France attributes supermarket freezer hack to Iran’s IRGC

France formally attributed the October 11-12, 2026 hack of supermarket refrigeration systems to Iran’s Islamic Revolutionary Guard Corps on November 9, 2026. “I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran,” French Foreign Minister Jean-Noel Barrot said.

The intrusion reached about 700 French supermarket sites, causing major food losses and about 20 fires. Staff dumped melted ice cream and perished meat into rubbish containers, and some refrigerators grew hot enough to catch fire. Intruders reached Danfoss and Dixell refrigeration controllers, the devices that regulate cooling in stores, via web interfaces. They ran defrost cycles with no time limit and shut off temperature alarm probes.

Laure Beccuau, the Paris prosecutor, opened a judicial investigation and is seeking international arrest warrants against the Shahid Kaveh unit’s head, his two deputies and others identified. Investigators pointed to the method used, Farsi-language traces and IP addresses leading to terminals in Iran as signs tying the campaign to the unit. Charges include criminal conspiracy, aggravation tied to serving a foreign power, damage by dangerous means against people, and fraudulent data-system access by an organized gang. OFAC, France’s anti-cybercrime office and DGSI, described as the domestic intelligence service, are involved in the investigation.

Barrot described the attack as unprecedented in scale and aggression and summoned Iran’s ambassador to France on Monday to protest. He said France would seek European-level sanctions against those responsible. Iran’s UN mission gave no response, and Tehran routinely denies carrying out malicious cyber operations.

Another wave affected more than 100 locations across Belgium, Luxembourg, Sweden, Ireland and Estonia, together with French blood bank refrigerators, and no one has publicly attributed that wave to Iran. Sophos senior director Rafe Pilling said investigators now presume a connection between the French attacks and the recent European wave of rogue defrosting hacks. Pilling said default passwords allowed access to the fridge controls and that the method matches Iranian capabilities. “The attacks themselves were not particularly complex,” Pilling said.

In 2023, a state-backed group cut television streaming in the United Arab Emirates to air a deepfake report about the Gaza war. Also in 2023, Iran-affiliated hackers put the slogan down with Israel on screens for water-control hardware from an Israeli company.

Other incidents involved May attacks against industrial freezers at an Israeli food production facility. Malfunctions in freezers spoiled food at American military bases in August, and those cases are now reportedly treated as a suspected hack. Neither the May nor the August attacks have been officially attributed to Iran.

France’s cybersecurity agency ANSSI has blamed basic security failures, saying companies did not follow its recommendations. The agency added that exposed shop equipment linked to the internet constituted the weak point.

Reuters said the hacks would count among the most disruptive cyberattacks of the Iran war that began in February 2026. Earlier alleged incidents included the Los Angeles transit network and American water treatment facilities, along with vessels heading to the United States.

Britain’s NCSC warned that the country faces a new cyber threat level and should expect a big increase in incidents. The agency also treats artificial intelligence as a key worry because it can expose unforeseen IT flaws and assist attackers in planning and carrying out attacks.