France Blames Iran's Revolutionary Guard for Supermarket Freezer Cyberattacks on 700 Stores, Seeks EU Sanctions

France on Monday, November 9, 2026, formally blamed Iran’s Islamic Revolutionary Guard Corps (IRGC) for cyberattacks that sent temperatures soaring in supermarket refrigerators and freezers at about 700 sites across the country last month. Paris summoned Iran’s ambassador, opened a judicial investigation into the suspected hackers, and said it would seek European Union sanctions against those responsible.

Direct answer: On Monday, November 9, 2026, France formally accused Iran’s Islamic Revolutionary Guard Corps of carrying out cyberattacks on October 11–12 that overheated refrigeration units at about 700 French supermarket sites, causing food losses and at least 15 fires. French Foreign Minister Jean-Noël Barrot called the attack “unprecedented in both its scale and its level of aggression,” and Paris opened a judicial probe and said it would seek EU sanctions. The attribution is a government claim, not a court finding, and US intelligence agencies have reportedly held only a “low confidence” assessment that Iran was responsible.

What France Announced on Monday

Foreign Minister Jean-Noël Barrot made the announcement on the sidelines of the G7 foreign ministers’ meeting in Paris. “I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran,” Barrot said. “This attack is unprecedented in both its scale and its level of aggression.” He said the Iranian ambassador was being summoned to “strongly protest against this extremely serious act,” and that France would pursue sanctions at the European level. For the latest on the fallout, see the latest Iran updates here.

Paris prosecutor Laure Beccuau said in a separate statement that a formal judicial investigation had been opened into suspected organized cybercrime “committed to serve the interests of a foreign power — in this case, Iran.” The investigation targets the head of an offensive cyber unit called Shahid Kaveh and his two deputies, and French authorities have requested international arrest warrants.

How the October Attacks Unfolded

On October 11 and 12, hackers took control of the software that regulates temperatures in refrigeration units used by many French supermarkets. The software, provided by the Danish engineering firm Danfoss, allows retailers to manage their cold units remotely. The French report said about 700 commercial sites were targeted — roughly 700 of the country’s 10,000 supermarkets — and at least 15 fires broke out, with some reports putting the figure near 20. In many cases retailers had to throw away entire inventories of perishable food.

Supermarket chains affected included Carrefour, Monoprix, Intermarché and Coopérative U. France’s national cybersecurity agency, ANSSI, attributed the attack to Shahid Kaveh, a cyber unit it places inside the IRGC’s Electronic and Cyber Center. The unit is better known in the cyber world as CyberAveng3rs, an avatar through which it has claimed attacks in the past. A joint report by France’s intelligence and cyber agencies named three alleged associates of the unit: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand. ANSSI cited four attribution indicators: infrastructure characteristics, signature tools, a propaganda outlet linked to Shahid Kaveh that relayed the attack, and traces of Persian in the attack infrastructure. Its CERT-FR report, CTI-009, also attributes other cyberattacks against France since 2020 to a second unit, Shahid Shoostari, also affiliated with the IRGC.

What Is Not Yet Proven

The French attribution is a government claim, not a court finding, and several details remain unsettled. Reuters reported that it could not establish exactly how French authorities reached their conclusion. The New York Times reported, citing three sources, that US intelligence agencies held a “low confidence” assessment that Iran was responsible for the French refrigeration attacks. Reuters separately reported that Microsoft had privately linked Iran to the October attacks at least two weeks ago, according to three people familiar with the matter, and The Wall Street Journal reported that US officials confirmed the probes show the hallmarks of Iranian cyber tactics, although the investigation remains ongoing.

Russian hacktivists NoName057(16) and Z-Pentest had previously claimed responsibility for attacks against refrigeration systems across Europe, and similar attacks hit refrigeration systems in other European countries that authorities have not attributed. Iran has not publicly responded to Monday’s specific accusation, and Tehran routinely denies carrying out malicious cyber operations. European Union foreign policy chief Kaja Kallas said the response should be strong after learning of France’s attribution.

Why This Matters Now

France called the incident the first large-scale cyberattack aimed at sabotage on its national territory. The accusation lands amid the ongoing US–Iran war, which began on February 28, 2026, and as American, Russian and Ukrainian negotiators meet in Abu Dhabi this week. The G7 foreign ministers’ meeting in Paris, where Barrot made the announcement, is also discussing the wars in Ukraine and Iran and the security of strategic shipping routes.

Read our coverage of the Iran conflict here: Trump Says Iran War Is ‘Effectively Over’ After Qatar Talks — No New Strikes, Blockade Stays and Four Oil Tankers Hit Mines and Catch Fire in Strait of Hormuz as Iran Warns Waterway Closed to ‘Violating’ Ships.

Read Also:
Trump Says Iran War Is ‘Effectively Over’ After Qatar Talks — No New Strikes, Blockade Stays
Missiles Intercepted Over Riyadh: Aramco Tower Damaged as Saudi Air Defenses Stop Attack

Frequently Asked Questions

What did France accuse Iran of doing?

On Monday, November 9, 2026, France formally accused Iran’s Islamic Revolutionary Guard Corps of carrying out cyberattacks on October 11–12 that overheated refrigeration units at about 700 French supermarket sites, causing food losses and at least 15 fires.

Who is Shahid Kaveh?

Shahid Kaveh is an offensive cyber unit that France’s cybersecurity agency ANSSI places inside the IRGC’s Electronic and Cyber Center. It is also known online as CyberAveng3rs. French investigators named three alleged associates: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand.

How did the attackers take over the freezers?

Hackers took control of refrigeration-control software provided by the Danish engineering firm Danfoss, which lets retailers manage cold units remotely. They raised temperatures in the units, forcing stores to discard perishable food and, in at least 15 cases, starting fires.

Has Iran responded to the accusation?

Iran has not publicly responded to Monday’s specific accusation. Tehran routinely denies carrying out malicious cyber operations, and Iran’s UN mission did not respond to a request for comment.

Is the French attribution proven in court?

No. The attribution is a government claim based on ANSSI’s technical indicators, including Farsi traces and Iran-linked infrastructure. A judicial investigation has been opened, but the allegations remain subject to judicial examination. US intelligence agencies reportedly held only a “low confidence” assessment that Iran was responsible.

What happens next?

France has summoned Iran’s ambassador, opened a judicial investigation with international arrest warrants requested, and said it will seek European Union sanctions against those involved. EU foreign policy chief Kaja Kallas said the response should be strong.

Related: Trump Says Iran War Is ‘Effectively Over’ After Qatar Talks • Four Oil Tankers Hit Mines and Catch Fire in Strait of Hormuz • Missiles Intercepted Over Riyadh: Aramco Tower Damaged