France formally accused Iran on Monday, November 9, 2026, of carrying out destructive cyberattacks against refrigeration systems at approximately 700 supermarkets and food businesses across the country. French officials said hackers linked to Iran's Islamic Revolutionary Guard Corps remotely changed temperature settings, destroying large quantities of refrigerated food and causing at least 15 fires.
The attacks took place overnight on October 11 and 12, affecting major supermarket chains and other food businesses. France's Foreign Ministry announced that it would summon the Iranian ambassador and seek European Union sanctions against those responsible.
The accusation follows similar refrigeration-related cyber incidents in several other European countries. However, investigators have not established that the attacks outside France were conducted by the same Iranian group.
Hackers Turned Supermarket Refrigerators Into Heaters
According to France's national cybersecurity agency, ANSSI, the attackers gained remote access to industrial refrigeration controllers at supermarkets and other food businesses.
Instead of stealing customer information or demanding ransom payments, the hackers manipulated the equipment responsible for maintaining safe food temperatures.
The attackers changed defrost settings and caused refrigeration equipment to reach temperatures as high as 50 degrees Celsius, or 122 degrees Fahrenheit. Some systems remained affected for approximately six hours.
Refrigeration systems normally use controlled defrost cycles to prevent ice from building up on cooling equipment. By altering those settings, the attackers effectively turned a routine maintenance function into a method of damaging food supplies and equipment.
The intrusion also interfered with temperature alerts intended to warn operators about unsafe conditions.
By the time workers discovered the problems, large quantities of fresh and frozen food could no longer be sold safely. Supermarkets had to remove affected products, empty refrigerated displays and inspect equipment before restoring normal operations.
ANSSI reported that the cyberattacks caused at least 15 fires. French prosecutors also described extensive property damage and significant financial losses.
The incidents demonstrate how cyberattacks can cause physical damage without requiring attackers to enter the facilities they target.
French Supermarkets Report Millions in Food Losses
The attacks affected numerous grocery chains, including Intermarché, Carrefour, E.Leclerc, Cooperative U, Casino and Metro.
Intermarché was among the hardest-hit retailers. The company reported losses amounting to tens of millions of euros in a single day as stores discarded spoiled products.
The destruction extended beyond frozen foods. Refrigerated meat, dairy products, prepared meals and other temperature-sensitive merchandise also became unusable when storage temperatures rose.
Several independent businesses were affected, including butcher shops and food-processing facilities.
French authorities reported that the attacks also reached an abattoir and cooperative food-production sites. These businesses depend on refrigeration systems to maintain safe conditions during storage and processing.
Photographs taken after the attacks showed empty refrigerated shelves and signs explaining why products were unavailable.
At some supermarkets, customers found entire refrigerated sections temporarily closed while employees assessed the damage.
The financial impact extended beyond replacing spoiled food. Businesses also faced equipment inspections, emergency repairs, interrupted operations and the costs associated with disposing of damaged inventory.
The French government has described the combined losses as amounting to several tens of millions of euros.
France Identifies Iranian Revolutionary Guard Cyber Unit
France's official accusation followed an investigation involving its national cybersecurity agency and other government security organizations.
Investigators attributed the attacks to a group called Shahid Kaveh, which French authorities identified as a cyber-offensive unit affiliated with the Islamic Revolutionary Guard Corps.
The group operates within the Revolutionary Guard's electronic and cyber operations structure, according to the government's investigation.
ANSSI said technical evidence included characteristics of the attack infrastructure, specialized tools, traces of Persian-language activity and connections to internet addresses associated with Iran.
Investigators also identified activity involving a propaganda outlet linked to Shahid Kaveh.
Together, those indicators led French authorities to formally attribute the operation to the Iranian unit.
The findings represent an official French government assessment rather than a determination by an international court.
Iran had not publicly responded to the latest allegations when the announcement was made. Tehran has previously denied responsibility for malicious cyber operations attributed to Iranian organizations.
Paris prosecutor Laure Beccuau announced a formal judicial investigation into suspected organized cybercrime carried out for the benefit of a foreign power.
Investigators are pursuing the group's alleged leader, two deputies and other individuals who may have participated.
French prosecutors are also seeking international arrest warrants for suspects connected to the operation.
France Summons Iranian Ambassador and Seeks Sanctions
French Foreign Minister Jean-Noël Barrot described the refrigeration attacks as an unusually serious act of cyber sabotage.
The Foreign Ministry said the operation represented the first large-scale cyber campaign conducted purely for sabotage on French territory.
France announced that the Iranian ambassador would be summoned to receive a formal protest.
The government also said it would propose additional European Union sanctions against Iranian individuals and organizations associated with the attacks.
