Summary
- France attributes the October refrigeration attacks to SHAHID KAVEH, a unit it says is affiliated with Iran's Islamic Revolutionary Guard Corps.
- More than 700 retail locations in France were targeted, according to French authorities, with fires, material damage and substantial food losses.
- Paris plans diplomatic action and will propose additional European sanctions; the proposed measures have not yet been adopted.
France has formally attributed a destructive cyberattack campaign against supermarket refrigeration systems to an Iranian Revolutionary Guard-affiliated unit, escalating a major operational infrastructure incident into a dispute over state responsibility and potential European sanctions.
In a declaration issued on 10 November, the French Ministry for Europe and Foreign Affairs identified SHAHID KAVEH, which it describes as affiliated with the electronic warfare and cyber defence organisation of Iran’s Islamic Revolutionary Guard Corps, as responsible for the campaign.
The attacks began overnight on 11–12 October and targeted refrigeration controllers at more than 700 retail locations across France. French authorities say the resulting disruption caused significant material damage, fires and spoiled food, with losses estimated at tens of millions of euros.
France describes the campaign as an operation deliberately intended to cause physical sabotage. The attribution follows several weeks of investigation and European coordination, during which the scale of the disruption and the countries affected became clearer.
The French declaration does not publicly establish every technical step used during the intrusions or provide a complete breakdown of losses at individual businesses. Those limitations remain important when distinguishing the government’s attribution from the publicly available forensic evidence.
Diplomatic response follows operational disruption
Paris intends to summon Iran’s ambassador to France to protest the attacks and says it will propose further European Union sanctions against Iranian entities and individuals involved in the operation and other malicious cyber activity.
The sanctions are proposals, not measures already adopted in response to this particular campaign. Any additional EU restrictions would require the relevant European decision-making process.
French authorities say the campaign violated international norms governing responsible state behaviour in cyberspace. They have also referred to previous alleged Iranian activity directed at French interests, including the Charlie Hebdo publication and the Paris 2024 Olympic and Paralympic Games.
The attribution is supported institutionally by France’s Cyber Crisis Coordination Centre, known as C4, which brings together cybersecurity, intelligence, defence and military organisations. The government says the participating services are publishing a joint assessment of offensive cyber activity associated with Iran’s Revolutionary Guard.
The latest position marks a development from the earlier European coordination of refrigeration cyberattacks, when the authorities had not established a common public attribution.
That response involved the European Commission, the EU Agency for Cybersecurity, Europol and national security authorities following additional incidents in early November. The French attribution now provides a specific state-linked allegation around which further diplomatic and regulatory action may develop.
Refrigeration controls expose physical business risk
The attacks illustrate how compromises of connected operational systems can produce consequences outside conventional information technology environments. Refrigeration controllers support temperature management for supermarkets, distribution operations and other facilities handling perishable goods.
Where such systems are manipulated or made unavailable, the impact can extend to product safety, stock losses, damaged equipment and interruption of normal operations. The French government’s account includes both food spoilage and physical damage, rather than describing the incident as a purely digital service disruption.
This creates particular difficulties for businesses whose connected equipment is managed partly through remote access or maintained by external service providers. Operational responsibility may be divided among retailers, equipment manufacturers, contractors and technology suppliers, even though the financial and safety consequences ultimately arise at the affected premises.
Although the French declaration identifies the alleged perpetrators, it does not settle questions concerning the precise access paths, equipment configurations or safeguards present across the affected estates. Nor does the number of targeted retail sites establish that every location suffered an identical level of damage.
The distinction also affects how organisations assess insurance and recovery. Physical property damage, spoiled stock, business interruption and specialist equipment restoration can fall under different contractual provisions, with coverage depending on the particular policy and circumstances.
Earlier scrutiny of insurance arrangements following the refrigeration attacks had already raised questions about whether standard cyber policies would respond to every category of financial loss.
For national authorities, meanwhile, the case brings operational technology incidents into the same diplomatic framework as more familiar espionage and disruptive attacks against government systems. France’s response includes both conventional diplomatic channels and the prospect of coordinated European restrictions.
The ministry says France reserves the right to take additional proportionate measures, including steps that may not be publicly disclosed. Further sanctions will depend on discussions with European partners, while investigators and affected operators continue assessing the campaign’s technical and commercial consequences.
