France blames Iran's Revolutionary Guards for sabotaging fridges at 700 supermarket sites

What France announced

France's Ministry for Europe and Foreign Affairs said in a statement on November 9, 2026, that it attributes the October attacks on supermarket refrigeration controls to Iran. It named Shahid Kaveh, an offensive cyber unit affiliated with the electronic and cyber center of Iran's Islamic Revolutionary Guard Corps (IRGC), as the unit that carried them out. The ministry called it the first cyberattack campaign on French territory carried out purely for sabotage.

"I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran," Foreign Minister Jean-Noël Barrot said on the sidelines of a G7 foreign ministers' meeting in Paris, according to France 24. He said the attack was "unprecedented in both its scale and its level of aggression."

France's Cyber Crisis Coordination Centre (C4) set out the evidence in a joint report, published by CERT-FR, the incident response team of the national cybersecurity agency ANSSI. The C4 brings together ANSSI, the military's cyber command, and the DGSE and DGSI intelligence services, The Record reported.

What happened in October

On the night of October 11 to 12, 2026, attackers broke into the refrigeration controllers of about 700 retail sites in France and changed their defrost settings to high temperatures, according to the C4 report. The changes caused large losses of goods and, in at least 15 cases, fires. The French foreign ministry estimated the food losses at several tens of millions of euros.

Most victims were supermarkets, including stores of the Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché groups, the report said. The attackers also hit several small butcher shops, a slaughterhouse, and cooperative food processing plants, according to the report and BleepingComputer.

Paris prosecutor Laure Beccuau said the attackers took remote control of the equipment "to initiate abnormal, indefinite defrost cycles" while temperature alarms were "simultaneously disabled," France 24 reported. The C4 also linked attacks on Schneider Electric equipment at several small hydroelectric installations in France to the same campaign, with moderate effects on that equipment.

How France linked the attacks to Iran

According to the C4 report, the attackers used the same infrastructure in the same period to probe Schneider Electric industrial equipment, with techniques Shahid Kaveh has used since at least April 2026. They also used a search tool for internet-connected devices that the unit commonly uses. CyberBanNews, a propaganda outlet associated with the unit, publicized the attack from October 13, and investigators found traces of Farsi in the attack infrastructure.

Shahid Kaveh works mainly through online personas that pose as hacktivists, including CyberAv3ngers, Soldiers of Solomon, Mr. Soul, and Cyber Isnaad Front, the report said. An annex names Hamid Reza Lashgarian as head of the IRGC's electronic and cyber center, and Mahdi Lashgarian and Reza Salarvand as commanders of Shahid Kaveh.

US agencies identified Shahid Kaveh earlier in 2026 as another name for CyberAv3ngers, which they linked to disruptive attacks on US critical infrastructure, according to The Record. The US State Department had offered rewards of up to $10 million for information on six IRGC officials connected to the group's 2023 attacks on US water utilities, including both Lashgarians, The Record reported.

Reuters could not establish exactly how France reached its finding, CBC News reported. Microsoft had privately tied Iran to the October attacks at least two weeks earlier, Reuters reported, citing three people familiar with the matter. Microsoft declined to comment.

The report also blamed a second IRGC unit, Shahid Shoostari, also known as Emennet Pasargad, for earlier attacks on French targets. They include the January 2023 defacement and data theft at satirical weekly Charlie Hebdo's online shop and a 2024 attempt to hijack video display screens during the Paris Olympics. The intrusion was discovered before the attackers could display any images.

How France and others responded

France summoned Iran's ambassador, The Record and France 24 reported. The foreign ministry said France will propose new European Union sanctions against Iranian entities and individuals involved in the attack and in other malicious cyber activity. It reserved the right to take further public and non-public measures.

The Paris prosecutor's office opened a judicial investigation against the head of Shahid Kaveh, two of his deputies, and other suspects not yet identified, and requested international arrest warrants, The Record and France 24 reported. EU foreign policy chief Kaja Kallas said "our response should be strong," according to France 24.

Iran had not publicly responded to the accusations by the evening of November 9, The Record and NPR reported.

The November attacks and what operators should do

France attributed only the October attacks in France, not the later wave, BleepingComputer reported. The C4 report does not cover the second wave of refrigeration attacks in early November, which hit businesses in at least 11 European countries and three sites of France's national blood service, according to The Record. Reuters could not establish whether those attacks, the French campaign, and August refrigeration failures at US military commissaries are linked, CBC News reported.

CERT-FR's alert on the refrigeration attacks warns that attack campaigns against these controllers are probably still under way. It advises operators to remove the units from the internet and restore remote access only through a secure virtual private network (VPN) or a protected network. On November 5, the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and three other US agencies published a joint warning. It urges operators to use strong authentication, keep systems updated, and remove unnecessary remote access.