France blames Iran's Revolutionary Guards for supermarket fridge cyberattack
France formally attributed the October 2026 cyberattack on supermarket refrigeration systems to Shahid Kaveh, a cyber unit linked to Iran's Islamic Revolutionary Guard Corps, on Monday 9 November. The overnight attack hit more than 700 food sites, started fires and destroyed food worth tens of millions of euros, and Paris says it will push for new EU sanctions.
France has formally blamed Iran for the cyberattack that sent temperatures soaring in supermarket fridges and freezers across the country last month. In a statement on Monday 9 November 2026, the French Foreign Ministry attributed the attack to Shahid Kaveh, an offensive cyber unit it said is affiliated with the electronic and cyber centre of Iran's Islamic Revolutionary Guard Corps (IRGC).
The ministry said the attack, carried out overnight on 11–12 October, targeted refrigeration controllers at more than 700 retail food sites, caused "considerable" material damage and fires, and destroyed food worth an estimated several tens of millions of euros. Foreign Minister Jean-Noël Barrot said France was summoning Iran's ambassador and would seek new European Union sanctions. Iran had not responded officially by Monday evening, the BBC reported, though some Iranian media outlets dismissed the accusation as baseless.
What happened in the October supermarket fridge attack?
On the night of 11 October, attackers gained control of software used to manage refrigeration units in many French supermarkets, according to the BBC. The Paris prosecutor's office said the attackers "took remote control of the equipment via web interfaces to trigger abnormal defrost cycles of unlimited duration, while disabling the security alerts on the sensors that were supposed to activate once a certain temperature was exceeded", Politico reported.
In plain terms, cabinets that should have stayed cold were instructed to keep warming up, and the alarms that would normally have warned staff were switched off. The BBC reported that temperatures in some stores rose to 50C (120F) overnight. Staff the next morning threw away large quantities of spoiled meat and frozen food, Reuters reported.
The BBC said more than 100 Coopérative U supermarkets and 180 Intermarché and Netto stores were hit, along with stores run by Carrefour, Monoprix and E.Leclerc. It reported that the attack targeted remote-management software supplied by the Danish engineering company Danfoss. Reuters, in a report carried by CBC News, said the company behind many of the affected units had said several were obsolete or running outdated firmware, which security experts said could have made them easy to break into.
How much damage did it cause?
The French government puts food losses at "several tens of millions of euros". Figures for fires vary by source. A joint report by French intelligence and cyber agencies said at least 15 fires broke out, according to Reuters, while the Paris prosecutor's office put the number at about 20, according to Politico. Both describe the same mechanism: some units overheated badly enough to catch fire.
The report said most affected sites were supermarkets, but the attack also hit small butcher's shops, a slaughterhouse and food-processing factories, Reuters reported. No deaths or injuries have been reported in connection with the attack in the sources reviewed for this article.
How did France link the attack to Iran?
The Foreign Ministry's statement says France is "in a position to attribute" the attack to Iran after investigative work, and that the technical services of France's Cyber Crisis Coordination Centre (C4) have published a joint report on IRGC-linked cyber operations against French interests. The C4 brings together the national cybersecurity agency ANSSI, the foreign and domestic intelligence services, the defence procurement agency and France's cyber defence command.
According to Reuters, the report said investigators matched the pattern of the intrusion to other hacks by Shahid Kaveh and recovered traces of Farsi in the attack infrastructure. It also said the hackers operated through front groups posing as independent "hacktivists", including names such as "CyberAveng3rs" and "Cyber Isnaad Front". The report named three alleged associates of the unit; Reuters said it could not reach them for comment.
Reuters also reported, citing three people familiar with the matter, that Microsoft had privately tied Iran to the fridge hacks at least two weeks earlier. Microsoft declined to comment. Attribution of cyberattacks is difficult because attackers can disguise their location, and Reuters said it could not establish exactly how France reached its conclusion. The attribution is France's official finding; it has not been tested in court.
What is France doing in response?
Barrot, speaking on the sidelines of a G7 foreign ministers' meeting in Paris, called the attack "unprecedented in both its scale and its level of aggression". The Foreign Ministry said it was the first cyber-offensive campaign carried out purely for sabotage on French territory, and that it breached international law and United Nations norms on responsible state behaviour in cyberspace that Iran has endorsed.
France's stated steps are:
- Summoning Iran's ambassador to express its strongest condemnation.
