France blames Iran for the cyberattack on supermarket refrigeration

In brief

On 9 November 2026 the Paris Public Prosecutor's Office attributed the 12 October attack on the refrigeration of about 700 businesses to Iran's Revolutionary Guard and opened a judicial investigation.
Foreign Minister Jean-Noël Barrot summoned the Iranian ambassador and announced that France will push for sanctions at European level.
The case raises questions on food-chain cyber resilience, incident reporting and state attribution in the EU.

France has officially named Iran as responsible for a cyber sabotage that hit the refrigeration systems of hundreds of food businesses. It matters because it is a public state attribution for an attack on everyday civilian infrastructure, accompanied by an announcement of EU sanctions. According to O Povo (DW), the statement was released on Monday 9 November 2026.

What happened

In the early hours of 12 October, attackers remotely took control of refrigeration systems in hundreds of supermarkets and independent shops across France. Temperatures were held at around 50 ºC for about six hours, forcing businesses to discard fresh and frozen produce. Roughly 700 of the country’s 10,000 supermarkets were affected, along with small butchers, an abattoir and food processing plants. At least 15 fires were recorded, and the Intermarché chain reported losses in the tens of millions of euros in a single day.

The attribution and the response

The Paris Public Prosecutor’s Office attributed the attack to Iran’s Islamic Revolutionary Guard Corps. Prosecutor Laure Beccuau announced a formal judicial investigation into organised cybercrime, with the aggravating circumstance of acting for the benefit of a foreign power. The national cybersecurity agency, ANSSI, links the attack to the group Shahid Kaveh, described as a cyber unit tied to the Revolutionary Guard. According to the prosecutor, the perpetrators used Persian and IP addresses tied to devices in Iran, and international arrest warrants have been requested.

Foreign Minister Jean-Noël Barrot said at a G7 meeting in Paris that the Iranian ambassador had been summoned and that France will impose sanctions at European level on those responsible. He described the episode as the first large-scale sabotage attack on French soil. These are the positions of the French authorities, and the investigation remains open.

The wider context

The previous week, according to the same source, an attack on several French blood banks, aimed at raising temperatures, was foiled before it caused damage. Supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia also reported freezer and fridge problems apparently caused by cyberattacks. ANSSI also attributes earlier attacks since 2020 to another group linked to the Revolutionary Guard, including those against Charlie Hebdo in 2023 and the organisers of the Paris Olympic Games in 2024.

Our view at CEA Digital Law

This case shows that cybersecurity is no longer only about data and servers: it reaches the cold chain, public health and food security. For the Euro-American Committee of Digital Law - CEA Digital Law, three lessons stand out.

Sectoral reach. European cyber-resilience frameworks such as the NIS2 Directive should be applied with close attention to small operators and to connected industrial equipment, often managed by third parties. One supplier’s failure can cascade across hundreds of shops.
Cross-border coordination. If incidents in other Member States are confirmed as linked, fast sharing of indicators between national authorities and European cooperation will be decisive.
Attribution with safeguards. Combining technical attribution by an agency, a judicial investigation and a diplomatic response is a model that Latin America and the Caribbean and Africa could adapt as their incident response teams grow, provided the presumption of innocence and verifiable evidence are respected.

Important questions remain open: which EU sanctions instrument will be used, how state responsibility will be framed in international law, and what reporting and insurance duties the affected businesses will face. We will keep following the matter.