France has accused Iran’s Islamic Revolutionary Guard Corps of carrying out the supermarket fridge cyberattack that knocked out refrigeration and freezer systems at around 700 supermarkets across France in early October. French Foreign Minister Jean-Noel Barrot made the accusation on Monday, November 9, 2026. He said the responsibility for the attack lies with Iran’s Islamic Revolutionary Guard Corps. He called it an attack of unprecedented scale and unprecedented aggressiveness, and the first large-scale cyberattack carried out for sabotage purposes on French national territory. France summoned Iran’s ambassador on Tuesday morning, November 10, and Paris now plans to push for European Union sanctions against those it holds responsible.
Table of Contents
Quick Facts
| Detail | What France says happened |
|---|---|
| Date of the attack | Overnight on October 11-12, 2026 |
| Stores affected | Around 700 supermarkets across France |
| Retailers named | Intermarche, E. Leclerc, Carrefour, Monoprix and Cooperative U |
| What was targeted | Refrigeration and freezer systems |
| Equipment named | Controllers from Danfoss, Dixell and Copeland |
| Main damage | Fresh and frozen food spoiled |
| Fires reported | Around 15 to 20 fires |
| Group named by France | Shahid Kaveh, a unit tied to the IRGC |
| People named | Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand |
| French response | Ambassador summoned, EU sanctions sought, investigation opened |
| Iran position | No immediate comment from Tehran |
What Happened Overnight on October 11 and 12
The attack took place overnight on October 11-12, 2026, when many stores were closed and few staff were on site to notice a problem. Hackers remotely accessed refrigeration controllers through web interfaces. Those controllers manage temperature, cooling cycles and defrost cycles in supermarket fridges and freezers. Once inside, the attackers raised temperatures by switching on defrost cycles. In some cases, French officials said fridges were heated by as much as 50 degrees Celsius. That kind of change can ruin fresh food fast, and it can also ruin frozen food that must stay at a steady low temperature to remain safe to sell.
The result was widespread spoilage. Fresh food lost its cold chain, frozen food thawed, and stock that could no longer be sold had to be thrown away. Around 700 supermarkets were affected across France, and the retailers named included Intermarche, E. Leclerc, Carrefour, Monoprix and Cooperative U, known as Systeme U.
The damage went beyond spoiled food. The Paris prosecutor’s office reported around 15 to 20 fires linked to the incident, which added a serious safety concern to a story that might otherwise have been seen as a food waste problem.
How the Attackers Reached the Fridges
The attackers did not need to enter a store. They reached the refrigeration controllers remotely through web interfaces. Many modern refrigeration systems can be watched and managed online, which helps staff check temperatures. That same remote access can become a weakness if it is not protected well, and French officials said the attackers used that route to take control and change the settings from a distance.
The equipment named came from Danfoss, Dixell and Copeland. Those controllers run commercial refrigeration and control cooling and defrost cycles. A defrost cycle briefly warms parts of the system to clear ice, but when it is switched on at the wrong time it can push temperatures up fast. French officials said the attackers used that normal function as a weapon, raising temperatures in some cases by as much as 50 degrees Celsius.
The overnight timing also mattered. With stores quiet, a sudden temperature change could go unnoticed for longer, and by the time staff found the problem, food had already warmed past the point where it could be saved. The case shows that a cyberattack does not have to steal data to cause real harm. It can reach into physical equipment and change how it behaves.
Who France Says Was Behind It
France has blamed Iran’s Islamic Revolutionary Guard Corps, known as the IRGC, for the attack. French Foreign Minister Jean-Noel Barrot said the responsibility for the attack lies with Iran’s Islamic Revolutionary Guard Corps. He called it an attack of unprecedented scale and unprecedented aggressiveness, and the first large-scale cyberattack carried out for sabotage purposes on French national territory. That language points to intent, scale and effect, not just to a technical intrusion.
French intelligence and cybersecurity agencies identified the attackers as Shahid Kaveh, described as a cyber offensive unit tied to the IRGC’s Cyber-Electronic Command. Investigators cited the use of Farsi and IP addresses pointing to devices located in Iran. That can help point to a source, but it is not the same as a court finding, and the attribution remains France’s accusation until any legal process reaches its own findings.
Investigators also said the group worked through front groups masquerading as vigilante hackers: CyberAveng3rs and Cyber Isnaad Front. French officials said three alleged associates were named: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand. The Paris prosecutor’s office opened an investigation and is seeking international arrest warrants for the head of Shahid Kaveh, his two deputies and others.
