France Blames Iran for Supermarket Refrigeration Cyberattacks as Barrot Seeks EU Sanctions

There are cyberattacks that steal secrets, and there are cyberattacks that steal money, and then there is the kind of attack that France says it suffered in the middle of October, an attack that did not want information or ransom but wanted to spoil food and start fires, and on Monday, November 9, 2026, the French government put a name to it. Foreign Minister Jean-Noël Barrot, speaking on the sidelines of a meeting of foreign ministers from the Group of Seven in Paris, said that France could confirm that Iran’s Islamic Revolutionary Guard Corps was behind the overnight hacking of refrigeration systems at about seven hundred supermarkets and food businesses across the country, an operation that drove fridge and freezer temperatures far above safe levels, destroyed whole inventories of perishable food and, according to the French authorities, started at least fifteen fires. The announcement was accompanied by a five-page report from France’s Cyber Crisis Coordination Centre, a criminal investigation opened the same day by the Paris prosecutor, a summons for Iran’s ambassador, and a promise from Barrot that France would seek sanctions at the European level against everyone responsible, and would take any other measures it considered necessary and proportionate to answer the attack and to deter the next one. It was, in the words of the French foreign ministry, the first cyber offensive campaign carried out purely for sabotage on French soil, and it was described by Barrot as an attack of unprecedented scale and unprecedented aggression, a major attack on the nation’s interests and on the security of the French people. Yet for all the force of the language, the case France presented on Monday rests on evidence that the public has not yet seen, and Iran, which routinely denies carrying out malicious cyber operations, had not formally responded by the time Barrot spoke again on Tuesday, and that gap between a firm public accusation and unpublished proof is now the centre of the story, and the focus of this report is the France Iran supermarket cyberattack November 2026 story and what it means for France, for Iran and for the security of the everyday systems that keep food cold.

1. The Announcement in Paris

The attribution arrived on a Monday, and it arrived in the way that modern governments prefer to deliver news of this kind, all at once and from several directions, so that by the end of the day there was no doubt about how seriously Paris was taking it. The first word came from the foreign ministry, which published a statement condemning the attack in the strongest possible terms and describing it as the first campaign of its kind on French territory, a campaign carried out purely for sabotage, with no theft and no ransom demand attached to it. The second came from the Cyber Crisis Coordination Centre, known by its French initials as the C4, which published a five-page report setting out the findings of the investigation and naming the unit it held responsible. The third came from the Paris prosecutor’s office, which announced that a formal judicial investigation had been opened into the head of that unit, his two deputies and others yet to be identified, and that international arrest warrants would be sought. And the fourth, and the most quoted, came from Barrot himself, who spoke to reporters at the G7 ministerial meeting in Paris and used language that left no room for doubt about the government’s position, telling them that he could confirm the Revolutionary Guard’s responsibility and that France would act. The timing of the announcement, a month after the attacks themselves, suggested that the month had been spent building the case, and the breadth of the response, spanning diplomacy, criminal law and European sanctions, suggested that the government wanted the attribution to be seen not as a single statement but as the start of a sustained campaign of pressure.

1.1 Barrot’s Words at the G7 Meeting

Jean-Noël Barrot is not a minister given to dramatic language, which is part of why his words on Monday were so widely quoted, because when he spoke to reporters on the sidelines of the G7 meeting in Paris, he called the attack an assault of unprecedented scale and unprecedented aggression, and he described it as a major attack on the nation’s interests and on the security of the French people. He said that France would impose sanctions at the European level against all those responsible for the attack, and he added that Paris would take any other measures needed to respond to it and to deter future attacks, a phrase that was understood, in the French press, as leaving the door open to action that France might not announce in advance. He said that Iran’s ambassador in Paris was being summoned to receive a very strong protest against what he called an extremely serious act, and the foreign ministry later confirmed that the ambassador would be called in to hear France’s strongest condemnation of the cyberattacks. On Tuesday, November 10, Barrot returned to the subject in an interview with Franceinfo television, saying that the ambassador had been summoned earlier that day and that France ruled out nothing in its response, adding that Paris would take all measures, including those it might not disclose publicly, that it considered proportionate and necessary to deter any further attacks. The choice of venue mattered as well, because the G7 meeting put Barrot in front of the foreign ministers of the world’s largest democratic economies, and because it allowed France to present the attribution not as a bilateral grievance but as an issue for its closest partners, and to begin, in the same room, the work of building the European response that the sanctions promise will require.

