France Blames Iran's Revolutionary Guards for Cyberattack on Fridges at 700 Supermarkets

French authorities have formally pointed to Iran as the source of the cyberattack that disabled refrigeration systems in about 700 supermarkets across France in October. On Monday, November 9, 2026, the Paris prosecutor's office opened a judicial investigation targeting the head of Shahid Kaveh, an offensive cyber unit linked to the Islamic Revolutionary Guard Corps (IRGC), along with his two deputies, and requested international arrest warrants against them. The same day, Foreign Minister Jean-Noël Barrot publicly accused the IRGC of carrying out the attack, describing it as unprecedented in both scale and aggressiveness.

The attack began during the night of Sunday, October 11 to Monday, October 12, 2026, while stores were closed. Hackers took remote control of internet-connected controllers that regulate the temperature of refrigerated cabinets, cold rooms and freezers. They forced the equipment into defrost cycles with no time limit, pushed some set points as high as 50°C (122°F) and switched off temperature alarms so that night staff and maintenance contractors would not be alerted. When employees arrived on Monday morning, fresh and frozen aisles were warm and entire stocks had to be thrown away.

The damage spread across most of the major French grocery networks. Les Mousquetaires reported around 300 compromised Intermarché and Netto stores, Coopérative U said nearly 100 of its outlets were hit, and Carrefour, Monoprix and E.Leclerc also confirmed affected locations. Images of empty freezers at an Intermarché store in Névez, in Brittany, quickly became a symbol of the incident. According to the prosecutor, the overheating equipment caused roughly twenty fires in stores, which turned a digital intrusion into a physical safety risk.

The compromised devices were mainly Danfoss AK-SM and AK-SC series controllers, along with Copeland and Dixell XWEB web interfaces. The Danish manufacturer Danfoss said most of the hijacked units were older models that no longer received security updates, and that it had advised customers for years to replace or patch them. CERT-FR, the incident response team of the French cybersecurity agency ANSSI, issued an alert on October 12 covering these product lines and warned that attack campaigns were probably still underway.

On October 21, ANSSI director general Vincent Strubel told French senators that the attack had been made possible by basic security failures rather than sophisticated techniques. The main entry points were refrigeration management interfaces exposed directly on the internet and protected by weak passwords. He also stressed that the same type of equipment is widely used outside retail, including in research laboratories and pharmacies that store vaccines.

The financial toll is heavy for the food retail sector. Intermarché chief executive Thierry Cotillard estimated that losses could reach tens of millions of euros nationwide for a single night, and early local reports put the damage at about 270,000 euros for just two stores in Alsace. Besides discarded meat, dairy, ready meals and frozen goods, retailers face repair or replacement costs for damaged compressors and controllers, and insurance brokers have warned that standard cyber policies often exclude physical losses. The French government stressed that the attack did not threaten the country's overall food supply, but stores had to restock cold aisles over several days and food suppliers absorbed sudden reorder peaks.

The investigation, led by the Paris prosecutor's cybercrime section with the national anti-cybercrime office (OFAC) and the domestic intelligence agency (DGSI), relied on several elements. Investigators cited a modus operandi typical of Shahid Kaveh, the use of the Persian language and IP addresses traced back to terminals located in Iran. The charges include fraudulent interference with an automated data processing system and damage by means dangerous to persons, both committed by an organized group with the aggravating circumstance of acting to serve a foreign power, in this case Iran.

The diplomatic response was swift. Speaking on the sidelines of the G7 foreign ministers' meeting in Paris, Jean-Noël Barrot said the Iranian ambassador was being summoned to protest against an extremely serious act and announced that France would push for European sanctions against those responsible. This marks a notable shift for Paris, which for years avoided naming state sponsors of cyberattacks and only began publicly attributing operations to foreign states based on its own intelligence in 2025, starting with Russia's military intelligence service.

Washington shares the suspicion. US officials also suspect Iran, and US agencies have previously linked Shahid Kaveh to the CyberAv3ngers persona, which compromised industrial controllers at US water utilities in 2023. In August 2026, several US military commissaries run by the Defense Commissary Agency experienced refrigeration failures, and Pentagon investigators have been working with French law enforcement. Microsoft had reportedly tied Iran to the October attack privately at least two weeks before the French announcement. Claims of responsibility made earlier by pro-Russian hacktivist groups are now contradicted by the French findings.

The threat has not stopped at the French border. During the night of November 1 to 2, 2026, a second wave hit refrigeration controls in supermarkets in Belgium, Luxembourg, the Netherlands, Sweden, Estonia, Finland and Ireland. Ahold Delhaize, Colruyt, Carrefour Belgium, ICA, Coop and an IKEA store in Mons were among the businesses affected, and Danfoss again confirmed that its products were involved. That same night, hackers reprogrammed cold storage units used by the French blood service (EFS) at three sites through its contractor Coolworld, attempting to raise freezer temperatures from minus 30°C to 110°C. Alarms allowed staff to react in time and no blood products were lost. French prosecutors have not attributed the November incidents to Iran so far, and Belgian federal prosecutors have opened their own investigation.

As of November 10, 2026, the case remains active on several fronts. Investigating judges will now handle the French probe, retailers are still assessing their final losses and insurance claims, and thousands of refrigeration controllers across Europe remain exposed online, with France still leading the number of reachable Danfoss interfaces worldwide. Security agencies urge store operators and maintenance companies to remove these interfaces from the public internet, change default and weak passwords, replace unsupported equipment and monitor temperatures through independent alarms that attackers cannot switch off remotely.