Iran’s mission to the United Nations did not return messages seeking comment. Iran routinely denies carrying out malicious cyber operations, and there was no immediate comment from Tehran. The hacks were among the most disruptive cyberattacks since the Iran war began in February 2026. That context helps explain why France has reacted so firmly, but it does not prove who was behind this one attack. For background on how Iran has featured in recent talks, see Trump calls Iran strikes unnecessary as Qatar talks continue.
What France Plans to Do Next
France moved quickly after the public accusation. The country summoned Iran’s ambassador on Tuesday morning, November 10. A summons is a formal diplomatic step that signals serious concern, and it came one day after the public accusation, which shows how fast Paris wanted to act.
Barrot said France would push for EU sanctions against those responsible, including entry bans and asset freezes. An entry ban would stop a named person from entering EU countries, and an asset freeze would block access to money or property held in the EU. Those measures are targeted at people, not at a whole country. France will need support from other EU members to move forward, and that process can take time.
Barrot also warned that Paris could respond with cyber measures of its own, with some action not disclosed. The warning should not be read as a promise of a specific attack. It is a signal that France sees cyber tools as part of its response. At home, the Paris prosecutor’s office opened an investigation and is seeking international arrest warrants for the head of Shahid Kaveh, his two deputies and others. An international arrest warrant can limit travel and create legal risk for the people named, even if an arrest does not happen soon.
Why This Supermarket Fridge Cyberattack Stands Out
This supermarket fridge cyberattack stands out because it hit everyday life in a direct way. Most cyberattacks affect data or systems that people cannot see. This one affected food in fridges that shoppers use every day. When a fridge warms by as much as 50 degrees Celsius, the food inside is no longer safe in the way shoppers expect, and stores must check stock, dispose of spoiled food and make sure their systems are safe before they return to normal.
The scale also sets it apart. Around 700 supermarkets is a large number for one overnight incident, and the spread across France showed that the attack was not aimed at one town or one chain. French officials said it was the first large-scale cyberattack carried out for sabotage purposes on French national territory. Sabotage suggests a goal of damage, not theft or spying, and that goal shapes how a government responds.
Further refrigeration attacks were reported in November across Belgium, Luxembourg, the Netherlands, Finland, Ireland and Sweden. French officials cautioned against linking every refrigeration incident to this group, since a similar problem in another country may have a different cause. France previously attributed attacks on Charlie Hebdo in 2023 and cyberattacks around the 2024 Paris Olympics to Iran-based actors. Those earlier cases give context, but they do not prove the current case. For an example of another government moving to set clearer rules for new technology, see Australia plans mandatory AI safety standards under a new regulator. The fallout from a major hack can also reach company leaders, as seen in Binance CFO leaves after a 6.3 billion dollar hack.
FAQs
What did France accuse Iran of doing?
France accused Iran’s Islamic Revolutionary Guard Corps of carrying out cyberattacks that knocked out refrigeration and freezer systems at around 700 supermarkets across France in early October. French Foreign Minister Jean-Noel Barrot said the responsibility lies with Iran’s Islamic Revolutionary Guard Corps. The claim is France’s accusation, and it has not been confirmed by a court.
How did the hackers damage the supermarket fridges?
French officials said hackers remotely accessed refrigeration controllers through web interfaces. The controllers named came from Danfoss, Dixell and Copeland. The attackers raised temperatures by switching on defrost cycles, in some cases heating fridges by as much as 50 degrees Celsius. Fresh and frozen food spoiled, and the Paris prosecutor’s office reported around 15 to 20 fires linked to the incident.
Who is Shahid Kaveh, according to France?
France identified the attackers as Shahid Kaveh, described as a cyber offensive unit tied to the IRGC’s Cyber-Electronic Command. Investigators cited the use of Farsi and IP addresses pointing to devices located in Iran. French officials said the group worked through front groups masquerading as vigilante hackers, including CyberAveng3rs and Cyber Isnaad Front. Three alleged associates were named: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand.
What is France doing in response?
France summoned Iran’s ambassador on Tuesday morning, November 10. French Foreign Minister Jean-Noel Barrot said France would push for EU sanctions against those responsible, including entry bans and asset freezes. He also warned that Paris could respond with cyber measures of its own, with some action not disclosed. Iran’s mission to the United Nations did not return messages seeking comment, and there was no immediate comment from Tehran.
SOURCES
Final Thoughts
France has made a serious public accusation, backed by a diplomatic summons, a push for EU sanctions and a criminal investigation. The damage is clear: around 700 supermarkets affected, food spoiled, and around 15 to 20 fires reported. The question of who was behind the attack is now in the hands of investigators, diplomats and EU partners. Readers should keep the difference between an accusation and a proven finding in mind, and watch for what France and its partners do next.