1.2 A Five-Page Report and a Criminal Case

Behind the minister’s words stood a document that did much of the work of the day, a five-page report published on Monday by the Cyber Crisis Coordination Centre, the body that brings together France’s national cybersecurity agency ANSSI, the military’s cyber command, the arms procurement agency, and the DGSE foreign intelligence and DGSI domestic security services. The report, whose summary was published by France’s CERT-FR computer emergency response team, attributed the refrigeration attacks to Shahid Kaveh, an offensive cyber unit affiliated with the electronic and cyber centre of the Islamic Revolutionary Guard Corps, and it set out, in outline, the technical and intelligence findings on which that attribution rested. The report’s annex named and pictured three men it described as senior figures in the operation, Hamid Reza Lashgarian, the head of the Revolutionary Guard’s electronic and cyber centre, and Mahdi Lashgarian and Reza Salarvand, described as commanders of Shahid Kaveh, and it said that the techniques used in the attacks had been seen in the unit’s operations since at least April 2026. On the same day, Paris public prosecutor Laure Beccuau announced that she had opened a formal judicial investigation into the head of Shahid Kaveh, his two deputies and others yet to be identified, on suspicion of organised cybercrime with the aggravating circumstance of having been committed to serve the interests of a foreign power, and she said that international arrest warrants would be requested. The combination of a public intelligence report and a criminal investigation was deliberate, because it allowed France to present the attribution in two registers at once, as a matter of national security and as a matter of law, and to create two separate tracks, diplomatic and judicial, along which the response could travel.

2. The Night of October 11 and 12

The attacks themselves took place in the small hours, which was part of the plan, because the people who carried them out wanted the refrigeration systems to be running hot for as long as possible before anyone noticed, and the first signs of trouble came when shop staff arrived in the morning to find fridges and freezers that were warm to the touch and food that had already begun to spoil. According to the French authorities, the hackers struck overnight on October 11 and 12, 2026, taking control of the software that regulates temperatures in the refrigeration units used by many French supermarkets, and using that control to override the digital thermostats and to switch on the defrost cycles that are normally used, briefly and carefully, to clear ice from the cooling coils. The defrost function, which is designed to warm the coils for a short period so that frost melts away, was instead left running, and the temperatures inside the cabinets climbed far beyond anything the food inside them could survive. The reporting on the attack described temperatures rising from as low as minus 16.6 degrees Fahrenheit to above 122 degrees Fahrenheit, or up to around 50 degrees Celsius in the accounts that used the metric scale, which is a range that turns a freezer into an oven and a chiller cabinet into a warm cupboard, and the result was that perishable food, from dairy and meat to frozen meals, was ruined in a matter of hours. The choice of the small hours was not an accident, because a supermarket’s refrigeration system is most vulnerable when the shop is closed and no one is watching the gauges, and the attackers appear to have understood that, and to have chosen their moment accordingly.

2.1 How the Fridges Were Turned Against Their Owners

The method of the attack was, by the standards of modern cyber operations, strikingly simple, and that simplicity is part of what has alarmed the French authorities and the cybersecurity industry, because it suggests that the systems that keep food cold are far easier to reach than anyone had assumed. The hackers did not need to break into the supermarkets themselves, and they did not need to plant anything inside the shops, because the refrigeration controllers they targeted were connected to the internet, and in many cases they were protected by little more than weak passwords and basic security flaws that had never been fixed. The head of ANSSI, Vincent Strubel, told French senators on October 21 that the intrusions had been made possible by what he called elementary security flaws and weak passwords on internet-exposed equipment, a description that carries an implicit rebuke for the companies that owned the systems as well as for the people who attacked them. Once inside the controllers, the attackers were able to change the cooling settings remotely, to override the thermostats and to force the defrost cycles to run, and the French report said that the Shahid Kaveh unit had possessed the ability to scan, access and control industrial control equipment from manufacturers including Schneider Electric, Siemens and Rockwell since at least June 2024. The same methods, according to the reporting, were used to reach refrigeration controllers in the later wave of attacks that hit supermarkets and businesses across Europe in early November, which suggests that the vulnerability is not confined to France, and that the equipment that keeps food cold across the continent shares the same weaknesses. The lesson that the French authorities have drawn is that the attack was not a feat of extraordinary hacking but a demonstration of how much damage can be done by exploiting ordinary neglect, and that is a lesson that will be hard for the retail industry to ignore.

