French authorities officially attributed a significant cyberattack that disrupted supermarket refrigeration systems last month to Iran. On Monday, the government announced that the Iranian paramilitary Revolutionary Guard was responsible for the incident. In response to the findings, Paris summoned the Iranian ambassador to register a formal protest and stated its intention to pursue sanctions at the European level against those involved.
The initial attack occurred on October 12, when refrigerator temperatures in approximately 700 of France's 10,000 supermarkets spiked dramatically. In a statement released Monday, Paris prosecutors confirmed that the large-scale digital intrusion was executed by the Revolutionary Guard. This attribution marks a significant development in the ongoing investigation into the cause of the widespread temperature failures.
Foreign Minister Jean-Noel Barrot addressed the matter during G7 talks in Paris, describing the incident as an act of unprecedented scale and aggressiveness. He noted that this was the first large-scale cyberattack on French soil specifically designed for sabotage, posing a major threat to national interests and public security. Barrot emphasized that the attack would not go unanswered and pledged to impose sanctions on all responsible parties while taking any other necessary measures to deter future incidents.
Laure Beccuau, the Paris prosecutor, announced the opening of a formal judicial investigation into suspected organized cybercrime. The investigation includes the aggravating circumstance that the crime was committed to serve the interests of a foreign power, specifically Iran. The scope of the inquiry targets the leader of the responsible cyber group, his two deputies, and any other individuals identified in connection with the case.
France's national cybersecurity agency, ANSSI, identified the perpetrators as the Shahid Kaveh group. This unit is described as a cyber division affiliated with the Islamic Revolutionary Guard Corps. Investigators cited the use of Farsi language elements and IP addresses linked to devices located in Iran as key evidence in their findings. The Paris prosecutor's office is currently seeking international arrest warrants for the suspects.
During the early hours of October 12, attackers remotely controlled refrigeration systems in hundreds of supermarkets and independent stores across the country. Temperatures inside the units reached 50 degrees Celsius, or 122 degrees Fahrenheit, for a period of about six hours. This heat forced retailers to discard large quantities of fresh and frozen goods. The Intermarche supermarket chain reported financial losses amounting to tens of millions of euros in a single day.
The incident is part of a broader pattern of cyber threats targeting French infrastructure. Last week, a separate attack targeted several blood banks in an attempt to raise temperatures to damaging levels. However, the assault was thwarted before it could harm blood products or samples. Both the national cybersecurity agency and Paris prosecutors are investigating this more recent event.
Similar disruptions have been observed elsewhere in Europe. Last week, supermarkets in Sweden, Belgium, Luxembourg, Ireland, and Estonia experienced issues with freezers and fridges that appeared to be caused by cyberattacks. These incidents forced some stores to dispose of ruined food, highlighting the growing vulnerability of retail supply chains to digital sabotage.
ANSSI also revealed that it has attributed other cyberattacks against France since 2020 to a different group named Shahid Shoostari, which is also affiliated with the Iranian Revolutionary Guard. Notable past incidents include an attack on the satirical newspaper Charlie Hebdo in 2023 and a breach targeting the organization of the Paris Olympic Games in 2024.
