A month after the night when the refrigerators of some 700 French supermarkets went haywire, Paris has named a culprit: on November 9, France attributed the cyberattack to Iran, and more specifically to the Shahid Kaveh unit, which is attached to the cyber centre of the Revolutionary Guards. The Iranian ambassador was summoned, European sanctions have been proposed and the judiciary is targeting named officials. Tehran denies it. Here is what we know, and what the episode changes for businesses.
An official attribution, a rare move
In its statement of November 9, the Ministry of Foreign Affairs describes the operation as the first offensive cyber campaign carried out on national soil for the sole purpose of sabotage. The text links the attack to the Shahid Kaveh unit, presented as a lasting threat to critical infrastructure. It draws on a joint report by the Cyber Crisis Coordination Centre, the C4, which brings together ANSSI, the DGSE, the DGSI, the DGA and the cyber defence command.
Such a public designation of a state remains exceptional. France had already blamed Iran for operations targeting Charlie Hebdo in 2023 and the Paris Olympic Games in 2024, and the European Union sanctioned the entity Emennet Pasargad in March 2026 for its part in those actions. This time, Paris describes a campaign of unprecedented scale and aggressiveness, conducted for the purpose of sabotage.
What the investigation reveals
According to RTS, on the night of October 11 to 12 the attackers took control of refrigeration controllers installed in the stores, notably Danfoss-branded ones. They triggered endless defrost cycles and switched off the alarms, causing losses of goods and some twenty fires. According to CNBC, the temperature of some display cases rose by as much as 50°C, and chains such as Intermarché, E.Leclerc, Carrefour, Monoprix and Coopérative U are among the victims. The Quai d’Orsay puts the food losses at several tens of millions of euros.
To support the attribution, Paris prosecutor Laure Beccuau pointed, according to RTS, to the use of Farsi and to IP addresses leading to devices located in Iran; the C4 speaks of a body of evidence. Also according to RTS, the investigating judges are targeting the head of Shahid Kaveh and his two deputies, and the investigation has been entrusted to the Anti-Cybercrime Office and the DGSI. The prosecutor’s office is seeking international arrest warrants, CNBC reports.
The diplomatic and judicial fallout
Iran’s ambassador was summoned. France is proposing to its partners new European sanctions against Iranian entities and individuals, including for other cyber activities. Minister Jean-Noël Barrot does not rule out, according to CNBC, either bans on entering European territory or asset freezes. Paris also reserves the right to take other measures, public or not. Tehran rejects outright accusations that its Ministry of Foreign Affairs, quoted by CNBC, called “baseless and malicious”.
One point remains to be clarified. In early November, supermarkets in Belgium, the Netherlands, Ireland, Finland, Sweden and Switzerland suffered comparable attacks, and, according to CNBC, French blood banks were targeted on November 2. The specialist press has mentioned two pro-Russian groups, NoName057(16) and Z-Pentest; the Kremlin denied any involvement on November 5, RTS reports. The French attribution covers only the wave of October 11 to 12: nothing, at this stage, formally links all these attacks to the same perpetrator.
What businesses should take away
The scenario shows that refrigeration, heating or ventilation equipment connected to the Internet can become a weapon against its owner. According to CNBC, the attackers acted through the controllers’ web interfaces. For a shop, a warehouse or a central kitchen, a few reflexes are essential:
- list all remotely controllable technical equipment, including that managed by an installer;
- take their interfaces off the Internet or put them behind a VPN, and change default passwords;
- provide temperature alarms that are independent of the controller itself;
- require the maintenance provider to supply written access rules and a log of its connections.
Frequently asked questions
Who is the Shahid Kaveh unit?
According to the French statement, it is an offensive cyber unit attached to the electronic and cyber centre of the Islamic Revolutionary Guard Corps in Iran. Paris considers it a persistent threat to critical infrastructure.
What sanctions is France considering?
Paris is proposing new European sanctions against Iranian entities and individuals. The foreign minister mentions in particular entry bans and asset freezes, and the judiciary is seeking international arrest warrants.
Are the November attacks on European supermarkets linked?
Nothing confirms it at this stage. The French attribution covers the wave of October 11 to 12 in France. The attacks reported afterwards in other countries have not been officially attributed to the same actor.
Sources
- Déclaration d'attribution à l'Iran de cyberattaques visant la France — French Ministry for Europe and Foreign Affairs, 2026-11-09
- La France accuse l'Iran des cyberattaques visant les réfrigérateurs de 700 supermarchés — RTS, 2026-11-10
- France blames Iran for supermarket refrigerator cyberattacks, weighs sanctions — CNBC, 2026-11-10