2.2 Seven Hundred Sites, From Hypermarkets to Butchers

The scale of the attack is what made it unprecedented, and the numbers that the French authorities have published give a measure of just how widely it reached. About seven hundred commercial sites were targeted, according to the Cyber Crisis Coordination Centre’s report, a figure that covers roughly seven hundred of the roughly ten thousand supermarkets in France, and the list of affected retailers reads like a roll call of the French grocery industry, including Carrefour, Intermarché, Netto, Coopérative U, E.Leclerc, Casino, Metro and Monoprix. The BBC’s reporting, drawing on the French investigation, said that more than one hundred Coopérative U stores and one hundred and eighty Intermarché and Netto outlets were affected, which gives a sense of how concentrated the damage was in the country’s largest chains, and how many communities woke up to find their local supermarket unable to sell fresh or frozen food. But the attack did not stop at the big chains, because the victims ranged, according to the reporting, from large grocery chains to independent butchers, a slaughterhouse and food-processing plants, which means that the damage reached into the supply chain itself, and not only into the shops where customers buy their food. The French report also said that the same hackers had simultaneously targeted Schneider Electric equipment at several small hydroelectric facilities, although the disruption to those systems was described as moderate, which suggests that the attackers were interested in more than one kind of industrial system, and that the supermarkets were the most visible target of a wider campaign. Seven hundred sites is a large number in itself, but the more important figure may be the proportion, because an attack that can reach seven per cent of a country’s supermarkets in a single night is an attack that could, with a little more time, have reached far more, and that is the thought that has concentrated minds in Paris.

3. The Damage: Food, Fires and Fear

The damage caused by the attack was measured first in food, and then in fire, and then in something harder to measure, which is the fear that the systems people rely on every day can be turned against them by someone they cannot see. The supermarkets that were hit were forced to throw away entire inventories of perishable food, because once a fridge or a freezer has spent hours at temperatures far above the safe limit, nothing inside it can be sold, and the losses, according to one report drawing on the French authorities, ran into the tens of millions of euros. The food that was lost was not a single category but the whole range of what a supermarket sells fresh, from milk and cheese to meat and fish to frozen ready meals, and the scale of the waste was visible in the days after the attack, when shops that had been hit were left with empty shelves and with the cost of restocking them. The financial cost, however large, is only part of the story, because the attack also caused physical damage to the equipment itself, and to the buildings that housed it, and because it left shop workers and customers with the unsettling knowledge that the machines that keep their food safe can be made to do the opposite. The French authorities have been careful to describe the attack as sabotage rather than theft, because nothing was stolen and no ransom was demanded, and that description matters, because it means that the attackers’ purpose was destruction, and that the damage they caused was the point of the operation rather than a by-product of it.

3.1 Spoiled Stock and Losses in the Tens of Millions

The food losses were the most immediate and the most visible consequence of the attack, and they were also the most widely felt, because they touched every shopper who arrived at a supermarket in the days after October 12 to find the chilled and frozen aisles empty. The reporting on the attack said that the losses ran into the tens of millions of euros, a figure that was attributed to the French authorities and that covered the value of the food that had to be discarded, although no single official total has yet been published, and the true cost will only become clear when the retailers and their insurers have finished counting. The waste was not limited to the supermarkets themselves, because the food that was spoiled had already passed through a chain of suppliers, from farms and fisheries to processors and distributors, and the loss of a night’s stock in seven hundred shops represents a loss for everyone along that chain, from the farmer whose milk was thrown away to the distributor whose delivery was wasted. The shops that were hit also faced the cost of cleaning and repairing their refrigeration systems, of checking that the equipment was safe to use again, and of restocking shelves that had been emptied, and those costs, which are harder to count than the value of the food itself, will have added to the bill. The tens of millions of euros is a large sum, but it is worth putting it in context, because the French grocery industry turns over hundreds of billions of euros a year, and the financial damage, while serious for the shops that were hit, is not the kind of loss that threatens the industry as a whole, and that is part of why the French government has described the attack as a matter of national security rather than as a commercial dispute, because the point of the operation was not to bankrupt the supermarkets but to show that they could be hit.

