Source: Al Jazeera (citing AFP and AP)
France has formally attributed the 11 and 12 October cyberattacks on supermarket refrigeration systems to the Islamic Revolutionary Guard Corps (IRGC). Speaking on 9 and 10 November 2026, Foreign Minister Jean-Noel Barrot confirmed the attribution, said the Iranian ambassador had been summoned to lodge a very strong protest, and announced that France will push for sanctions at the European level. He described the attack as unprecedented in its scale and aggression and as the first large-scale cyberattack carried out for sabotage purposes on French national territory.
How the investigation reached Iran
The Paris prosecutor’s office said the attackers used Farsi and IP addresses linked to devices in Iran while gaining internet access to refrigeration controllers and remotely initiating abnormal, indefinite defrost cycles, pushing temperatures to around 50 degrees Celsius overnight. Paris prosecutor Laure Beccuau opened a formal investigation into Shahid Kaveh, an offensive cyber unit affiliated with the IRGC, and the prosecutor’s office has requested international arrest warrants against the unit’s leader and his two deputies. The attacks spoiled millions of euros worth of food, in some cases sparking fires or melting equipment, and hit major French retail groups including E.Leclerc, Intermarche, Carrefour, Monoprix and Cooperative U, with roughly 700 stores affected. Similar temperature spikes were later recorded in stores in Belgium, Estonia, Ireland, Luxembourg and Sweden on 2 November. Iran’s Foreign Ministry rejected the accusations as baseless.
What European operators should take away
This is the clearest sign yet that internet-connected operational equipment, not just data, is the target. Refrigeration controllers with default credentials and exposed management interfaces let attackers turn a mundane facility system into a national security incident. The same class of risk sits in building management, HVAC, industrial control and IoT fleets across every European sector. That means inventories of internet-facing devices, network segmentation for operational systems, strong unique credentials, and vendor pressure for secure defaults are no longer optional hardening, they are the difference between a bad night of spoiled stock and a geopolitical event with sanctions attached. With France promising further measures, public and private, and other European countries hit by copycat incidents, boards should treat connected device security as part of their operational resilience obligations under NIS2.
If your organisation runs connected operational systems and you want an independent review of what is exposed, segmented or hardened, contact Excello Digital for practical security advice from engineers who work in European infrastructure every day.