Those measures could include restrictions on financial assets, travel and other activities, depending on decisions reached by European authorities.
France has also reserved the right to take additional responses that it considers necessary and proportionate.
Officials argued that targeting civilian refrigeration systems threatened public safety and disrupted the country's food supply.
The attacks also raised questions about the extent to which foreign governments can use cyber operations to damage civilian infrastructure without conducting conventional military attacks.
French authorities have previously linked Iranian cyber units to operations involving the satirical newspaper Charlie Hebdo and organizations associated with the 2024 Paris Olympic Games.
However, those earlier incidents involved different methods and targets. The refrigerator attacks were notable for causing direct physical and economic damage across hundreds of ordinary businesses.
Similar Attacks Spread Across Europe
Several weeks after the French incidents, supermarkets in other European countries reported comparable problems involving refrigeration systems.
On November 2, stores in Belgium, Luxembourg and Sweden experienced unexplained temperature increases that damaged refrigerated and frozen products.
Retailers in Ireland, Estonia, Finland and the Netherlands also reported refrigeration disruptions.
In Belgium, affected businesses included Delhaize, Carrefour and Spar locations. Some stores remained open but had to remove products from refrigeration units.
Carrefour said approximately 15 of its 700 Belgian locations were affected.
Swedish grocery chains ICA and Coop also reported incidents involving refrigeration systems.
At one ICA store in Stockholm, workers discovered that freezer temperatures had reached 50 degrees Celsius. Large quantities of merchandise had to be discarded.
Reuters reported that an ICA store manager described the destruction of the affected inventory.
The incidents resembled the earlier French attacks because refrigeration settings had been manipulated remotely.
However, similarities in techniques do not necessarily establish that the same individuals or organizations were responsible.
Authorities have not publicly linked all the European incidents to Shahid Kaveh or confirmed that they formed one coordinated international operation.
Investigations in the affected countries are continuing.
FBI Warns Businesses About Exposed Refrigeration Controllers
The attacks prompted warnings from American cybersecurity authorities about vulnerabilities in industrial refrigeration and cold-storage equipment.
The FBI said it had observed malicious activity targeting refrigeration and cold-chain monitoring systems around the world.
Many commercial refrigeration systems use internet-connected controllers so technicians can monitor temperatures, diagnose problems and adjust equipment remotely.
Those capabilities can reduce operating costs and simplify maintenance. However, they can also create opportunities for attackers when control systems are accessible through the public internet.
The FBI warned that outdated software, weak security settings and exposed control interfaces can allow unauthorized users to change operating conditions.
Such intrusions can lead to spoiled inventory, damaged equipment and interruptions to critical services.
Federal authorities advised businesses to remove refrigeration controllers from direct public internet access and protect remote connections with firewalls and other security measures.
Companies were also encouraged to review equipment updates, restrict administrative access and monitor for unexpected changes to system settings.
These protections are especially important for businesses that rely on continuous refrigeration, including supermarkets, food distributors, hospitals and pharmaceutical storage facilities.
Blood Banks and Other Infrastructure Also Targeted
French investigators are examining another recent cyberattack involving refrigeration equipment at several blood banks.
In that incident, attackers attempted to raise storage temperatures to dangerous levels. Authorities said the attempt was stopped before blood products or samples were damaged.
French cybersecurity officials have also identified attacks targeting equipment at small hydroelectric installations.
ANSSI said some of those incidents involved Schneider Electric equipment and produced more limited effects than the supermarket attacks.
The investigation highlights the range of physical systems that can be affected when industrial controls are compromised.
Equipment used for refrigeration, electrical generation, water treatment and manufacturing increasingly relies on network-connected technology.
Those connections allow operators to manage complex systems remotely, but they also require security measures designed for the consequences of unauthorized changes.
Unlike attacks that primarily steal information, interference with industrial controls can affect temperatures, machinery and other conditions in the physical world.
The consequences depend on the type of equipment involved and whether operators can detect and stop suspicious activity quickly.
European Authorities Continue Investigating
France's investigation has established an official attribution for the October refrigeration attacks, but important questions remain about the wider incidents across Europe.
Authorities must determine whether the attacks in other countries involved the same infrastructure, methods or individuals.
French prosecutors are also continuing efforts to identify and pursue suspects connected to the Shahid Kaveh operation.
The European Union will need to consider France's request for additional sanctions before any new measures can be implemented.
For retailers, the immediate priority is protecting refrigeration equipment that is essential to food safety and daily operations.
The October attacks demonstrated that ordinary commercial technology can become a target of international cyber operations. France's next steps will include pursuing the criminal investigation, coordinating with European partners and strengthening defenses against further attacks on civilian infrastructure.