The short version
- French authorities have formally attributed the massive October cyberattack on supermarket refrigeration units to an Iranian paramilitary group.
- The incident caused temperatures in hundreds of stores to spike, resulting in significant financial losses and the disposal of perishable goods.
- France is seeking international arrest warrants and pushing for European Union sanctions against those responsible for the sabotage.
French authorities have formally attributed a major cyberattack that disrupted supermarket refrigeration systems across the country to Iran, marking a significant escalation in state-sponsored digital warfare. On Monday, prosecutors in Paris announced that they had identified the Shahid Kaveh group, a cyber unit affiliated with the Islamic Revolutionary Guard Corps, as the perpetrator behind the October 12 incident. This attribution represents the first large-scale cyberattack aimed specifically at physical sabotage on French soil, prompting the government to summon the Iranian ambassador and demand accountability for what officials described as an unprecedented act of aggression.
The attack unfolded in the early hours of October 12, when hackers remotely seized control of cooling systems in approximately 700 supermarkets and independent stores. For roughly six hours, internal temperatures within these refrigeration units soared to 50 degrees Celsius, or 122 degrees Fahrenheit. This extreme heat forced retailers to discard vast quantities of fresh and frozen products to ensure public safety. The Intermarché supermarket chain alone reported losses amounting to tens of millions of euros in a single day, highlighting the severe economic impact of targeting critical retail infrastructure.
French Foreign Minister Jean-Noël Barrot condemned the operation during G7 talks in Paris, characterizing it as an extremely serious threat to national interests and public security. He emphasized that the attack would not go unanswered, stating that France intends to impose sanctions at the European level against all individuals and entities responsible. The government is also preparing to take any additional measures necessary to deter future attacks, signaling a shift toward more aggressive diplomatic and legal responses to cyber threats originating from foreign powers.
The judicial investigation opened by Paris prosecutor Laure Beccuau focuses on suspected organized cybercrime committed to serve the interests of a foreign power. Investigators cited evidence including the use of Farsi language in command structures and IP addresses linked to devices located within Iran. The probe targets the leader of the Shahid Kaveh group, his two deputies, and any other individuals identified in connection with the case. Authorities are currently seeking international arrest warrants for those involved, aiming to hold them accountable through global legal channels.
This incident is part of a broader pattern of cyber aggression attributed to Iranian-affiliated groups. France’s national cybersecurity agency, ANSSI, has previously linked attacks on satirical newspaper Charlie Hebdo in 2023 and the organization of the Paris Olympic Games in 2024 to another group named Shahid Shoostari, also tied to the Islamic Revolutionary Guard Corps. The current attribution adds to a growing list of sophisticated cyber operations that have targeted French institutions since 2020, demonstrating a persistent and evolving threat landscape.
Concerns about the scope of these attacks were heightened last week when another cyber incident targeted several blood banks in France. Although this second attempt tried to raise temperatures to dangerous levels, it was thwarted before any damage could occur to blood products or samples. French cybersecurity agencies and prosecutors are actively investigating this separate incident, which underscores the vulnerability of critical health infrastructure to similar remote manipulation tactics.
The disruption extended beyond French borders, affecting supermarkets in Sweden, Belgium, Luxembourg, Ireland, and Estonia. These international incidents involved problems with freezers and fridges that appeared to be caused by coordinated cyberattacks, forcing retailers in those countries to dispose of ruined food supplies. The geographic spread suggests a sophisticated operation capable of targeting multiple nations simultaneously, raising questions about the resilience of shared supply chain technologies across Europe.
As France moves forward with its response, the focus remains on securing European-level sanctions and strengthening defensive measures against future sabotage. The government’s stance reflects a broader recognition that cyberattacks causing physical damage to civilian infrastructure represent a major shift in modern conflict. By treating these digital intrusions as acts of state-sponsored aggression, Paris aims to set a precedent for how nations respond to threats that blur the line between espionage and direct assault.
Sources behind this briefing
Go to the original reporting
- PBS NewsHour↗France blames Iran for last month's cyberattack on supermarket fridges
