France Attributes Refrigeration Cyber Sabotage to Iran's IRGC and Pursues European Sanctions

France has formally accused Iran's Islamic Revolutionary Guard Corps of carrying out a cyber sabotage campaign against commercial refrigeration equipment, ending weeks of speculation about one of the most disruptive digital attacks ever recorded against European food retail. The attribution, published on November 9, 2026, names Shahid Kaveh, an offensive cyber unit inside the IRGC's Electronic and Cyber Center, as the actor responsible for the October 11 and 12 operation that reached roughly 700 food distribution sites across France.

The announcement was made at a G7 foreign ministers meeting in Paris, where Foreign Minister Jean-Noel Barrot told reporters he could confirm the IRGC's responsibility, describing the operation as unprecedented in both scale and aggression. Paris summoned Iran's ambassador to lodge what Barrot called a very strong protest, and the government said it would pursue sanctions at the European level against those responsible. Iran has rejected the accusations, calling them baseless and hostile.

The technical details are unusually concrete for a state linked operation. According to the French investigation, attackers remotely took control of refrigeration controllers through web interfaces and triggered abnormal defrost cycles of indefinite length, while simultaneously disabling the sensor alerts that would normally warn staff that temperatures had crossed a dangerous threshold. Temperatures at affected sites moved from as low as -27C to above 50C, a swing that ruined stock and, in a number of stores, started fires.

French retailers spent days discarding entire inventories of frozen and chilled food. The damage was concentrated in grocery chains but reached beyond them: hackers also accessed cold storage holding blood products, though the national blood service said technicians disconnected the systems before any products were destroyed. A second and broader wave followed in early November, hitting retailers in at least nine European countries and pushing the incident from a French national security matter into a continental one.

Key Facts

The Record reported on November 9 that French authorities accused the IRGC of sabotaging refrigeration at around 700 grocery stores, causing extensive food losses and at least 15 fires. The accusation came in a five page report published that Monday by France's Cyber Crisis Coordination Centre, known as C4, which brings together ANSSI, the military cyber command COMCYBER, the DGA procurement agency and the DGSE and DGSI intelligence services. The report identifies the perpetrators as part of Shahid Kaveh, an IRGC cyber unit previously linked to attacks on industrial controllers at United States water utilities.

Le Monde reported on November 9 that Barrot confirmed the attribution and that the Paris prosecutor's office opened a judicial investigation. Chief prosecutor Laure Beccuau said the investigation targets the head of Shahid Kaveh, his two deputies and any other individuals who may be identified. She described the unit's modus operandi as the use of Persian language and IP addresses tracing back to terminals in Iran. France requested international arrest warrants in connection with the case.

The Guardian reported on November 9 that the attackers overrode digital thermostats across as many as 700 shops, pushing temperatures from as low as -27C to well over 50C in some cases, destroying thousands of tons of food and sparking fires that triggered sprinklers. The newspaper reported that more than 100 Cooperative U supermarkets were affected, along with 180 Intermarche and Netto stores, and that the targeted software was supplied by Danish engineering firm Danfoss, which lets retailers manage cold units remotely.

Politico Europe reported on November 9 that the Paris prosecutor's office said about 20 fires had been started because of the cyberattack, a higher figure than the 15 cited in earlier reporting. European Council President Kaja Kallas said the matter would be discussed at the next European foreign affairs council and that Europe's response should be strong if the attribution is confirmed. European Agriculture and Food Commissioner Christophe Hansen described the operation as a deliberate attempt to disrupt the food supply chain.

The official French report, published as CERTFR-2026-CTI-009, attributes the campaign to two offensive cyber units, Shahid Shoostari and Shahid Kaveh, both operating within the IRGC Electronic and Cyber Center. It calls the refrigeration attack unprecedented in scale and level of aggression and places it alongside other operations observed since at least 2020. An annex names Hamid Reza Lashgarian as head of the IRGC Electronic and Cyber Center, with Mahdi Lashgarian and Reza Salarvand identified as Shahid Kaveh commanders. The United States has previously identified Shahid Kaveh as another name for CyberAv3ngers.

Analysis

The attribution is notable less for the identity of the culprit than for what it reveals about the target set. Shahid Kaveh has spent years going after operational technology, and its previous known campaigns focused on industrial control systems at utilities. What happened in France in October was the same playbook applied to a retail supply chain, where a thermostat is not a curiosity but the difference between a working freezer aisle and a fire. The attackers did not need to break encryption or write novel malware. They used reachable web interfaces, then turned a safety function into a weapon.

What this really means is that the boundary between critical infrastructure and everyday commerce has effectively collapsed. A supermarket chain is not usually discussed in the same breath as a water utility, yet the refrigeration controllers involved here are the same class of industrial equipment, managed remotely, often by third party software, and rarely treated as a security asset. The French report notes that the targeted software came from Danfoss, a Danish supplier, which means the exposure is a supply chain problem spread across many retailers and several countries. The second wave in early November, which hit more than 100 stores across Europe, is consistent with that reading.

The legal and diplomatic framing matters too. Beccuau's investigation covers charges including attacks on an automated data processing system and causing damage dangerous to persons, aggravated by serving a foreign power. That combination is a statement that France treats this as state action rather than ordinary crime, which is what makes European sanctions legally and politically plausible. Barrot's language, that the operation was the first large scale cyberattack aimed at sabotage on French national territory, sets a marker that future incidents will be measured against.

There is a caution embedded in the record. Cyber experts had previously raised concerns that the attacks might have been part of Russian hybrid warfare against Europe, and the Kremlin denied involvement. The French case instead points to Iran, supported by Farsi language artefacts and infrastructure used in reconnaissance on other industrial equipment. Attribution in this domain is rarely beyond argument, and Iran's denial, which called the claims baseless and hostile, will be tested by whether the European Union can convert a national finding into collective measures. The EU designated the IRGC as a terrorist organisation in January 2026, giving Paris a legal runway it would not have had a year earlier.

Why It Matters

The immediate consequence is that a category of attack once treated as theoretical now has a documented toll of ruined food, damaged buildings and disrupted blood collection logistics. Roughly 700 sites in one country, at least 15 fires by one count and about 20 by another, thousands of tons of food destroyed, temperatures driven from -27C to above 50C: these are not abstractions, and they are recoverable only at significant cost to retailers and to consumers.

The wider consequence is regulatory. Remote management software for refrigeration is now a demonstrated attack surface across borders, and the European Commission is already looking into the incidents. Expect pressure to treat retail and building operational technology with the same seriousness as energy and water systems, including mandatory logging, network segmentation and the removal of default or shared credentials on web interfaces. Retailers that outsourced cold chain management to third party platforms will need to ask who can reach those controllers and what happens when a sensor alert is silently switched off.

There is also a deterrence question. France has summoned an ambassador, opened a criminal investigation against named commanders, requested international arrest warrants and promised European sanctions. Whether that package changes Iranian behavior is unproven, but it does establish a public evidentiary record that other governments can adopt.

Next Up

BBC News reported on November 10 that Iran described the French accusations as baseless and hostile, and that the second wave affected more than 100 stores across Europe, including Belgium, Luxembourg and smaller numbers of shops in Sweden, Ireland, the Netherlands, Estonia and Finland. The European foreign affairs council is expected to take up the matter next week, and the commission's review is ongoing.

The near term test is whether the EU turns a French national attribution into a coordinated sanctions package and whether retailers and their software suppliers harden the interfaces that made this operation possible. The longer term test is whether operational technology in food retail is reclassified as critical infrastructure before another campaign, whether by the same unit or a copycat, demonstrates that the lesson was not learned.