PARIS — More than 700 supermarket sites in France had their refrigeration systems hacked last month, and France says Iran’s Islamic Revolutionary Guard Corps did it, according to a declaration from France’s Foreign Ministry. The attack spoiled food, started fires and caused losses put at tens of millions of euros.
The attribution came on Monday from Foreign Minister Jean-Noël Barrot, speaking on the sidelines of a G7 foreign ministers’ meeting in Paris. For Barrot, the scale and aggression were without precedent. It was, he said, the first large-scale cyberattack carried out purely for sabotage on French territory.
The attack came in the night of Oct. 11 to 12. Hackers reached the controllers that run fridges and freezers in stores across France and set them to defrost without stopping, prosecutors said. Temperatures in some units climbed to 50 degrees Celsius. Food spoiled in large quantities, and many stores had to throw away their entire refrigerated stock.
Paris prosecutor Laure Beccuau said the attack caused major food losses and about 20 fire starts. The Foreign Ministry put food losses alone at several tens of millions of euros. Most of the sites were supermarkets, but an abattoir, food-processing plants and small hydroelectric installations were also hit, French officials said.
How the fridges were reached
The controllers came from two suppliers, Danfoss in Denmark and Dixell in Italy. A technician can log in from anywhere to check a temperature or change a setting. In store after store, that login page was sitting on the public internet, waiting for whoever found it.
Once inside, according to prosecutors, the attackers set the units to defrost and kept them there, with no time limit. They also switched off the alarm probes that watch the temperature. Staff, in other words, got no warning as the cabinets warmed up.
At a Senate hearing on Oct. 21, ANSSI director Vincent Strubel was blunt about the security. Nobody, he said, had needed a sophisticated exploit. The equipment was online with little protection, and the passwords were weak.
Investigators said the method pointed in one direction. Beccuau said her office had found an operating mode characteristic of one unit, the use of Farsi and IP addresses tracing back to terminals located in Iran.
Investigation targets the unit’s chief and his deputies
Beccuau said a judicial investigation had been opened against the head of Shahid Kaveh, an offensive cyber unit affiliated with the Electronic and Cyber Center of the Revolutionary Guards, against his two deputies, and against any other person who may be identified. Her office has requested international arrest warrants for the three men.
A joint report by France’s Cyber Crisis Coordination Centre, which brings together ANSSI, the intelligence services, the armaments directorate and the cyberdefense command, named the three as Hamid Reza Lashgarian, who heads the Guards’ Electronic and Cyber Center, and Shahid Kaveh figures Reza Salarvand and Mahdi Lashgarian. The report attributed the October attack to Shahid Kaveh. It also linked a second Guards unit, Shahid Shoostari, to earlier attacks on French interests dating back to at least 2020, including the 2023 attack on Charlie Hebdo and an attempt against a video advertising company during the Paris 2024 Olympics.
Shahid Kaveh, also known as CyberAv3ngers, has mainly targeted industrial equipment in Israel and the United States, French authorities said, but it has also hit European countries. The group claimed a November 2023 attack on the Israeli industrial controls maker Unitronics and a sabotage campaign against Israeli refrigeration systems in March and April 2026.
Ambassador summoned, sanctions proposed
Iran’s ambassador in Paris was summoned on Tuesday morning and was received by the Foreign Ministry’s secretary-general, who delivered France’s firmest condemnation, the ministry said. Barrot had announced the summons on Monday.
Speaking on France Info television on Tuesday, Barrot said France would push for sanctions at the European level against those responsible. The Foreign Ministry said Paris would propose new European Union sanctions against Iranian entities and individuals involved in this attack and in other malicious cyber activity.
“We rule nothing out and will take all measures — including those we may not disclose publicly — that we deem proportionate and necessary to deter any further attacks.”
The aim, he said, was to deter anyone tempted to repeat such an attack, in Iran or elsewhere. Britain took a similar step last month, sanctioning two Iranian nationals and summoning Iran’s ambassador after assessing that the Revolutionary Guards had directed an incident at RAF Fairford.
Iran gave no immediate response to the French accusation on Monday. Its mission to the United Nations did not return requests for comment, according to Reuters, and Tehran routinely denies carrying out malicious cyber operations. The French attribution is a government finding, not a court judgment, and the judicial investigation is continuing.
Blood storage sites were hit two weeks later
A separate attack struck France’s blood service, the Établissement français du sang, in the night of Nov. 1 to 2. Temperature and defrost thresholds at three cold-storage sites for plasma were raised to extremely high levels, the blood service said in a statement on Nov. 3.
The weekly Le Canard enchaîné, which first reported that attack, said rooms normally held at minus 30 degrees Celsius had been set to reach 110 degrees. That figure was a setting imposed on the controls, not a temperature the rooms reached. Monitoring and alarms detected the change, a duty technician responded, and plasma bags were moved or secured.
No blood products or samples were compromised, no health consequences were identified and no blood products were lost, the blood service said. The attack reached the sites through their refrigeration equipment supplier, Coolworld. French officials have not attributed the blood service attack to Iran, and they have not established a link between it and the October supermarket attack.
Have something to promote?
Bring your business, services or event to our readers.