PARIS, November 10, 2026 — France summoned Iran’s ambassador after publicly attributing the October supermarket cyberattack to an offensive unit linked to Iran’s Islamic Revolutionary Guard Corps, escalating a dispute that now includes a threat of European sanctions and possible French cyber measures. Tehran rejected the accusation as “baseless and hostile.” The attack disrupted refrigeration controls at more than 700 retail sites and caused food losses and fires, according to French authorities.
The diplomatic step followed France’s announcement on Monday that its investigators had linked the operation to the Shahid Kaveh cyber unit. On Tuesday, the Foreign Ministry confirmed that the ambassador had been summoned that morning. Foreign Minister Jean-Noël Barrot said Paris would press for sanctions at the European level and could take additional measures if they were judged proportionate and necessary to deter further attacks.
The incident itself took place overnight from October 11 to 12, not on the day France made its attribution public. Attackers gained control of refrigeration-system controllers at supermarkets and other retail locations, then changed equipment settings so that defrost cycles pushed temperatures sharply higher. France’s national cybersecurity agency, ANSSI, said the attack affected about 700 large-retail sites. The country’s Foreign Ministry said the campaign caused substantial material damage and food losses estimated at tens of millions of euros.
The consequences were physical as well as digital. The ANSSI account says the altered settings led to merchandise losses and at least 15 fires. The Associated Press reported that temperatures in some refrigerators reached about 50 degrees Celsius and remained elevated for roughly six hours. Stores were forced to discard fresh and frozen goods that could no longer be considered safe. Intermarché reported losses worth tens of millions of euros in a single day, according to AP.
France’s attribution rests on an investigation involving the country’s cyber-crisis coordination system, known as C4. The body brings together the national cybersecurity agency ANSSI, the military cyber command, the defense procurement and technology authorities, and the domestic and foreign intelligence services. The French government said the investigation identified the Shahid Kaveh unit, which it describes as affiliated with the electronic warfare and cyber-defence organization of the IRGC.
ANSSI listed several indicators behind its assessment, including characteristics of the infrastructure used in the operation, tools associated with the activity, the way the attack was publicized by a channel linked to the group, and traces of Persian-language use in the attack infrastructure. These are the French authorities’ findings. They have not been presented as a public, independently replicated forensic examination by outside investigators, and Iran disputes the conclusion. The distinction between a government attribution and a universally accepted finding remains important in cyber cases, where technical evidence and intelligence assessments are often not fully disclosed.
The French account says the operation extended beyond supermarket refrigeration. Investigators identified other victims in the food sector, including small butcheries, an abattoir, and cooperative food-processing facilities. ANSSI also reported that equipment from Schneider Electric at several small hydroelectric installations was targeted at the same time, although it described the effects there as limited. That wider scope is one reason officials have framed the campaign as an attack on critical infrastructure rather than simply a theft or disruption affecting individual retailers.
Also read: AI Cyberattacks on UK Critical Infrastructure ‘Highly Likely’ by 2028
Paris prosecutors have opened a formal judicial investigation into suspected organized cybercrime, with the aggravating circumstance that the activity was allegedly carried out in the interests of a foreign power. The prosecutor’s office said the investigation concerns the group’s leader, two deputies, and other people who may be identified. The Associated Press reported that prosecutors were seeking international arrest warrants. The legal process is separate from the diplomatic decision to summon Iran’s ambassador and from any future European sanctions.
France has not published every technical detail that would allow outside specialists to reproduce the investigation. Some information may be withheld because it relates to intelligence methods, investigative steps, or systems still at risk. But the public account describes a campaign that used remote access to alter settings in equipment designed to maintain food at safe temperatures. The operation did not need to steal customer records or shut down a supermarket’s entire computer network to cause serious disruption. It targeted a control system whose normal job is to manage a physical process.
