Paris says a cyberattack on the cooling systems of about 700 supermarkets spoiled food and sparked fires, and it is pressing for EU sanctions and international arrest warrants.
France has accused Iran’s Revolutionary Guards of a large-scale cyberattack on the refrigeration systems of hundreds of supermarkets in October. Paris says it will seek penalties at European level. Its judicial authorities have opened a criminal investigation and asked for international arrest warrants for the suspects.
Foreign Minister Jean-Noël Barrot said on Monday, November 9, that the Revolutionary Guards carried out the attack. He called it the first large-scale cyber sabotage attack on French soil and a serious threat to national interests and public safety.
“Unprecedented in scale and level of aggression”.— Jean-Noël Barrot, French Foreign Minister, on the attack
France has summoned the Iranian ambassador to protest, Barrot said, and will push for EU sanctions on everyone responsible. It will also take further measures, announced and unannounced, to respond and deter similar attacks.
According to French authorities, the attacks came overnight on October 11 and 12. They targeted control units for the cooling systems of Danfoss and Dixell. About 700 supermarkets across France were hit. The attackers disabled alarms and launched defrost programs inside refrigerators, which pushed temperatures up and spoiled large quantities of food. Prosecutors reported significant food losses and about twenty fires. France’s blood bank was also targeted in early November.
The prosecutor’s office opened an investigation into officials of “Shahid Kawah”, a cyber warfare unit linked to the Revolutionary Guards. Paris prosecutor Laure Beccuau said it targets the unit’s head, his two deputies and others who may be identified later. Investigators found evidence on working methods and technical indicators tied to Iran, including the use of Persian.
France’s cyber crisis coordination center said technical and intelligence indicators point to the Guards as the party that ordered the attack and to Shahid Kawah as its executor. The techniques had appeared in operations attributed to the same unit since April 2026, it said. A platform linked to the unit also covered the operation in propaganda days after it was carried out.
Separately, US media reported investigations into a string of cyberattacks on critical US infrastructure. They include Los Angeles’ transport system in March, water treatment plants in July and ships bound for the US in August. Those responsible remain unknown. Iran’s UN mission did not answer Reuters’ requests for comment, and Tehran has consistently denied involvement in cyberattacks attributed to it.
