France Blames Iran’s Revolutionary Guard for Destructive Cyberattacks on Supermarket Refrigeration Systems

France has officially pointed the finger at Iran’s Islamic Revolutionary Guard Corps (IRGC), accusing the elite military force of masterminding a wave of sophisticated cyberattacks targeting commercial refrigeration systems in supermarkets across the country. French Foreign Minister Jean-Noël Barrot condemned the operation as unprecedented in both scale and aggression, warning that the perpetrators will face severe, coordinated sanctions at the European Union level.

The sophisticated digital intrusions, which took place last month, deliberately manipulated temperature controls in industrial cooling units across hundreds of French supermarkets. By intentionally disabling or heating up these refrigeration and freezing systems, the hackers caused widespread spoilage of fresh and frozen food stocks, resulting in multi-million-euro losses for retailers and raising serious alarms regarding food supply chain vulnerabilities.

This dramatic escalation in state-sponsored cyber warfare marks a pivotal shift from traditional espionage and data theft toward physical infrastructure sabotage. As European cybersecurity agencies scramble to contain the fallout, the geopolitical ramifications of these attacks are rippling far beyond France’s borders, drawing sharp rebukes from Western governments and prompting intense counter-intelligence investigations.

Chronology of the European Refrigeration Cyberattacks

The coordinated cyber campaigns targeting commercial cold-chain infrastructure unfolded across two distinct waves, baffling security researchers and retail executives alike.

The first major incident materialized in mid-October, when unauthorized actors breached the industrial control systems (ICS) of supermarket refrigeration units across France. Rather than deploying ransomware to extort financial payouts, the perpetrators remotely altered temperature settings, heating up display cases and storage freezers. The resulting thermal spikes ruined vast inventories of perishable goods, including meat, dairy, and frozen products, inflicting millions of euros in commercial damages and triggering localized electrical fires in some affected stores due to system overloads.

Just weeks later, during the final week of October and early November, a second wave of cyberattacks struck grocery retail chains across several other European nations. Dozens of supermarkets in neighboring countries reported identical anomalies in their cooling infrastructure. While European cybersecurity authorities are still examining the telemetry of the subsequent incidents, investigators are actively exploring whether the late-October and early-November breaches represent a coordinated, multi-nation campaign or a series of opportunistic copycat attacks leveraging the initial vector.

Technical Profile and the Shadow of Unit Shahid Kaveh

Attributing cyberattacks has historically been one of the most formidable challenges in digital forensics, given the ease with which threat actors can spoof internet protocol addresses, route traffic through virtual private networks, and leverage compromised third-party infrastructure. Despite these inherent complexities, French authorities have moved swiftly to name specific individuals and state-backed entities tied to the operation.

On Monday, Paris Prosecutor Laure Beccuau announced that formal judicial investigations had been initiated against the head of an offensive cyber unit linked to the IRGC, alongside his two primary deputies. The targeted network has been identified as Shahid Kaveh, an advanced persistent threat (APT) cluster operating under the umbrella of the IRGC’s electronic and cyber warfare center.

Security researchers have long monitored Shahid Kaveh as a shadow unit utilized by the Iranian regime to conduct offensive cyber operations, ranging from reconnaissance against critical infrastructure to disruptive attacks against foreign adversaries. While the French government has not publicly disclosed the precise digital breadcrumbs or intelligence methods that led to the attribution, the specificity of the prosecutor’s announcements indicates a high degree of confidence among French intelligence agencies.

Official Diplomatic and Legal Responses

The diplomatic fallout from the attribution has been swift and severe. Foreign Minister Jean-Noël Barrot characterized the supermarket sabotage as a watershed moment for European security, noting that it represents the first large-scale cyberattack explicitly designed to cause physical sabotage and disruption on French soil.

In response to what Paris has classified as a direct assault on the nation’s vital interests and public safety, the French Ministry for Europe and Foreign Affairs formally summoned the Iranian ambassador to Paris. The diplomatic summons served as a high-level demarche to lodge a resolute protest against what Barrot termed an "extremely grave act."

Furthermore, the French government has signaled that it will not rely on diplomatic reprimands alone. Paris is actively lobbying its partners within the European Union to formulate a robust, unified sanctions package targeting the IRGC leadership, associated cyber command structures, and specific operatives identified in the judicial inquiry. Barrot emphasized that France stands ready to implement any necessary and proportionate measures to safeguard its territory and deter hostile actors from attempting similar campaigns in the future.

Broader Implications for Critical Infrastructure and Food Security

The weaponization of commercial refrigeration systems highlights a dangerous evolution in modern asymmetric warfare. For decades, critical infrastructure protection frameworks have justifiably focused on high-profile sectors such as power grids, water treatment plants, financial systems, and telecommunications networks. However, the events in France and wider Europe underscore the vulnerable underbelly of the modern commercial supply chain.

Supermarket refrigeration units, industrial cold-storage warehouses, and food distribution hubs increasingly rely on Internet of Things (IoT) connectivity and centralized remote management software to optimize energy consumption and monitor inventory temperatures. While these digital integrations offer significant operational efficiencies, they also expand the attack surface for sophisticated state-sponsored threat actors seeking to inflict maximum social disruption with minimal resource expenditure.

The targeting of the food supply chain carries profound psychological and economic implications. Unlike traditional data breaches—where victims grapple with privacy violations or financial theft—physical sabotage of food storage strikes directly at basic societal needs. The deliberate spoilage of food stocks not only inflicts severe financial strain on retail corporations and agricultural suppliers but also threatens public confidence in the reliability of daily necessities.

As international investigators dig deeper into the Shahid Kaveh network and the mechanics of the October intrusions, cybersecurity experts are urging commercial enterprises across all sectors to urgently audit their operational technology (OT) security postures. Implementing stringent network segmentation, multi-factor authentication for remote vendor access, and robust anomaly detection systems will be critical in preventing commercial infrastructure from becoming the new frontline in geopolitical conflict.