3.2 At Least Fifteen Fires

The fires were the most frightening part of the attack, and they are the detail that has done most to fix the story in the public mind, because a cyberattack that starts a fire is a cyberattack that has crossed the line from the digital world into the physical one. The French authorities said that at least fifteen fires broke out as a result of the attacks, a figure that was given in the Cyber Crisis Coordination Centre’s report and repeated by the Paris prosecutor’s office, although some reporting put the number higher, at around twenty fires, and the difference between the two figures has not yet been explained. The fires are understood to have been caused by the refrigeration equipment itself, which was forced to run at temperatures it was never designed to reach, and which in some cases overheated to the point where components caught fire, and the fact that the fires broke out in shops that were closed for the night, with no one present to raise the alarm, made them more dangerous than they might otherwise have been. No deaths have been reported as a result of the fires, and no serious injuries have been reported either, which is fortunate, because a fire in a closed supermarket at night could easily have spread to neighbouring buildings before anyone noticed it, and the absence of casualties is a matter of luck as much as of design. The fires are also the detail that has most clearly established the attack as sabotage rather than as a prank or a protest, because a hacker who sets out to spoil food is making a point, but a hacker who sets out to start fires is making a threat, and the French government has treated the fires as evidence that the attackers were willing to put lives at risk in order to cause disruption, and that is a judgement that has shaped the severity of the response.

4. Who France Says Did It

The question of who carried out the attack was, for a month, the subject of speculation, and the speculation was coloured by the fact that the attack looked, at first glance, like the work of a criminal gang or a group of hacktivists, because it targeted a soft and unglamorous part of the economy, and because it caused damage that was visible but not obviously strategic. The French government’s answer, when it came on November 9, was that the attack was the work of a state, and of a specific part of that state, the Islamic Revolutionary Guard Corps, the elite military force that answers directly to Iran’s religious leadership and that operates, alongside the regular armed forces, as a parallel army with its own intelligence, cyber and overseas operations. The Guard has been under sanctions from the United States and the European Union for years, and the European Union designated it as a terrorist organisation in January 2026, according to the reporting on the attribution, which means that France’s accusation is not only a claim about a single attack but a claim about an organisation that Europe has already decided is a threat. The attribution to the Guard, rather than to Iran as a whole, matters, because it allows France to target its response at the specific people and units it holds responsible, rather than at the Iranian state in general, and because it frames the attack as the work of a military organisation rather than as the policy of a government, even though the distinction between the two is, in the case of the Guard, a fine one.

4.1 Shahid Kaveh and the Revolutionary Guard

Shahid Kaveh is not a name that most people outside the cybersecurity industry had heard before Monday, but it is a name that has been appearing in intelligence reports for several years, and it is a name that carries a history of its own. The unit is described by the French authorities as an offensive cyber unit affiliated with the electronic and cyber centre of the Islamic Revolutionary Guard Corps, and it is better known in the cybersecurity world by its hacktivist persona, CyberAv3ngers, a name under which it has claimed responsibility for attacks on industrial control systems in several countries. The French report said that Shahid Kaveh had been linked to attacks on industrial controllers at water utilities in the United States, and the reporting on the attribution noted that American national security and law enforcement agencies had attributed a series of cyberattacks against water facilities in the United States to the same group in 2023, and that the group was suspected of involvement in attacks that targeted more than one hundred internet-exposed water systems in America in July of this year. The unit’s speciality, according to the French report, is industrial control equipment, the computers that manage the physical systems of modern life, from water treatment to power generation to refrigeration, and the report said that since at least June 2024 the unit had possessed the ability to scan, access and control equipment from manufacturers including Schneider Electric, Siemens and Rockwell. The attribution of the supermarket attacks to Shahid Kaveh therefore fits a pattern, because the unit has been attacking the same kind of equipment, in the same kind of way, for years, and the supermarket attack can be seen as the largest and most destructive application of a method that the unit had already practised on smaller targets.

4.2 The Three Names in the Report

The French report did more than name a unit, it named people, and the naming of individuals is one of the most significant features of the attribution, because it turns an abstract accusation against a foreign organisation into a concrete accusation against named men, and it creates the possibility of criminal proceedings against them. The annex to the report named and pictured three men, Hamid Reza Lashgarian, who is described as the head of the Revolutionary Guard’s electronic and cyber centre, and Mahdi Lashgarian and Reza Salarvand, who are described as commanders of Shahid Kaveh, and the report said that the techniques used in the supermarket attacks had been seen in the unit’s operations since at least April 2026. The Paris prosecutor’s investigation, opened on the same day, targets the head of Shahid Kaveh, his two deputies and others yet to be identified, and the prosecutor’s office said that international arrest warrants would be requested for the unit’s leader and his two deputies, which means that the three men named in the report are now the subject of a criminal case as well as an intelligence attribution. The naming of individuals is a deliberate choice, because it allows France to seek sanctions against specific people, to request their arrest if they travel outside Iran, and to put pressure on the organisation by making its leadership visible, and it is a choice that reflects a wider trend in the attribution of cyberattacks, in which governments increasingly name the people they hold responsible rather than simply blaming a country in general. Whether the warrants will ever be executed is another matter, because the men named are unlikely to travel to a country that would arrest them, and because Iran does not extradite its own citizens, but the warrants serve a purpose even if they are never used, because they put the accused on notice that they are known, and that their movements are now restricted.