Iran’s Foreign Ministry rejected the French accusation, describing it as baseless and hostile, Reuters reported. Tehran’s denial means the public record contains competing positions: France says its investigation has attributed the sabotage to an IRGC-linked unit, while Iran denies responsibility. No independent international body has announced a separate attribution. The allegations should therefore be reported as France’s official finding, not as a fact accepted by all parties.
Barrot said France would seek European Union sanctions against those responsible and did not rule out other action. Reuters reported that he referred to the possibility of cyber measures, while declining to disclose what form they might take. France says its cyber-defense doctrine gives the government a range of options. Any response would carry diplomatic consequences because a cyber operation against an alleged state-linked unit could prompt countermeasures or further accusations.
The dispute comes during an already difficult period in relations between Paris and Tehran. Reuters reported that the two governments have clashed over Iran’s nuclear and missile programs, regional activity, and the detention of French nationals. Relations had improved for a time after detainees were released but deteriorated again after Iran arrested and expelled two French diplomats during the summer, and France responded by expelling Iranian diplomats. The supermarket case adds a new security issue to a relationship that was already under strain.
The French government has described the operation as the first offensive cyber campaign conducted purely for sabotage on its territory. That is a significant political claim, but it does not mean France is the only country facing attacks on systems that control physical equipment. The Associated Press reported that supermarkets in Sweden, Belgium, Luxembourg, Ireland, and Estonia had also experienced problems involving refrigerators and freezers that appeared to be linked to cyber activity. The available reporting does not establish that every incident was carried out by the same group or under the same direction.
French authorities have also been investigating a separate attempt to manipulate temperatures at blood-bank facilities. AP reported that the attempt was stopped before blood products or samples were damaged. The two cases involve temperature-control systems, but they should not be conflated: the supermarket attack caused losses and fires, while the blood-bank incident was thwarted. Together, they have drawn attention to the risks posed when network-connected controls are used to maintain conditions that matter for food safety and medical care.
Industrial and commercial refrigeration is part of operational technology: digital equipment that monitors and controls machinery, buildings, and physical processes. A compromise can change what a device does in the real world, even if the attacker never accesses a payment database or customer account. In a supermarket, temperature controls help preserve food and prevent spoilage. In a hospital or blood bank, similar systems can protect medicines, samples, and other temperature-sensitive materials. At an energy facility, control systems can affect generation or distribution equipment.
Also read: PM Modi Inaugurates RBI Data Centre and Cybersecurity Institute in Odisha
The supermarket cyberattack illustrates why cyber resilience cannot be limited to office computers and customer-facing websites. Retailers depend on refrigeration vendors, maintenance contractors, and remote-management tools and networks that connect equipment across multiple locations. If those connections are poorly separated from business systems, or if remote access is not tightly controlled, a weakness at one point can affect many sites. The French authorities have not publicly identified a single technical vulnerability responsible for the incident, so it would be premature to claim that one software flaw or supplier caused the campaign.
Operators will now face questions about how they monitor unusual changes in equipment settings, how quickly staff can switch to manual controls, and whether they can isolate compromised devices without losing visibility across a store. Food retailers also need procedures for deciding when stock must be discarded, how to document losses, and how to keep stores safe if cooling fails. Those are operational questions as much as cybersecurity questions. A successful response has to involve IT teams, facilities managers, suppliers, store staff, and public health authorities.
The wider policy issue is attribution and deterrence. France says it has enough evidence to identify an IRGC-linked unit and wants the European Union to act. Iran rejects the charge. European governments will have to assess the French evidence and decide whether sanctions are justified while also considering the risk that a cyber response could widen the confrontation. Public attribution can expose a hostile operation and signal that a government is prepared to respond, but it does not by itself prevent another attack.
The next developments will include the French judicial investigation, any formal EU sanctions proposal, and further explanation from the government about the measures it is considering. Investigators may disclose more technical evidence as the case progresses, although some details may remain classified. Retailers and infrastructure operators will also be watching for signs that similar attacks are being attempted elsewhere. France has made a clear allegation and taken a diplomatic step; the legal and international response is still unfolding.
Comments (0)
Be the first to comment. Comments are published after moderation.