France Blames Iran’s Revolutionary Guard for the Supermarket Fridge Cyberattacks

France has publicly blamed Iran’s Revolutionary Guard for the cyberattacks that turned supermarket fridges and freezers across Europe into fire hazards last month. In an announcement on Monday, 9 November 2026, French Foreign Minister Jean-Noël Barrot said the attacks were carried out by the Islamic Revolutionary Guard Corps (IRGC), and Paris has asked for international arrest warrants for the leaders of the cyber unit it says was responsible.

It is the first time a government has formally named who it believes was behind the attacks. Until now, the hackers were unknown, and no group had claimed responsibility. France’s announcement changes the story from a strange cybercrime into a diplomatic confrontation — and it comes in the middle of a war between the United States and Iran that began in February 2026.

“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran,” Barrot said, speaking about the attacks on French supermarkets on 11 and 12 October.

He called the attack “unprecedented” in both its scale and its aggression, and described it as the first large-scale cyberattack carried out for sabotage on French national territory.

This article explains what France announced, what happened in October, how investigators say the attacks were done, and what is still not proven.

What France announced on Monday

Barrot’s statement was backed by action from the French justice system on the same day.

The Paris prosecutor’s office said it had opened a judicial investigation into an offensive cyber unit called Shahid Kaveh, which it said was affiliated with the electronic and cyber centre of the Revolutionary Guard. Paris prosecutor Laure Beccuau said the investigation was opened against the head of the unit, his two deputies, and any other people who might be identified.

The prosecutor’s office also said it had requested international arrest warrants against the three men.

Barrot said the Iranian ambassador in Paris had been summoned, and that France would seek sanctions against Iran at the European level. There was no immediate comment from Tehran on the French allegations. Iran routinely denies carrying out malicious cyber operations.

According to CNN, which cited the Paris prosecutors’ office, the case against the unit rests in part on “the use of Farsi and IP addresses pointing to devices located in Iran”. Farsi is the language spoken in Iran, and an IP address is the number that identifies a device on the internet.

It is worth being clear about the status of the accusation. France has named the unit and the people it believes are responsible, and it has opened a criminal investigation. But the detailed forensic evidence behind the accusation has not been made public. Reuters, which first reported on Monday that French officials suspected Iran, said it could not establish exactly how the French authorities had reached their conclusion, and that its sources spoke on condition of anonymity.

What happened in October

The attacks themselves took place over the weekend of 11 and 12 October. Hackers remotely connected to internet-linked refrigeration systems in supermarkets and switched on defrost cycles, raising the temperature inside fridges and freezers to as high as 50 degrees Celsius. Food spoiled, stock was destroyed, and fires broke out at several stores.

Around 700 retailers in France were affected, according to CNN. The supermarket groups hit included E-Leclerc, Intermarché, Carrefour, Monoprix and Cooperative U — some of the biggest names in French food retail.

The strange part, at the time, was what the attackers did not do. There was no ransom demand, and no group claimed the attack. That silence puzzled investigators, because most cyberattacks on businesses are done for money. An attack that simply destroys food and starts fires, with no demand attached, looked more like sabotage than crime.

France’s cybersecurity agency, ANSSI, later said the attackers had exploited what its director general, Vincent Strubel, called “elementary” security failures: refrigeration units left open to the internet and protected by weak passwords. The affected systems were internet-connected refrigeration units made by a Danish manufacturer.

The cost of the damage could run into tens of millions of euros across France, one supermarket owner estimated, according to Reuters.

The attacks did not stop in France

A second wave of attacks followed in early November. On 2 November, hackers hit supermarket groups Ahold Delhaize and Colruyt in Belgium and Luxembourg, and Swedish grocers ICA and Coop. More than 100 establishments across Europe were affected in that wave.

The second wave also reached French blood banks. Attackers targeted refrigerators used to store blood, and staff had to move blood supplies to different cold storage units to keep them safe.

Findivoza covered both waves as they happened: the attack on supermarkets across Europe, and the attempt to heat France’s blood supply.

The attacks on food refrigeration were alarming enough on their own. Food that is not kept cold goes bad, and in a large supermarket a single broken freezer can mean tonnes of wasted food. But the blood bank attacks showed something more worrying: the same weak point in refrigeration systems could be used against hospitals and medical supplies.

