Written By | International News Agencies
On Monday, November 9, the Paris prosecutor's office opened a judicial investigation targeting the leadership of an IRGC-linked hacking unit known as Shahid Kaveh.
Search
Middle East
Overview
France has formally accused Iran's Islamic Revolutionary Guard Corps (IRGC) of carrying out what its foreign minister calls the first large-scale cyber sabotage operation ever conducted on French soil: a coordinated attack on October 11 and 12 that seized remote control of refrigeration systems at roughly 700 supermarkets and food sites across the country, spoiling food worth millions of euros and setting off around twenty fires. On Monday, November 9, the Paris prosecutor's office opened a judicial investigation targeting the leadership of an IRGC-linked hacking unit known as Shahid Kaveh. On Tuesday, the French government summoned Iran's ambassador, and Foreign Minister Jean-Noël Barrot vowed to seek European Union sanctions against everyone responsible, warning that France "rules nothing out" in its response.
Tehran has categorically denied involvement, calling the accusations "baseless." But the attribution, coming as the United States and Iran remain locked in an unresolved war centered on the Strait of Hormuz, marks a significant escalation in Europe's confrontation with the Islamic Republic and raises urgent questions about the vulnerability of everyday infrastructure to state-backed hackers.
Background: What Happened in October
According to the Paris prosecutor's office, as reported by CBS News, the attackers gained remote control of commercial refrigeration equipment through internet-facing web interfaces. Once inside, they triggered abnormal, indefinite defrost cycles and disabled the alarms designed to warn staff when temperatures rose above safe limits. The result was that refrigerators and freezers quietly warmed while their monitoring systems reported nothing amiss. Perishable food had to be discarded on a large scale, and in some cases equipment overheated, melted or caught fire.
The damage was spread across France's biggest grocery groups. Al Jazeera reported that E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U were all hit. Latin Times, citing the companies' own figures, reported that Groupement Mousquetaires counted about 300 affected Intermarché and Netto stores, Carrefour and Coopérative U each confirmed around 80 locations, and Monoprix said about five percent of its 490 stores were affected. Investigators also identified independent butcher shops, a slaughterhouse and food-processing cooperatives among the victims.
The attack reached beyond groceries. Several sites of the French Blood Establishment (EFS), the national blood service, were targeted, though the EFS confirmed that no blood products or samples were lost. One outlet, Cybernews, reported that attackers attempted to push blood storage temperatures as high as 110 degrees Celsius; that figure does not appear in other reporting reviewed for this article and should be treated with caution.
The Attribution: Shahid Kaveh and the IRGC
Paris prosecutor Laure Beccuau opened a judicial investigation through the office's cybercrime division into the alleged head of Shahid Kaveh, his two deputies and anyone else whose involvement is established. CBS News described Shahid Kaveh as an offensive cyber unit tied to the IRGC's Electronic and Cyber Center. The potential charges include fraudulent interference with an automated data-processing system and causing damage by means dangerous to persons, both as part of an organized group, with aggravating factors of acting on behalf of a foreign power and conspiracy to prepare a serious crime.
Cybernews reported that three Iranian nationals are suspected of directing the operation: Reza Salarvand and Mahdi Lashgarian, named as leaders of Shahid Kaveh, and Hamid Reza Lashgarian, identified as head of the wider Electronic and Cyber Center. According to Latin Times, the U.S. Treasury has previously sanctioned both Lashgarians as IRGC cyber officials. Reports differ on the number of international arrest warrants requested: Al Jazeera said prosecutors sought warrants for two officials, while Cybernews and Latin Times described requests covering three suspects.
French investigators pointed to several technical indicators: traces of the Persian language, IP addresses linked to Iran, and attack infrastructure and tactics previously associated with the unit. Cybernews reported that the attack was promoted by an online propaganda outlet linked to Shahid Kaveh, and that the unit has operated under other personas, including CyberAveng3rs and Soldiers of Solomon. Reuters, as cited by Cybernews, reported that Microsoft had privately linked Iran to the October attacks at least two weeks before France went public.
The picture is not entirely uncontested. Pro-Russian hacktivist groups NoName057(16) and Z-Pentest claimed responsibility the week before France's announcement, though security researchers doubted those claims and the Kremlin called the allegations of Russian involvement "absurd." Cybernews also reported that U.S. intelligence holds only a "low confidence" assessment that Iran was responsible for the French attacks, even as U.S. officials told the Wall Street Journal that the investigations bear hallmarks of Iranian tactics. France's attribution is its own, based on its investigation, and has not been independently verified.