- Proposing new EU sanctions against Iranian entities and individuals involved in this attack and in other malicious cyber activity.
- Reserving the right to take further "public and non-public" measures it judges necessary and proportionate.
Separately, Paris prosecutor Laure Beccuau said an investigation had been opened into the head of Shahid Kaveh and two deputies, the BBC reported. Reuters said the prosecutor's office had requested international arrest warrants for the three.
Kaja Kallas said after Barrot's statement that the matter would be discussed at next week's meeting of EU foreign ministers and that, if the attribution is confirmed, Europe's response "should be strong", according to Politico. EU agriculture and food commissioner Christophe Hansen called the attacks a "deliberate attempt to disrupt our food supply chain".
Were other countries hit?
Yes, though links between the incidents have not been established. The BBC reported that a second wave of attacks earlier this month hit more than 100 stores across Europe, mainly in Belgium and Luxembourg, with smaller numbers in Sweden, Ireland, the Netherlands, Estonia and Finland. Reuters said French blood banks were also affected, forcing staff to move blood to other cold storage.
In the United States, refrigerators at at least half a dozen military commissaries failed in August. Reuters has reported that Pentagon investigators are treating those failures as a suspected cyberattack and working with French officials. The Pentagon said on Monday it was "aware of speculation" but could not comment further for security reasons. Reuters said it could not establish whether the US, French and wider European incidents were connected. A pair of Russia-aligned hacktivist groups had earlier claimed responsibility, but the BBC said few believed them.
Has Iran targeted France online before?
The French Foreign Ministry says so. Its statement cites Iranian operations against the satirical weekly Charlie Hebdo in 2023 and against the organisation of the Paris 2024 Olympic Games. It notes that the EU adopted sanctions in March 2026 against the Iranian company Emennet Pasargad over its role in those operations.
The BBC noted that some commentators and politicians in Iran have argued in recent weeks that the country should extend any retaliation beyond the Middle East if the US and Israel resume the war they began earlier this year. Whether the fridge attack, if carried out by the IRGC, was part of a deliberate deterrence strategy remains unclear, the BBC said.
Why does a fridge hack matter?
The attack shows how everyday commercial equipment connected to the internet can become a route for sabotage. Supermarket refrigeration is increasingly managed remotely through web dashboards, which saves staff time but can expose systems if they are reachable online, unpatched or protected by weak credentials. Experts quoted by Reuters said the October attack appeared easy to carry out.
For shoppers, the immediate effects were empty freezer aisles and wasted food. For governments, the concern is wider: food supply chains count as critical infrastructure, and an attack that can spoil stock across hundreds of sites in one night is a new kind of pressure point. France's response, and whether the EU agrees sanctions, will be tested at the foreign ministers' meeting next week.
Image: Photo: Pierre Rudloff, public domain, via Wikimedia Commons (https://commons.wikimedia.org/wiki/File:Dia_int%C3%A9rieur.JPG) — December 2010 file photo of the frozen-food aisle in a Dia supermarket in Strasbourg; not one of the stores affected by the 2026 attack
About this article: prepared by The Daily Context editorial desk using automated, source-based reporting from the publications linked below. No reporter was on the ground.
Sources
- French Ministry for Europe and Foreign Affairs: Déclaration d'attribution à l'Iran de cyberattaques visant la France (9 November 2026, in French): https://www.diplomatie.gouv.fr/fr/presse-et-ressources/decouvrir-et-informer/actualites/declaration-d-attribution-a-l-iran-de-cyberattaques-visant-la-france
- BBC News (Ella Kipling and Joe Tidy): France accuses Iran of supermarket fridge hacking: https://www.bbc.com/news/articles/cmg474vk6dyqo
- Reuters via CBC News: France blames Iran for cyberattack that hacked supermarket refrigerators across the country: https://www.cbc.ca/news/world/france-iran-cyberattack-accusation-9.7415031
- Politico Europe (Victor Goury-Laffont): France blames Iran for cyberattacks targeting supermarket fridges: https://www.politico.eu/article/france-blames-iran-for-cyberattacks-targeting-supermarket-fridges/
Kabeer Ahmad
Kabeer Ahmad is the founder and editor of The Daily Context. He oversees the site's source-based coverage of world affairs, technology, business, entertainment, lifestyle and sports, and is responsible for its editorial standards, sourcing and corrections.
