France has formally attributed to Iran the cyberattack campaign that, overnight between 11 and 12 October, seized control of the refrigeration systems at more than 700 retail sites on French soil. In an attribution statement published on Monday, 9 November, the Ministère de l'Europe et des Affaires étrangères (Ministry for Europe and Foreign Affairs) said the operation caused extensive physical damage, fires and food losses estimated in the tens of millions of euros — and described it as the first cyber campaign carried out on French territory purely for the purpose of sabotage.
The French text names those it holds responsible: the offensive cyber unit Shahid Kaveh, linked to the electronic and cyber centre of the Islamic Revolutionary Guard Corps (IRGC). Paris called the episode "a campaign unprecedented in both its scale and its level of aggression" and said the attacks were "unjustifiable, inexcusable and contrary to international law".
What was hit
According to the Paris prosecutor's office, roughly 700 retail locations had their cooling equipment compromised on 11 October, with significant food spoilage and around twenty fires. The investigation covers, among other offences, fraudulent interference with an automated data-processing system, and targets the head of the unit and his two deputies — for whom French prosecutors have requested international arrest warrants.
Investigators' findings, as reported by CBS News, indicate the attackers reached the refrigeration controllers through internet-facing web interfaces, triggered abnormal defrost cycles and disabled temperature safety alerts. The use of Farsi in the systems and IP addresses traced to Iran were among the elements behind the attribution.
Also according to the US network, similar hacks later struck supermarkets in Belgium, Luxembourg and Sweden. In France, blood banks were targeted as well, though their products and samples were not damaged. In August, refrigeration failures at six US military bases prompted an investigation by the Army's criminal investigation division, still under way.
What Paris is doing
The French statement sets out three lines of response: summoning the ambassador of the Islamic Republic of Iran to France to receive the government's condemnation; proposing to European partners new sanctions against Iranian entities and individuals involved in this attack and in other malicious cyber activity; and reserving the right to take any further measures, public or otherwise, deemed necessary and proportionate.
On Tuesday, 10 November, Foreign Minister Jean-Noël Barrot sharpened the tone in remarks carried by AFP. He said France would take "all measures, including those we will not disclose publicly", with the aim of "deterring any new attack". Asked whether Iran was also behind actions against a contractor for the blood service, the bank Crédit Mutuel Arkéa and the public finances directorate, Barrot declined to answer, saying those investigations remain open.
The Quai d'Orsay statement places the episode within a longer series of Iranian destabilisation efforts in France, among them attacks aimed at the newspaper Charlie Hebdo in 2023 and at the Paris 2024 Olympic Games. In March 2026 the European Union had already sanctioned an Iranian entity over malicious cyber activity.
There was no immediate reaction from Iranian authorities to the French accusations.
Why this case is different
The technical detail is what measures the precedent: the target was neither a database nor a payment system, but the physical equipment that keeps the cold chain running. An attack that drives a compressor out of cycle and silences the temperature alarm produces fire and spoiled food, not a data leak — and that, in the French government's reading, moves the episode out of the category of espionage and into sabotage.
With information from the attribution statement of France's Ministry for Europe and Foreign Affairs, the Paris prosecutor's office, Al Jazeera, CBS News and AFP.
