France accuses Iran’s Revolutionary Guards of supermarket fridge cyberattacks

France accuses Iran’s Revolutionary Guards of supermarket fridge cyberattacks
View of empty refrigerators after a cyberattack targeted refrigeration systems at French supermarket chains, causing food losses and fires, France, 13 October 2026.
Reuters

Paris summons Tehran’s envoy and seeks EU sanctions after hackers overrode refrigeration units at 700 sites, starting at least 15 fires.

France has accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of carrying out the cyberattacks that sent temperatures soaring in fridges and freezers at supermarkets across the country last month. Paris has threatened European sanctions in response.

Foreign Minister Jean-Noël Barrot said on Monday that the attack was “unprecedented in both its scale and its level of aggression”. He said France would “implement sanctions at the European level against all those responsible for this attack”.

“It marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people,” Barrot said.

The Iranian ambassador was summoned to the foreign ministry to receive what Barrot called “a very strong protest against this extremely grave act”. He added that France would take “any other necessary and proportionate measures” to respond and to “deter anyone who might seek to repeat it”.

Iran has not yet responded. Its mission to the United Nations did not reply to messages seeking comment. Tehran routinely denies carrying out malicious cyber operations.

France made its announcement minutes after Reuters reported that investigators privately suspected Iran of being behind the attacks.

Prosecutors target IRGC unit

Also on Monday, Paris prosecutor Laure Beccuau said an investigation had been opened into the head of an offensive cyber unit linked to the IRGC and his two deputies.

She named the unit as Shahid Kaveh, which she said was affiliated with the IRGC’s electronic and cyber centre.

A joint report by France’s intelligence and cyber agencies named three alleged associates of the unit: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand. The report included their photographs. Reuters could not immediately find contact details for the men.

According to the report, the hackers operated through several front groups posing as vigilante hackers, including “CyberAveng3rs” and “Cyber Isnaad Front”.

How France made the link

The report said investigators connected Shahid Kaveh to the hacks in three ways. They tied the incidents to the digital infrastructure used to sabotage the fridges. They matched the pattern of the intrusions to other hacks by the unit. And they found traces of Farsi in the attack infrastructure.

Reuters could not establish exactly how French authorities reached their conclusion. Attributing cyberattacks is notoriously difficult, because hackers can conceal their locations.

According to three people familiar with the matter, Microsoft had privately linked Iran to the October attacks at least two weeks earlier. Microsoft declined to comment.

On 11 October, hackers took control of the software that regulates temperatures in refrigeration units used by many French supermarkets. The software, provided by the Danish engineering firm Danfoss, allows retailers to manage their cold units remotely.

Temperature controls were overridden overnight. In some stores, fridges reportedly reached 50C (120F). Some units were heated so much that they caught fire.

The French report said 700 commercial sites were targeted and at least 15 fires broke out. Most of the sites were supermarkets, but small butchers’ shops, a slaughterhouse and food-processing factories were also hit.

More than 100 Coopérative U supermarkets were affected, along with 180 Intermarché and Netto stores. Carrefour, Monoprix and E.Leclerc were also hit.

In the hours after the attack, staff carried boxes of spoiled meat and melted ice cream to large rubbish containers. Fresh and frozen food worth millions of euros was ruined. One French supermarket owner estimated that the total cost nationwide could reach tens of millions of euros.

Cybersecurity experts had previously told Reuters that the attack appeared easy to carry out. The company behind many of the affected units said that several were obsolete or running outdated firmware, which could have made them easier to break into.

Earlier this month, a second wave of attacks hit more than 100 establishments in seven other European countries. Supermarkets in Belgium and Luxembourg were affected, as were a smaller number of shops in Sweden, Ireland, the Netherlands, Estonia and Finland.

Refrigerators used by French blood banks were also affected, forcing staff to move some blood supplies to other cold storage.

It is not known whether the two waves are linked.

On Wednesday, two Russian-aligned hacktivist groups claimed responsibility for the attacks, but few believed them.

The simplicity of the hacks, and the fact that they were repeated in several countries, had fuelled speculation about the culprits.

Concerns include Russia’s suspected sabotage campaign in Europe, the war between the U.S. and Iran, and the global rise of AI-powered cyberattacks. Iran was on experts’ list of possible suspects.

Earlier attack on U.S. military bases

The European attacks were preceded by at least one similar incident in the U.S.

In August, refrigerators at no fewer than six U.S. military commissaries stopped working. Pentagon investigators are treating the failures as a suspected cyberattack and are working with French officials, Reuters reported last month.

A person familiar with the matter said the Pentagon considers Iran a suspect but that the investigation is continuing. The news website Nextgov first reported that the military regarded Iran as a suspect.

The Pentagon said on Monday that it was “aware of speculation regarding a potential cyber incident”. It said military investigators were working on the case but that it could not comment further for security reasons.

Reuters could not independently establish whether the U.S. incidents, the attacks in France and the later wave across Europe were connected.

Read more:

Tags