5. How France Says It Knows

The attribution of a cyberattack is never a simple matter, because hackers can conceal their locations, can borrow the tools of other groups, and can plant false clues that point in the wrong direction, and the history of cyber attribution is full of cases in which an early accusation turned out to be wrong. France has said that its attribution rests on a combination of technical and intelligence findings, and the reporting on the five-page report gives a outline of what those findings were, although the full evidence has not been published, and the public has been asked to accept the conclusion on the strength of the institutions that reached it. The French report said that the attribution was based on several factors, including evidence of the Persian language within the infrastructure and the artefacts associated with the hacking operation, the similarity of the tactics, techniques and procedures used in the attack to those used in other hacks by the same group, and the publicity given to the hacking on propaganda channels linked to Shahid Kaveh, such as CyberbanNews, which celebrated the operation after it had taken place. The report also said that the characteristics of the infrastructure used in the attack, and the specialised tools associated with the unit, pointed to Shahid Kaveh, and that the combination of these factors, taken together, was enough to justify the attribution. The French authorities have not published the raw data behind these claims, and they have not explained, in detail, how each piece of evidence was weighed, and that is a decision that has already been criticised, because an attribution that cannot be checked cannot be fully trusted, and because the history of cyber attribution gives good reason to be cautious.

5.1 Language, Tools and Propaganda Channels

The evidence that France has described falls into three categories, and each of them is worth examining, because each of them has strengths and weaknesses, and because the strength of the attribution depends on the strength of the weakest of them. The first category is language, and the report said that traces of the Persian language were found within the infrastructure and the artefacts associated with the hacking operation, which is the kind of clue that can be significant, because it suggests that the people who built the tools spoke Persian, but which is also the kind of clue that can be faked, because any hacker can leave a few words of Persian in their code in order to mislead an investigator. The second category is method, and the report said that the tactics, techniques and procedures used in the supermarket attacks matched those used by Shahid Kaveh in earlier operations, and that the techniques used in the attacks had been seen in the unit’s work since at least April 2026, which is a stronger kind of evidence, because a group’s methods are harder to imitate than its language, and because the match across several operations is harder to explain away as coincidence. The third category is publicity, and the report said that the hacking was publicised on propaganda channels linked to Shahid Kaveh, such as CyberbanNews, which is a channel that has celebrated the unit’s operations in the past, and the fact that the operation was claimed, even indirectly, by a channel associated with the unit is a piece of evidence that points in the same direction as the other two. Taken together, the three categories form a coherent picture, and the French authorities have evidently decided that the picture is clear enough to justify a public attribution, but it is worth noting that each category, on its own, would not be enough, and that the case rests on the combination rather than on any single piece of proof.

5.2 What Has Not Been Shown

The most important thing about the French attribution is not what has been shown but what has not been shown, because the evidence that would allow an independent observer to test the claim has not been published, and the public has been asked to trust the judgement of the institutions that made it. Reuters, reporting on the attribution, said that it could not establish exactly how the French authorities had reached their conclusion, and that attributing cyberattacks is notoriously difficult, because hackers can conceal their locations, and that observation, which was repeated in several of the reports on the story, is a reminder that attribution is a judgement rather than a fact, and that judgements can be wrong. The French report itself is only five pages long, which is short for a document that is being asked to carry the weight of an accusation against a foreign state, and the summary published by CERT-FR is shorter still, and neither document contains the kind of detailed technical evidence, such as the addresses of the servers used, the samples of the malware, or the logs of the intrusions, that would allow an independent analyst to reproduce the investigation. The French authorities have also not explained how they ruled out other possibilities, including the possibility that the attack was carried out by a different group using Shahid Kaveh’s tools, or that the clues pointing to Iran were planted by someone else, and those are the questions that any serious assessment of the attribution will need to answer. None of this means that the attribution is wrong, because the institutions that made it, ANSSI, the DGSE and the DGSI, are serious and capable, and because the pattern of the unit’s earlier operations is consistent with the supermarket attack, but it does mean that the attribution should be reported as France’s conclusion, and not as a fact that has been independently established, and that is how this report has presented it throughout.