Who is Shahid Kaveh?

The unit France has named is Shahid Kaveh. According to the Paris prosecutor’s office, it is an offensive cyber unit affiliated with the electronic and cyber centre of the Islamic Revolutionary Guard Corps — the IRGC-CEC.

The Revolutionary Guard is a powerful branch of Iran’s armed forces. It runs its own military, intelligence and cyber operations, separate from Iran’s regular army. Western governments have accused its cyber units of attacks on banks, energy companies and government systems in the past. Iran denies carrying out such operations.

France has not published the names of the three men it wants arrested. It has identified them only by their roles: the leader of Shahid Kaveh and his two deputies. International arrest warrants, if issued, would mean the men could be detained if they travel to a country that recognises the warrants.

The accusation, if confirmed, would make the fridge hacks one of the most disruptive cyberattacks of the war with Iran that began in February. That war has already included scattered incidents of alleged cyber disruption on both sides.

There is also a possible American connection. In August, refrigerators in at least half a dozen military commissaries — the grocery stores on US military bases — stopped working. Pentagon investigators are treating those failures as a suspected cyberattack, and a person familiar with the matter told Reuters that the Pentagon considers Iran a suspect in that case too, although the investigation is still in progress. The Pentagon said on Monday that it was aware of speculation about a possible cyber incident but could not comment further for security reasons.

Why this matters beyond France

The fridge attacks matter for a simple reason: they show how an ordinary piece of equipment can become a weapon.

A supermarket fridge is not a military target. It is a machine that keeps milk cold. But when thousands of fridges are connected to the internet so they can be monitored and controlled remotely, they can also be reached by anyone who finds the password — including a hacker on the other side of the world.

That is what makes this attack different from the cyberattacks people usually hear about. Most cyberattacks steal data or lock up computers and demand money. This one broke physical things. It spoiled food, started fires and put blood supplies at risk. Security experts call this kind of attack “cyber-physical”: a digital attack with real-world effects.

The attack also shows how the war with Iran is being fought in places far from any battlefield. France is not a party to the war, but its supermarkets were attacked anyway. If France’s accusation is correct, a military cyber unit used a civilian target — food shops — to send a message or cause disruption in a country that was not fighting it.

For businesses, the lesson is practical. The attackers got in through basic weaknesses: devices connected directly to the internet and weak passwords. France’s cybersecurity agency has been warning for years that internet-connected industrial equipment needs proper protection, and this attack is now the clearest example of what happens when that warning is ignored.

What is still not proven

For all the detail in France’s announcement, some important questions remain open.

First, the evidence has not been shown in public. France says its case rests on the use of Farsi and on IP addresses pointing to devices in Iran. That is a starting point, but it is not proof on its own: IP addresses can be faked, and skilled hackers often work through computers in other countries to hide where they really are. Reuters said it could not establish how the French authorities reached their conclusion.

Second, Iran has not responded. Tehran routinely denies carrying out cyberattacks, and it may issue a formal denial in the coming days. Until the evidence is tested — in court, or by independent experts — the accusation remains exactly that: an accusation, even though it comes from a government and its prosecutors.

Third, it is not yet clear whether the second wave of attacks in November, or the blood bank attacks, were carried out by the same unit. France’s statement focused on the October attacks on French supermarkets. The prosecutor’s investigation may cover the wider campaign, but that has not been confirmed.

None of this means France’s accusation is wrong. Governments usually only make a public attribution like this when they are confident in their intelligence. But the history of cyberattacks is full of cases where the first suspect turned out to be wrong, and where the evidence took months or years to come out.

What happens next

Several things are now in motion.

The French judicial investigation will continue, and the arrest warrants for the three men will be circulated internationally. In practice, arrest warrants for members of a foreign military cyber unit rarely lead to an arrest, because the people named do not travel to countries where they could be detained. But the warrants still matter: they put the men’s names on international lists and make it harder for them to move freely.

France will also push for sanctions against Iran at the European level. That could mean asset freezes or travel bans on people linked to the cyber unit, or wider measures against the Revolutionary Guard. European sanctions need the agreement of member states, so that process could take weeks.

