France has formally accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of orchestrating an October cyberattack that compromised refrigeration systems at approximately 700 supermarkets and retail sites, causing extensive food spoilage and fires. French Foreign Minister Jean-Noël Barrot announced the attribution Monday, November 9, saying France would pursue European sanctions and had summoned Iran’s ambassador.

The attacks, carried out overnight on October 11–12, remotely manipulated internet-connected refrigeration controllers, forcing temperatures upward and damaging large quantities of perishable goods. Some equipment reportedly reached temperatures exceeding 50°C (122°F), despite normally operating well below freezing.

French investigators identified an IRGC cyber unit called Shahid Kaveh as the suspected operator. According to a technical attribution report published by France’s Cyber Crisis Coordination Centre, the attackers altered equipment defrost settings across hundreds of retail locations. The incident caused substantial inventory losses and at least 15 outbreaks of fire.

The five-page report identifies several indicators supporting the attribution, including infrastructure previously associated with Shahid Kaveh, the use of the FOFA internet-scanning tool, traces of Farsi within the attack infrastructure, and publicity about the operation through a communication channel linked to the group.

The investigation has moved into criminal proceedings. Paris prosecutor Laure Beccuau announced a judicial investigation targeting Shahid Kaveh’s leadership and other potential participants. Prosecutors have requested international arrest warrants for the unit’s leader and two deputies, according to Iran International. The suspected offenses include organized cybercrime and causing damage that endangered people, allegedly in the service of a foreign power.

French authorities also linked concurrent targeting of Schneider Electric equipment at small hydroelectric installations to the same attack campaign. Their report describes Shahid Kaveh as an established operator targeting industrial control systems, including earlier operations against Israeli and American infrastructure.

The attribution follows a broader wave of attacks on connected refrigeration equipment. Similar incidents were reported across several European countries in early November, affecting supermarkets and other food businesses. Investigators have not established whether those attacks were conducted by the same perpetrators.

On November 5, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), FBI, and three other federal agencies issued a joint security advisory warning that attackers were exploiting vulnerabilities and weak configurations in internet-accessible refrigeration controllers. The agencies urged operators to eliminate unnecessary internet exposure, isolate industrial equipment from business networks, strengthen authentication, and apply security updates.

France’s announcement establishes a formal state attribution for an attack that caused physical damage through remotely accessible industrial equipment. Barrot described the operation as unprecedented in scale and aggression on French territory and pledged further measures against those responsible. Iran had not publicly responded to the allegations at the time of the announcement.