6. The Response: Sanctions, Summons and Warrants

The response that France has promised is, like the attribution itself, a package rather than a single measure, and it is designed to work on several fronts at once, so that even if one part of it fails, the others will still apply pressure. The first part is diplomatic, and it is the summoning of Iran’s ambassador, a formal step that allows a government to deliver a protest in person and to make clear, in the most direct terms, that it regards the attack as a serious matter. The second part is legal, and it is the criminal investigation opened by the Paris prosecutor, which creates the possibility of arrest warrants and of prosecutions if the accused ever fall into French hands. The third part is economic, and it is the promise of sanctions at the European level, which would freeze the assets of the people and organisations held responsible and would ban them from travelling to the European Union, and which would require the agreement of the other member states. And the fourth part is the one that Barrot hinted at but did not describe, when he said on Tuesday that France would take all measures, including those it might not disclose publicly, that it considered proportionate and necessary, a phrase that was widely understood to mean that France reserves the right to respond in cyberspace, and to do so without announcing it in advance. The combination of these measures is a familiar one, because it is the same combination that Western governments have used in response to earlier cyberattacks, but the scale of the attack, and the fact that it targeted civilian food infrastructure, has given the response a sharper edge than usual, and the question now is whether the measures, taken together, will be enough to deter the next attack.

6.1 The Ambassador Is Called In

The summoning of an ambassador is one of the oldest tools of diplomacy, and it is a step that is taken when a government wants to deliver a message that is too serious to be left to a telephone call or a written note, and the summoning of Iran’s ambassador to Paris was, in that sense, the most traditional part of France’s response. Barrot said on Monday that the ambassador was being summoned to receive a very strong protest against what he called an extremely serious act, and the foreign ministry said that the ambassador would be called in to hear France’s strongest condemnation of the cyberattacks, and on Tuesday Barrot confirmed that the ambassador had been summoned earlier that day. The summoning is a symbolic act as much as a practical one, because the ambassador himself is not accused of carrying out the attack, and because the protest he receives will be passed to Tehran, where it will be read by people who already know what France thinks, but the symbolism matters, because it puts the Iranian government on formal notice that France holds it responsible, and because it creates a public record of the accusation that cannot easily be withdrawn. The summoning also serves a domestic purpose, because it shows the French public that the government is taking the attack seriously, and that it is willing to confront Iran directly, and it serves a European purpose, because it signals to France’s partners that Paris expects them to take the same view. Iran’s ambassador, for his part, will have listened to the protest and will have reported it to Tehran, and the Iranian government’s response, when it comes, will be shaped in part by the tone of the meeting, and by the knowledge that France has already decided to seek sanctions, which means that the summoning was not the end of the process but the beginning of it.

6.2 The Road to European Sanctions

The promise of European sanctions is the centrepiece of France’s response, and it is also the part of the response that will take the longest to deliver, because sanctions at the European level require the agreement of all twenty-seven member states, and because the process of agreeing them is slow and political. Barrot said on Monday that France would impose sanctions at the European level against all those responsible for the attack, and he repeated the promise on Tuesday, saying that Paris would seek sanctions against the Iranian entities and individuals involved, and the European Union’s foreign policy chief, Kaja Kallas, said that the bloc’s foreign affairs council would discuss the incident on the following Monday, November 16, and that attribution to Iran would call for a strong response. The scope and the timing of any sanctions have not yet been announced, and the reporting on the story has been careful to describe the sanctions as a promise rather than a fact, because the council has not yet met, and because the member states have not yet agreed on who should be listed and what measures should be applied. The sanctions, if they are agreed, are likely to take the form of asset freezes and travel bans against the individuals and organisations named in the French report, and they would be added to the sanctions that the European Union has already imposed on Iran, including the designation of the Revolutionary Guard as a terrorist organisation in January 2026, which was reported in the coverage of the attribution. The question that will determine the success of the sanctions is whether the other member states share France’s assessment of the evidence, and whether they are willing to impose new measures on Iran at a time when relations with Tehran are already strained over its nuclear programme and its regional activities, and the discussion on November 16 will be the first test of that willingness.