A Wider European Pattern
The French attack does not appear to be isolated. In a second wave on November 2, refrigeration systems at food retailers in several other European countries experienced sudden temperature spikes. Al Jazeera listed Belgium, Estonia, Ireland, Luxembourg and Sweden; Cybernews reported grocery stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands, Denmark, Sweden and Finland discarding spoiled food after similar disruptions. French authorities have not attributed this second wave to Shahid Kaveh, and Vincent Strubel, head of France's national cybersecurity agency ANSSI, cautioned that "even if the modus operandi is similar, nothing at this stage confirms that it is the same attacker." In Sweden, the supermarket chains ICA and Coop told AFP they had no information that a cyberattack was involved. Belgian prosecutors have opened an investigation into the Russia-linked claims.
Across the Atlantic, the U.S. Army's Criminal Investigation Division is examining refrigeration outages at six U.S. military commissary facilities in August, and its Cyber Field Office is working with French police. Reuters reported that Iran is among the suspects being considered, but no formal attribution has been made. The FBI and the Cybersecurity and Infrastructure Security Agency said they were observing malicious cyber activity targeting industrial refrigeration and cold-chain monitoring systems worldwide, and urged operators to remove controllers from the public internet and place them behind firewalls.
France's Response
Barrot has framed the attack in the strongest terms. Speaking to Franceinfo on Tuesday, he described the perpetrator as "a terrorist organization that has committed an attack of unprecedented scale and aggression against our country," according to CBS News, and called it "the first large-scale cyberattack aimed at sabotage on our national territory," according to Al Jazeera. "We will take sanctions at the European level against all those responsible for this attack," he said, as quoted by Cybernews. He added that France would take further measures, some possibly undisclosed, to deter future attacks, and warned that anyone tempted to repeat such operations, "in Iran or elsewhere," would face a firm response.
Iran's ambassador was summoned to the Foreign Ministry to receive what Paris called a very strong protest. How quickly France can turn its outrage into EU action is less certain. Sanctions under the EU's common foreign and security policy require unanimity among the 27 member states, and the bloc's cyber sanctions framework has historically been used sparingly. The IRGC is already subject to EU sanctions for human rights abuses, and earlier this year France reversed its longstanding reluctance and backed adding the IRGC to the EU's terrorist list in response to Iran's violent crackdown on nationwide protests. New measures would therefore likely target specific individuals and entities tied to the cyber unit.
Washington offered rhetorical support. Secretary of State Marco Rubio, who was in Paris, told reporters that the accusations did not surprise him, citing Iran's record of such operations and existing U.S. sanctions on the IRGC, according to Latin Times.
Iran's Denial
Tehran rejected the allegations outright. In a written statement on Tuesday, reported by Anadolu Agency, Iran's Foreign Ministry called the accusations "baseless," criticized what it described as France's "accusatory approach toward Tehran," and said it would take whatever steps it considered necessary against "unlawful" foreign actions. Al Jazeera reported that the ministry also rejected "one-sided accusations" and condemned what it called a "hackneyed policy" of blaming the Islamic Republic.
The accusation lands on an already badly damaged relationship. Al Jazeera noted that in August, Iran arrested and expelled two French diplomats and France responded by expelling Iranian diplomats, and that in September France summoned Iran's ambassador after Tehran closed a French-language center linked to its embassy. Two French nationals, Cécile Kohler and Jacques Paris, who were detained in Iran in 2022 and later sentenced on espionage charges, have been out of prison but awaiting permission to leave the country, a factor that has long complicated Paris's calculations.
Implications
The attack, if France's attribution holds, represents a notable shift in Iranian tactics against Europe. Iran has threatened for months to widen its retaliation against the United States and its allies over the war and the U.S. naval blockade, by means it has not specified. Striking civilian food supply chains is a low-cost, deniable way to impose economic pain and sow public anxiety far from the Gulf. It also arrives amid a broader pattern of alleged Iranian activity in the West: U.S. prosecutors this week charged three Iranian nationals with terrorism-related offenses over attacks and attempted attacks in Europe and America, and Treasury Secretary Scott Bessent reportedly relocated to a military base over threats attributed to Iran, according to a news digest compiled on November 11. Iranian officials, meanwhile, have denied that negotiations with Washington are under way, even as Qatar continues to mediate.
The episode is also a warning about the security of the 'internet of things.' The attackers did not need to breach a retailer's corporate network; they exploited refrigeration controllers that were reachable from the public internet. Security agencies have warned about exposed industrial controllers for years, and the French case shows how such weaknesses can be turned into physical damage at national scale.
What's Next
In the coming weeks, attention will turn to Brussels, where France must persuade all 26 of its EU partners to sign off on new sanctions, and to whether other governments hit by the November 2 wave reach their own attributions. The French judicial investigation will proceed regardless, though international arrest warrants against IRGC officers are unlikely to result in arrests as long as the suspects remain in Iran. Analysts will also watch whether France takes the undisclosed countermeasures Barrot hinted at. And for retailers and other operators of connected equipment across Europe, the immediate task is more mundane but urgent: taking vulnerable controllers offline before the next wave arrives.
