France Accuses Iran's Revolutionary Guard of Turning Supermarket Freezers Into Weapons

France on Monday formally accused Iran's Islamic Revolutionary Guard Corps of carrying out a cyberattack that disabled refrigeration systems at about 700 supermarkets and food sites across the country last month, in what Paris called an unprecedented act of sabotage on French soil. Foreign Minister Jean-Noël Barrot announced the attribution on the sidelines of G7 talks in Paris, summoned the Iranian ambassador to protest, and said France would seek European Union sanctions against those responsible. Prosecutors in Paris opened a judicial investigation the same day and requested international arrest warrants for three Iranians said to have directed the operation.

The attack struck in the early hours of 11–12 October, when hackers remotely seized control of temperature-management software used by major French retailers and drove refrigerator and freezer temperatures to 50°C (122°F) for roughly six hours while stores were closed. The heat spoiled millions of euros' worth of fresh and frozen food, forcing retailers to discard perishable stock, and fires broke out in at least 15 locations as overheated units melted or caught alight, according to French authorities. About 700 commercial sites were affected — mostly supermarkets, but also butcher shops, a slaughterhouse and food-processing plants — including stores run by Carrefour, Monoprix, Intermarché and Coopérative U.

France's national cybersecurity agency, ANSSI, attributed the attack to a unit called Shahid Kaveh, which it describes as an offensive cyber unit inside the Revolutionary Guard's Electronic and Cyber Centre. Investigators pointed to technical indicators including the use of Farsi and internet addresses associated with equipment in Iran, and said the operation was promoted shortly afterwards through CyberbanNews, a propaganda outlet linked to the group. The Paris prosecutor, Laure Beccuau, said the judicial investigation concerned suspected organised cybercrime committed in the interests of a foreign power, and named the unit's leader and two deputies — identified in the French intelligence report as Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand — as the subjects of the arrest-warrant requests. ANSSI also linked a second Guard-affiliated group, Shahid Shoostari, to other cyberattacks against France since 2020.

The incident exposed how exposed everyday infrastructure has become. The targeted software, supplied by Danish engineering firm Danfoss, lets retailers manage refrigeration units remotely, and researchers found thousands of its control systems reachable from the internet — one count put the figure at 2,991 exposed hosts worldwide, 1,825 of them in France. The firmware itself contained a built-in "datetime-based password" mechanism that researchers have described as a backdoor, a detail that drew wide attention online. Mr Barrot described the operation as unprecedented in its scale and aggression, calling it the first major cyberattack intended to sabotage infrastructure on French territory.

The accusation is a government attribution, not a court finding, and the full technical basis has not been made public. Iran's mission to the United Nations did not respond to a request for comment, and Tehran has previously denied conducting malicious cyber operations. The picture is further complicated by a second wave of similar attacks at the start of November, when grocery stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, Denmark, Sweden and Finland were forced to discard tons of spoiled food after their refrigeration systems were disrupted. Russian hacktivist groups claimed responsibility for those attacks, and no official source has linked that wave to Iran.

Online, the reaction mixed disbelief at the target with alarm at the vulnerability. A thread on Reddit's r/worldnews about the French accusation drew more than 8,800 upvotes, with the most popular comment — more than 2,500 upvotes — joking that "maybe having the date as the password was a not so great idea" (r/worldnews), while on Hacker News, readers discussing the exposed control systems argued that devices like these should never have been connected to the internet at all. The episode now moves from the technical to the diplomatic: the judicial investigation and the push for EU sanctions will test whether attribution, arrest warrants and penalties can deter a form of sabotage that turns the machinery of daily life into a weapon.