7. A Longer Campaign Against France

The supermarket attacks did not come out of nowhere, and the French authorities have been at pains to present them as the latest chapter in a longer campaign rather than as an isolated incident, because the longer history gives the attribution a context that makes it easier to understand. The French foreign ministry said that the Iranian cyber threat against French interests is not new, and that Iran has already carried out several destabilising acts against France, and the report from the Cyber Crisis Coordination Centre described the incidents as part of a campaign of destabilisation against French interests dating back at least six years. The history that the report sets out includes the defacement of the website of the satirical newspaper Charlie Hebdo, an attack that was attributed to another Revolutionary Guard unit, Shahid Shoostari, also known as Emennet Pasargad, and that involved the theft of database information as well as the defacement itself, and it includes an attempted operation against the company that managed the video-display systems during the Paris Olympic and Paralympic Games in 2024, which was also attributed to Iranian actors. The French report said that both Shahid Shoostari and Shahid Kaveh operate under the Revolutionary Guard’s electronic and cyber centre, which means that the two units, although they have different names and different targets, are part of the same organisation, and that the campaign against France has been carried out by a single institution over a period of years. The history matters because it changes the way the supermarket attacks should be understood, not as a sudden escalation but as a continuation, and because it suggests that the French authorities have been watching these units for a long time, and that the attribution of the supermarket attacks rests on years of observation rather than on a single investigation.

7.1 Charlie Hebdo, the Olympics and Six Years of Pressure

The two earlier incidents that the French report cites are worth examining in detail, because they show the range of targets that the Iranian units have chosen, and because they show how the campaign against France has evolved. The attack on Charlie Hebdo in 2023, which was attributed to Shahid Shoostari, involved the defacement of the newspaper’s online shop and the theft of information from its database, and it was an attack on a symbol of French free expression, because Charlie Hebdo is the satirical weekly that was the target of a terrorist attack in 2015, and because an attack on its website was understood, in France, as an attack on the values that the newspaper represents. The attempted operation against the video-display systems during the Paris Olympics in 2024 was a different kind of target, because it was aimed not at a symbol but at an event, and because it was intended, if it had succeeded, to disrupt the broadcast of the Games to a global audience, which would have been a humiliation for France as well as a practical problem. The report’s description of a campaign dating back at least six years suggests that these two incidents are not the whole story, and that there have been other operations, some of which may not have been made public, and the French authorities have said that the supermarket attacks should be seen in that light, as the most destructive operation in a campaign that has been running for years. The history also explains why the French government has responded so forcefully, because a government that has been the target of a campaign for six years is less likely to treat the latest attack as an isolated incident, and more likely to see it as evidence that the campaign is escalating, and that a stronger response is needed.

7.2 The Second Wave Europe Cannot Yet Explain

The supermarket attacks in France were not the only attacks on refrigeration systems in Europe in the autumn of 2026, and the existence of a second wave of attacks, which hit other countries in early November, is one of the most important and most uncertain parts of the story. On November 2, stores in at least nine other European countries were hit by a suspected cyberattack on their freezer systems, according to the reporting, and the countries affected included Ireland, Sweden, Belgium, Estonia, the Netherlands and Luxembourg, among others, and the methods used were understood to be the same as those used in the French attacks, with refrigeration controllers reached remotely and their temperature settings altered. The French report does not address the second wave, and the French authorities have not attributed it to Iran, and the link between the French attacks and the later incidents in other European countries has not been established, which means that it is not yet known whether the second wave was carried out by the same people, by a different group using the same methods, or by a group that had learned from the French attacks and decided to copy them. One report said that the second wave also hit three sites belonging to France’s national blood service, where temperature and defrost settings were altered, which, if confirmed, would mean that the attackers had moved from food to medical supplies, and that the risk they posed had grown. The American authorities have also taken notice, because the FBI, the Cybersecurity and Infrastructure Security Agency and three other federal departments issued a joint warning on November 5 about malicious activity targeting industrial refrigeration worldwide, which suggests that the problem is not confined to Europe, and that the vulnerability in refrigeration systems is a global one. The second wave is a reminder that the story is not finished, and that the attribution of the French attacks, however firm, does not explain everything that has happened, and that the next wave, if there is one, may be harder to attribute than the first.

