access to web controllers of industrial refrigeration units and manually raised the temperature, causing fresh and frozen products to spoil. According to euronews, more than 700 stores out of roughly 10,000 supermarkets in France were affected, including stores of the Carrefour, Monoprix, Intermarché and Coopérative U chains; in some cases the units heated up so much that fires broke out. The French Foreign Ministry estimated the damage at tens of millions of euros, although the BBC spoke of damage 'in the millions of euros' — the estimates differ. Individual stores, according to Life.ru citing Reuters, reported losses in the hundreds of thousands of euros.

Investigation and diplomatic measures

As reported by Anadolu citing Le Figaro, French intelligence linked the attack to an IRGC cyber unit. The Paris prosecutor's office has opened a judicial investigation against the head of the Iranian group Shahid Kaveh — an offensive cyber unit linked to the IRGC's Electronic and Cyber Center — as well as two of his deputies and other individuals who may be identified; international arrest warrants have been requested. Iran's ambassador was summoned to the Foreign Ministry: the ministry's spokesperson Pascal Confavreux called the attacks 'unjustifiable' and in violation of international law, and said France reserves the right to take additional measures. Iran has not yet responded to the accusations; TechCrunch notes that a representative of Iran's consulate in New York did not comment on the situation.

A wave of attacks across Europe and other targets

The attack on France did not remain an isolated incident. Last week, on November 2, similar malfunctions affected dozens of supermarkets in seven more countries — Belgium, Luxembourg, Sweden, Finland, Ireland, the Netherlands and Estonia, where the temperature in some units rose to +55 °C; the BBC emphasizes that it is unknown whether these incidents are connected to the October attack. According to TechCrunch, hackers also attempted to breach refrigeration units at blood banks, but the attack was stopped before any blood was spoiled — this was confirmed by the French Blood Establishment (EFS). Similar incidents involving freezers, according to TechCrunch, are also being investigated by US authorities at military bases: officials link them to Iran, but the intelligence community has not yet made a formal public statement. DW adds that security researchers pointed to a vulnerability in the web controllers, and some of the affected models from the Danish company Danfoss no longer receive security updates.

What's next

The EU High Representative for Foreign Affairs, Kaja Kallas, said that the Foreign Affairs Council meeting on November 16 will be an occasion to discuss cyberattacks across Europe: 'If involvement is proven, our response must be more resolute.' French authorities also recalled Iran's previous 'destabilizing actions' against France — the hack of Charlie Hebdo in 2023 and incidents during the 2024 Olympics. Key questions remain open: Iran has neither acknowledged nor denied the accusations, the connection between the November wave of attacks and the October attack has not been established, and Paris has not disclosed the specific content of the European sanctions.