The European Union may also look again at the security of internet-connected equipment. The attacks have already prompted questions about why refrigeration units — and similar industrial systems — were reachable from the open internet at all. New rules requiring basic security, such as strong passwords and closed connections, are likely to be discussed.

For Iran, the accusation adds to the pressure it already faces. The war with the United States is in its ninth month, with no settlement in sight, and France’s public blame puts Tehran in a direct dispute with another major European power.

For shoppers, the immediate danger has passed. The affected stores have repaired or replaced their systems, and the food on sale is safe. But the attack is a reminder that the systems keeping everyday life running — fridges, power grids, water supplies — are now part of the battlefield, whether we like it or not.

Why this story matters

This is not only a story about fridges. It is a story about how war has changed.

A decade ago, an attack on a country’s food supply would have meant bombs or a blockade. Now it can mean a few lines of code, sent from thousands of kilometres away, that tell a freezer to heat up instead of cooling down. No soldiers cross a border. No missile is fired. But the food still spoils, the fires still start, and the damage still costs millions.

France’s decision to name Iran publicly is also a message in itself. Governments usually keep cyber intelligence secret. When they publish it, they are trying to deter the next attack — and to show their own people that they know who did it and are doing something about it.

Whether the evidence holds up, and whether sanctions or arrest warrants change anything, will become clear in the weeks ahead. For now, the fridges are fixed, the food is back on the shelves, and the question of who turned up the heat has, for the first time, an answer — from France, at least.

Frequently asked questions

What did France accuse Iran of?

France’s foreign minister said on 9 November 2026 that the Islamic Revolutionary Guard Corps carried out the cyberattacks on French supermarket fridges and freezers on 11 and 12 October. Paris prosecutors have opened a judicial investigation and requested international arrest warrants for the leader of a cyber unit called Shahid Kaveh and his two deputies.

What did the hackers actually do?

They remotely connected to internet-linked refrigeration systems in supermarkets and switched on defrost cycles, raising temperatures to as high as 50 degrees Celsius. Around 700 retailers in France were affected, food was spoiled, and fires broke out at several stores.

Which supermarkets were hit?

In France, the groups affected included E-Leclerc, Intermarché, Carrefour, Monoprix and Cooperative U. A second wave in November hit Ahold Delhaize and Colruyt in Belgium and Luxembourg, and ICA and Coop in Sweden. French blood banks were also targeted.

How did the attackers get in?

According to France’s cybersecurity agency, the attackers exploited basic security failures: refrigeration units left open to the internet and protected by weak passwords.

Has Iran responded?

There was no immediate comment from Tehran on the French allegations. Iran routinely denies carrying out malicious cyber operations.

Is the evidence public?

No. Prosecutors cited the use of Farsi and IP addresses pointing to devices in Iran, but the detailed forensic evidence has not been released. Reuters said it could not establish how the French authorities reached their conclusion.

What happens next?

France has summoned the Iranian ambassador, will seek sanctions at the European level, and has requested international arrest warrants. The judicial investigation continues.

Sources

• Reuters: French officials suspect Iran is behind refrigerator hacks — https://www.reuters.com/world/french-officials-suspect-iran-is-behind-refrigerator-hacks-sources-say-2026-11-09/
• CNN: France blames Iran for ‘unprecedented’ supermarket fridge cyberattack — https://www.cnn.com/2026/11/09/europe/france-accuses-iran-of-fridge-cyberattack
• Al Jazeera: France accuses Iran of cyberattack on supermarket fridges — https://www.aljazeera.com/news/2026/11/9/france-accuses-iran-of-cyberattack-on-european-fridges
• WION: ‘Carried out by IRGC’: France blames Iran for cyber-attacks on supermarket refrigerators — https://www.wionews.com/world/carried-out-by-irgc-france-blames-iran-for-cyber-attacks-on-supermarket-refrigerators-1794243305594/amp
• The Telegraph India: France suspect Iran behind cyberattack that turned supermarket refrigerators into fire hazards — https://www.telegraphindia.com/world/france-suspect-iran-behind-cyberattack-that-turned-supermarket-refrigerators-into-fire-hazards/cid/2188647

This article is for general information and education only. It is not legal or financial advice.