8. What to Watch Next

The story of the supermarket cyberattacks is far from over, and the weeks ahead will bring the answers to the questions that Monday’s announcement left open, and the tests that will show whether France’s attribution and its response are as solid as the government has claimed. The first thing to watch is the meeting of the European Union’s foreign affairs council on November 16, because that meeting will show whether France’s partners share its assessment of the evidence, and whether they are willing to agree to new sanctions against the people and organisations named in the French report, and the outcome of that meeting will determine whether the sanctions promise becomes a reality or remains a statement of intent. The second thing to watch is the criminal investigation opened by the Paris prosecutor, because the investigation will produce, over time, a fuller account of how the attacks were carried out, and because the request for international arrest warrants will test whether the men named in the report can be brought to justice, or whether they will remain beyond the reach of the French courts. The third thing to watch is Iran’s response, because Tehran has not yet formally answered the accusation, and because its answer, when it comes, will shape the diplomatic future of the dispute, and will show whether Iran intends to deny the attribution, to ignore it, or to retaliate in some way. And the fourth thing to watch is the security of the refrigeration systems themselves, because the attack exposed weaknesses that have not yet been fixed, and because the second wave of attacks in early November showed that the same methods can be used again, and that the next target may not be a supermarket at all.

8.1 The Tests That Will Show Whether This Is Real

There are several tests that will show, over the coming months, whether the French attribution is as solid as the government has claimed, and the first of those tests is the simplest, which is whether France publishes more of the evidence behind its conclusion, because an attribution that is supported by detailed technical data is more convincing than one that rests on a five-page summary, and because the publication of that data would allow independent analysts to test the claim. The second test is the reaction of France’s European partners, and whether they agree to the sanctions that Paris is seeking, because their agreement would be a sign that they have seen the evidence and found it convincing, and their refusal would be a sign that they have not. The third test is the criminal investigation, and whether it produces charges that can stand up in court, because a prosecution requires a standard of proof that is higher than the standard for a public attribution, and because the investigation will have to show, in detail, how the attacks were carried out and who carried them out. The fourth test is the behaviour of the attackers themselves, and whether the attacks stop, because a campaign that ends after the attribution would suggest that the attribution had its intended effect, and a campaign that continues would suggest that it had not. And the final test is the security of the systems that were attacked, and whether the retailers and the manufacturers of refrigeration equipment fix the weaknesses that the attack exploited, because the attack was made possible by elementary security flaws and weak passwords, and because those flaws will remain an invitation to any hacker, Iranian or otherwise, until they are fixed.

8.2 The Bottom Line

The bottom line of Monday’s announcement is that France has accused Iran’s Revolutionary Guard of carrying out the first large-scale cyber sabotage campaign on French soil, an attack that struck about seven hundred supermarkets and food businesses on the night of October 11 and 12, spoiled food worth tens of millions of euros, and started at least fifteen fires, and that France has answered with a summons for Iran’s ambassador, a criminal investigation, a request for international arrest warrants, and a promise to seek European sanctions against everyone responsible. The attribution, which names the Shahid Kaveh unit and three of its senior figures, rests on evidence that France has described but not published, and Iran, which routinely denies carrying out malicious cyber operations, had not formally responded by the time Barrot spoke again on Tuesday, and the gap between the firmness of the accusation and the thinness of the public evidence is the central uncertainty of the story, and it will only be resolved when France publishes more of its case, or when its European partners endorse it, or when the criminal investigation produces a fuller account. The attack itself, whatever its authorship, has exposed a vulnerability that goes far beyond France, because the refrigeration systems that keep food cold are connected to the internet, protected in many cases by little more than weak passwords, and used in every country in Europe, and the second wave of attacks on November 2 showed that the same methods can be used again, and that the next target may be a hospital, a blood bank or a water plant rather than a supermarket. Whether the French response proves to be enough will depend on whether the sanctions are agreed, whether the warrants are executed, and whether the systems that were attacked are made secure, and until those questions are answered, the accusation will stand as a warning that the everyday machines of modern life can be turned into weapons. The coming weeks will provide the answers.

What remains unconfirmed: the exact evidence behind France’s attribution has not been published, so the claim that Shahid Kaveh carried out the attacks is reported here as France’s conclusion and has not been independently verified; the number of fires is reported as at least fifteen by the French authorities, while some reporting puts the figure at around twenty, and the difference has not been explained; no official total for the financial damage has been published, and the figure of losses in the tens of millions of euros comes from reporting that attributed it to the French authorities rather than from a published official assessment; no timetable or list of targets for the promised European sanctions has been announced, and the sanctions remain a proposal to be discussed by the European Union’s foreign affairs council on November 16; Iran has not formally responded to the accusation, and its UN mission did not reply to requests for comment, so no official Iranian position on the attribution is available; and the second wave of refrigeration attacks in early November, which hit at least nine other European countries, has not been attributed to Iran by the French authorities, so any link between that wave and the French attacks is unconfirmed.

Comments

comments