France accuses Iran Revolutionary Guard cyber unit of sabotaging 700 supermarket refrigerators and seeks EU sanctions

France has formally accused an elite cyber-operations unit inside Iran’s Islamic Revolutionary Guard Corps of orchestrating an unprecedented sabotage campaign against industrial refrigeration controllers across more than 700 French supermarkets, escalating the confrontation to the European Union ahead of next week’s Foreign Affairs Council meeting in Brussels while Tehran flatly denied responsibility on Wednesday.

French Foreign Minister Jean-Noël Barrot announced that technical forensics conducted by France’s national cybersecurity agency, ANSSI, alongside the Cyber Crisis Coordination Centre and Paris cybercrime prosecutors traced the coordinated overnight intrusion on October 11–12 to the Shahid Kaveh unit — an operational group embedded within the IRGC’s cyber-electronic command previously linked by western intelligence services to attacks on water utilities, fuel stations, and maritime logistics.

Paris summoned Iran’s ambassador to the Quai d’Orsay to deliver a formal diplomatic démarche and confirmed that EU foreign policy chief Kaja Kallas has placed targeted European cyber-sanctions designations on the agenda for the bloc’s 27 foreign ministers when they convene on November 16.

Remote commands forced defrost cycles and triggered 15 equipment fires

Unlike conventional ransomware incidents that encrypt back-office billing servers, the October assault struck directly at operational technology governing cold-chain storage across major French grocery banners, including stores operated by or affiliated with Carrefour, Monoprix, Intermarché, and Coopérative U.

According to French investigators and retail industry disclosures, attackers compromised networked refrigeration-management controllers exposed to remote maintenance links during the night of October 11–12. Once inside, operators overrode thermal safety thresholds, disabled automated temperature alarms so overnight monitoring desks would not receive early alerts, and forced hundreds of chilled and frozen display cases and cold rooms into sustained heating and defrost cycles.

By the time store managers arrived the following morning, spoiled meat, dairy, seafood, and frozen goods across more than 700 retail outlets had to be destroyed under French food-safety rules, inflicting tens of millions of euros in direct inventory losses and cleanup expenses. Investigators also documented at least 15 localized electrical and compressor fires sparked by overheated refrigeration units pushed beyond normal operating tolerances.

The attack highlights growing alarm among western cyber defenders over exposed industrial and edge network appliances — the same class of perimeter threat that prompted US officials this week to issue an emergency CISA directive ordering agencies to patch exploited enterprise firewalls.

Barrot warns of ‘crossed threshold’ as Tehran rejects allegations

Barrot described the operation as an unacceptable escalation targeting civilian daily life inside a European Union member state, saying the sabotage “crossed a threshold” by deliberately seeking physical destruction and public disruption rather than espionage.

“France will not let deliberate attacks against its civilian economic infrastructure go unanswered,” Barrot said in outlining Paris’s push for coordinated EU asset freezes and travel bans under the bloc’s cyber-sanctions regime, which allows Brussels to sanction foreign intelligence directorates and named commanders behind destructive cyber operations.

On Wednesday, Iran’s Foreign Ministry rejected the French attribution as “baseless and politically motivated,” accusing Paris of deflecting domestic pressures and aligning with broader western pressure campaigns against Tehran. Iranian diplomats maintained that Tehran does not target civilian food supply chains in Europe and warned that fresh European Union sanctions would further strain diplomatic channels.

Implications for European critical infrastructure security

Cybersecurity analysts across Europe noted that the French supermarket incident marks one of the largest confirmed state-linked operational-technology attacks against civilian retail infrastructure in European history. Because building-management systems, HVAC controllers, and commercial refrigeration units are frequently managed by third-party regional contractors over shared remote-access gateways, compromising a single maintenance vendor or default-credential controller line can let attackers fan out simultaneously across hundreds of storefronts.

Ahead of Monday’s EU Foreign Affairs Council session in Brussels, ANSSI has issued updated hardening guidance urging European retailers, cold-storage warehouses, and pharmaceutical distributors to segment refrigeration controllers off public internet connections, enforce multi-factor authentication on vendor maintenance portals, and install independent out-of-band thermal sensors incapable of being silenced remotely.