France has accused Iran’s Islamic Revolutionary Guard Corps of orchestrating cyberattacks against supermarket refrigeration systems, turning an October food-spoilage incident into a diplomatic confrontation and a criminal investigation. Foreign Minister Jean-Noël Barrot said nearly 700 food-distribution sites were targeted across France.
Speaking in Paris on Monday, November 9, Barrot promised a European sanctions response and said the Iranian ambassador had been summoned. The Washington Post reported France’s attribution, following attacks that remotely changed temperature settings and forced retailers to discard spoiled goods.
The new allegation follows The Eastern Herald’s earlier coverage of the French supermarket freezer attacks. Monday’s announcements identify an alleged state-linked perpetrator; they do not mean a court has established the suspects’ guilt.
How refrigeration controls became a sabotage target
The attacks occurred on October 11 and 12, according to AFP’s account of the French announcements. Paris prosecutor Laure Beccuau said attackers accessed equipment through web interfaces and triggered abnormal defrost cycles that continued indefinitely. Sensor alerts designed to warn when temperatures exceeded safe thresholds were disabled at the same time.
That combination interfered with both cooling and the warnings intended to reveal a problem. Some supermarkets lost entire inventories of perishable food. Reuters, in reporting carried by CBC, said the affected premises also included butcher shops, a slaughterhouse and food-processing factories, rather than supermarkets alone.
The roughly 700 figure describes commercial or food-distribution sites, not individual refrigerators. The public accounts do not establish that every location sustained identical damage. Reuters reported through CBC that French authorities recorded at least 15 fires. The total financial cost remained unclear.
French investigators name an alleged Iranian cyber unit
French authorities attributed the operation to Shahid Kaveh, described as an offensive cyber unit affiliated with the Revolutionary Guards’ Electronic and Cyber Centre. AFP reported that French security agencies associated the unit with the CyberAveng3rs identity used to claim previous attacks.
The Paris prosecutor’s office opened a judicial investigation involving the unit’s leadership. Reuters reported that prosecutors requested international arrest warrants against its leader and two deputies. The suspected offences include organized cybercrime committed to serve a foreign power’s interests.
Investigators cited similarities with earlier intrusions, traces of Farsi and internet addresses linked to devices in Iran. Those are elements of France’s stated attribution, not independent proof presented by this publication. Reuters said it could not establish exactly how French authorities reached their determination.
Sanctions promised, but wider connections remain uncertain
Barrot described the operation as unprecedented in scale and aggression and characterized it as France’s first large-scale cyberattack intended for sabotage. He said France would pursue sanctions at European level and consider other necessary, proportionate measures to respond and deter further attacks.
Those statements announce a proposed response, not completed sanctions. AFP also reported similar refrigeration incidents elsewhere in Europe on November 2. Reuters cautioned that it could not independently establish links between the French campaign, later European incidents and suspected refrigeration interference at US military commissaries.
Remote-access security comes into focus
Reuters reported that the manufacturer behind many affected units said some were obsolete or running outdated firmware. That raises security concerns but does not, by itself, identify the precise vulnerability or access route used in every intrusion.
For wider context, CISA’s internet-exposure guidance recommends removing unnecessary remote access, changing default passwords, patching equipment and replacing unsupported devices. Necessary remote connections should use managed security controls and strong authentication. This is general defensive guidance, not a finding about the French case. The investigation and attribution dispute remain distinct from those broader lessons.
