The French government has formally accused Iran of orchestrating a series of destructive cyberattacks against its critical infrastructure during October. According to the French National Cybersecurity Agency, ANSSI, hackers affiliated with the Iranian military seized control of refrigeration controllers at approximately 700 retail locations, ranging from supermarkets to butcher shops. The attackers turned up the temperature in the middle of the night, spoiling millions of dollars worth of food. The campaign also targeted several small hydroelectric power plants, resulting in moderate operational effects.
French Foreign Minister Jean-Noel Barrot described the hacking campaign as unprecedented in both its scale and level of aggression. He noted that it marks the first large-scale cyberattack aimed at sabotage on French national territory. Barrot stated that the incident constitutes a major attack on the nation's interests and the security of the French people. The Paris Prosecutor's Office has opened an investigation into the Iranian cyber unit Shahid Kaveh, which the French government links to the Islamic Revolutionary Guard Corps. The prosecutor's office is currently requesting the issuance of international arrest warrants.
These attacks are part of a broader trend targeting refrigeration systems across multiple continents. In 2026 alone, hackers have aimed at such controllers in Europe, Israel, and the United States. Last week, grocery stores in Sweden and Ireland suffered similar disruptions. In France, employees at a major blood bank had to act quickly to save samples from heating up after their refrigeration system was compromised, prompting calls for the health sector to better protect lifesaving products.
In a separate incident in Israel this spring, suspected Iranian hackers known as the Cyber Isnaad Front claimed responsibility for sabotaging an industrial food processing plant. They infected corporate computers with malware, took over office printers to display threatening messages, and hacked cameras for a propaganda video. That video included a taunt in French referencing education protests. Cybersecurity firm Profero attributed the attack to a wing of the Revolutionary Guard Corps. Over the summer, similar issues occurred on U.S. military bases, where food spoiled after temperatures in refrigerators and freezers spiked overnight.
The French government is the first to formally assign blame for this wave of destructive attacks. ANSSI officials said they identified the hackers through digital clues, including specific infrastructure used by the attackers, connections to a propaganda outlet, and traces of the Farsi language in the code. While U.S. officials suspect Iran was behind the August attacks on military bases, the Pentagon has not made an official statement. A spokesperson for the Department of War Office of the Inspector General stated that the Criminal Investigative Service does not discuss ongoing investigations to preserve their integrity.
Cybersecurity experts believe the pattern fits the strategy of Iranian hackers. Alex Orleans, head of threat intelligence at Sublime Security, said the attacks likely represent the Revolutionary Guard Corps attempting to reassert Iranian power abroad through physically and psychologically disruptive operations. He noted that Shahid Kaveh is repeating a pattern seen in attacks on American water treatment plants earlier this year. This unit has refined its tradecraft through attacks on Israeli targets before shifting focus to similar systems in the West.
Ari Ben Am, an adjunct fellow at the Foundation for the Defense of Democracies, described Shahid Kaveh as an offensive unit responsible for significant Iranian cyber operations. He highlighted a linked group, Cyber Av3ngers, which the U.S. government tied to attacks on Israeli-made systems in U.S. water facilities between 2023 and 2024. The French government also cited previous IRGC attacks against French interests, including those targeting Charlie Hebdo and digital kiosks at the 2024 Paris Olympics.
Experts say the incidents highlight long-standing difficulties in securing operational technology, which controls physical processes like cooling systems. These machines are often outdated, difficult to patch without disrupting services, and frequently exposed to the open internet due to vendor maintenance requirements. Iran has not yet responded to the accusations, but the French move may encourage other affected nations to act. During a G7 meeting in Paris on Monday, Secretary of State Marco Rubio declined to comment on information sharing but described the attackers as sickos who attack refrigerators, noting that the news does not surprise him given the ongoing conflict between the U.S. and Iran.
