France blames Iran for cyberattacks on grocery store refrigeration systems

A diplomatic and cybersecurity threshold was crossed when French authorities formally accused Iran’s Islamic Revolutionary Guard Corps of orchestrating a mass sabotage campaign that manipulated commercial refrigeration systems across approximately 700 French grocery stores last month. The accusation, delivered on Monday in a five-page report by France’s Cyber Crisis Coordination Centre, ties the remote freezer hacking directly to Tehran's military infrastructure. The trigger for the public announcement came during a G7 ministerial meeting in Paris, where French Foreign Minister Jean-Noël Barrot confirmed the attribution and warned that the digital intrusions marked an unprecedented escalation. That assessment is backed by the Paris Prosecutor’s Office, which simultaneously launched a judicial investigation and requested international arrest warrants for the leadership of the specific IRGC cyber unit alleged to have carried out the operation.

The convergence of physical destruction and remote digital intrusion has left policymakers scrambling to respond to a new class of cyber-physical warfare. With supermarkets suffering inventory losses and at least 15 fires sparked by forced, indefinite defrost cycles, the incident demonstrates how vulnerable obsolete or outdated firmware in Internet of Things devices has become to hostile state actors. That vulnerability is further compounded by a second wave of attacks hitting blood banks and retail sites across European countries, raising urgent questions for corporate risk managers and insurers who must now determine how policies cover first-party property damage triggered by remote code execution. As European officials prepare for upcoming diplomatic councils to weigh sanctions against Tehran, the crucial question remains how Western governments can effectively deter state-sponsored operatives from weaponizing everyday commercial infrastructure without igniting broader geopolitical conflict.

Who is Shahid Kaveh and what evidence links the unit to the October 11 attacks?

French investigators identified the primary perpetrator as Shahid Kaveh, an offensive cyber unit operating under the IRGC Electronic and Cyber Center. According to disclosures from the Paris Prosecutor’s Office and the national cyber crisis report, the unit executed the intrusions by remotely accessing web-based equipment interfaces, altering defrost settings, and simultaneously disabling safety alarms designed to trigger when temperatures crossed specific limits. The forensic evidence left behind included Farsi text artefacts, specific tooling, and infrastructure utilized in reconnaissance on other industrial equipment. Prosecutors have opened an investigation against the head of the unit, along with two deputies. An annex to the official report names Hamid Reza Lashgarian as the head of the IRGC Electronic and Cyber Center, alongside Mahdi Lashgarian and Reza Salarvand as commanders of Shahid Kaveh. U.S. federal agencies have previously identified Shahid Kaveh under its alias, CyberAv3ngers, linking it to prior attacks on U.S. water utilities.

That trail connects the French grocery store sabotage directly to a broader pattern of global cyber-physical aggression. While Iran routinely denies conducting malicious cyber operations and had not publicly responded by Monday evening, the technical hallmarks of the attack match previous campaigns attributed to Tehran. The deployment of Persian-language indicators and infrastructure tied to Iranian internet service providers gave French intelligence services the confidence to make the first formal attribution of the October incidents.

How did the sabotage unfold across France and the rest of Europe?

The initial wave struck overnight on October 11 and 12, targeting refrigeration controllers at approximately 700 retail distribution sites across France. Major supermarket chains including Carrefour, Intermarché, Leclerc, Monoprix, and Coopérative U reported severe disruptions. Smaller businesses, including independent butchers, a slaughterhouse, and cooperative food-processing plants, were also hit. In many locations, hacked cooling units pushed internal temperatures up, spoiling fresh and frozen food, and causing at least 15 fires as overworked compressors failed. A second wave followed in early November, striking grocery stores and freezer systems in European countries, including British meat suppliers and three regional French blood banks. ANSSI also noted that the same Iranian hackers targeted Schneider Electric equipment at several small hydroelectric facilities, though the resulting disruptions there were moderate.

What actions are France and its European allies taking in response?

The French government moved swiftly on multiple fronts following the release of the crisis center report. Foreign Minister Jean-Noël Barrot announced that Iran’s ambassador to France had been summoned to the foreign ministry to receive a formal and vigorous protest. Barrot stated that Paris would pursue European-level sanctions against all individuals and entities responsible for the cyber-sabotage. EU foreign policy chief Kaja Kallas echoed that sentiment, indicating that the upcoming Foreign Affairs Council meeting on November 16 will provide a formal venue to debate a robust collective response if the attacks are attributed. Meanwhile, the Paris Prosecutor’s Office requested international arrest warrants for the named unit commanders. French authorities have emphasized that they are prepared to take any additional necessary and proportionate measures, public or otherwise, to deter future attacks on national territory.

1. August: Refrigeration units fail at U.S. military bases in incidents investigated as potential cyberattacks.
2. October 11 and 12: Hackers compromise web-based refrigeration controllers at approximately 700 retail sites across France, causing food spoilage and at least 15 fires.
3. November 2: A second wave of refrigeration tampering strikes businesses across European countries, alongside a cyberattack on three regional French blood-storage facilities.
4. November 9: France’s Cyber Crisis Coordination Centre publishes a five-page report formally blaming the IRGC unit Shahid Kaveh, prompting France to summon Iran's ambassador and launch international arrest warrants.

Ashley Jones, SVP, AI Risk and Advisory, Cyber & Technology Practice at Lockton, noted that the exploitation of connected operating systems brings physical losses firmly into cyber risk discussions, pointing out that threat actors increasingly target the Internet of Things to cause first-party property damage or business interruption without demanding traditional ransoms. Insurers and brokers are now forced to reevaluate policy wordings as clients confront exposures where a digital intrusion translates directly into melted inventory and structural fires. Yet, despite the detailed attribution provided by French authorities, crucial blind spots remain. It is still unclear whether the November wave across European countries and the U.S. military commissary failures in August are directly commanded by the same central authority or executed by splintered proxy networks. Furthermore, the absence of any public acknowledgment from Tehran leaves international investigators operating in an enforcement vacuum.

I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran. This attack is unprecedented in both its scale and its level of aggression.

Jean-Noël Barrot, French Foreign Minister, via Agence France-Presse

The harder question facing Western governments is how to establish an effective deterrent against state-backed hacktivists who exploit vulnerable, aging industrial controllers in civilian supply chains. As intelligence agencies and corporate risk officers parse the aftermath of the October incursions, the line between traditional military conflict and commercial cyber sabotage continues to blur. Whether European sanctions and international arrest warrants can constrain the IRGC's Electronic and Cyber Center remains the central unresolved issue for a continent whose critical infrastructure is increasingly wired to the internet.