“It marks the first large-scale cyber attack aimed at sabotage on our national territory, and it constitutes a major attack on the nation’s interests and the security of the French people,” said French Foreign Minister Jean-Noël Barrot.
French officials accused Iran’s Islamic Revolutionary Guard Corps of orchestrating a cyberattack that disabled commercial refrigerators and freezers across roughly 700 sites in France. Swathes of French supermarkets were hit during the intrusions on October 11 and 12.
Hackers remotely overrode digital thermostats to push internal temperatures above 50 degrees Celsius, spoiling fresh and frozen produce. Paris prosecutor Laure Beccuau stated that her office opened a judicial investigation against the head of Shahid Kaveh and two deputies. Beccuau described the entity as an offensive cyber unit tied to the electronic and cyber centre of the IRGC.
Investigators traced the operation using Persian language traces and IP addresses pointing to terminals inside Iran. Barrot stated that France summoned the Iranian ambassador to lodge a strong protest against the incident.
Grocery stores across nine other European countries were hit by a suspected cyberattack on their freezer systems on November 2.
A second wave of hacks struck dozens of stores in Belgium, Ireland, Luxembourg, and Sweden, forcing supermarket giants like Ahold Delhaize and Colruyt to throw out spoiled food. Security researchers identified the targeted units as internet-connected refrigerators made by Danish company Danfoss, which was no longer providing security updates.
Hackers changed equipment settings to initiate abnormal, indefinite defrost cycles while simultaneously disabling safety sensor alerts. It remains unclear if the November attacks in other European nations are directly linked to the earlier incident in France.
Hackers also accessed control systems at cold stores belonging to the French blood service, raising temperature and defrosting thresholds. Technicians received sensor warnings and disconnected the cold storage units before blood products were destroyed.
Gérôme Billois, a partner at cybersecurity firm Wavestone, noted that Shahid Kaveh had been active since 2020 and previously targeted water distribution systems in the United States. The incidents arrived while European officials warned of Russian sabotage risks amid support for Ukraine, alongside an ongoing conflict between the US and Iran that began with the killing of Supreme Leader Ali Khamenei on February 28.
“We will implement sanctions at the European level against all those responsible,” Barrot said. EU foreign policy chief Kaja Kallas added that the bloc’s response should be strong.
France previously dropped its opposition to designating the IRGC as a terrorist organization earlier this year, allowing the European Union to formalize the designation. Barrot stated that France would take any necessary and proportionate measures to deter future attacks.
The Paris prosecutor’s office opened an investigation targeting the head of Shahid Kaveh and his two deputies, identifying the entity as an offensive cyber unit affiliated with the Islamic Revolutionary Guard Corps.
The cyberattack targeted approximately 700 supermarket sites across France, spoiling fresh and frozen produce by overriding digital thermostats.
Security researchers reported that the attacks exploited internet-connected commercial refrigerators and freezers that lacked active firmware security updates.
Related reading