France has formally accused Iran of orchestrating a cyberattack that disrupted commercial refrigeration systems in hundreds of supermarkets across the country last month, marking what officials describe as the first large-scale sabotage cyberattack on French soil. The French government summoned Iran’s ambassador to Paris on Tuesday to lodge a formal protest and announced it was pursuing retaliatory measures, including potential EU sanctions.
Iran denies involvement, calling the accusations "baseless and hostile."
Immediate Action & Core Facts
France accuses IRGC-linked unit Shahid Kaveh
French authorities have attributed the October 11–12 cyberattacks to Shahid Kaveh, a cyber offensive unit affiliated with the Electronic and Cyber Centre (IRGC-CEC) of Iran’s Islamic Revolutionary Guard Corps (IRGC). The attacks targeted refrigeration controllers in approximately 700 supermarkets, causing temperatures to spike to 50°C (122°F), spoiling food and sparking at least 15 fires. Major retailers including Intermarché, E. Leclerc, Carrefour, Monoprix, and Coopérative U were affected.
French foreign minister Jean-Noël Barrot stated that the attack was conducted by a foreign power and represented an "unprecedented scale and aggressiveness." He warned that France would take "any other necessary and proportionate measures" in response, including undisclosed actions.
Deeper Dive & Context
Evidence cited by French investigators
French prosecutors and intelligence agencies cited multiple forms of evidence linking the attacks to Iran:
- Use of the Farsi language in attack infrastructure.
- IP addresses traced to devices in Iran.
- Operational patterns matching previous campaigns attributed to Shahid Kaveh.
- Front organizations such as "CyberAveng3rs" and "Cyber Isnaad Front" were used to obfuscate attribution.
The attackers remotely accessed refrigeration systems via web interfaces, initiating unlimited defrost cycles and disabling safety alerts. The Paris Prosecutor’s Office has sought international arrest warrants for three alleged leaders: Hamid Reza Lashgarian (head of IRGC-CEC), Mahdi Lashgarian, and Reza Salarvand. All three are subject to US sanctions imposed in 2024.
Iran’s denial and diplomatic response
Iran has denied any involvement, calling the accusations "baseless and hostile." The Iranian government has not publicly detailed its response beyond rejecting the claims. French officials have stated that they are not ruling out further measures, including asset freezes and travel bans within the EU.
Broader implications and related incidents
French authorities described the attack as part of a larger campaign by Shahid Kaveh, which has previously targeted industrial equipment in Israel, the United States, and several European countries. The EU’s foreign policy chief, Kaja Kallas, acknowledged the incident and indicated that the bloc is considering further measures in response.
The attacks occurred amid heightened tensions in the region, including the ongoing conflict in Gaza and broader geopolitical rivalries involving Iran. While the immediate impact was economic—with millions of euros in food spoilage—the incident has raised concerns about the vulnerability of critical infrastructure to state-sponsored cyber operations.
Retailer and industry response
Affected supermarket chains reported significant operational disruptions, with some locations experiencing extended closures and food waste. Industry experts estimate the total cost of the incident to be in the tens of millions of euros, though the full financial impact remains under assessment.
French cybersecurity and intelligence agencies continue to investigate the incident, with a focus on identifying additional collaborators and preventing future attacks. The case has prompted calls for enhanced cybersecurity standards for industrial control systems across Europe.