France blames Iran for supermarket fridge cyberattack

France formally blamed Iran on Monday for the October cyberattack that heated supermarket refrigerators across the country, summoning Tehran's ambassador and promising European sanctions against those responsible. The attack, launched in the early hours of October 12, remotely took control of refrigeration systems in roughly 700 of France's 10,000 supermarkets and independent stores, sending temperatures to 50 degrees Celsius for about six hours. Stores discarded fresh and frozen goods; the Intermarché chain reported losses of tens of millions of euros in a single day.

The national cybersecurity agency ANSSI attributed the sabotage to the Shahid Kaveh group, described as a cyber unit affiliated with Iran's Revolutionary Guard, and investigators found the attackers had used Farsi and IP addresses linked to devices located in Iran. Paris prosecutor Laure Beccuau opened a formal judicial investigation into suspected organized cybercrime with the aggravating circumstance of "having been committed to serve the interests of a foreign power — in this case, Iran." The case targets the Shahid Kaveh leader, his two deputies and anyone else identified, and the prosecutor's office is seeking international arrest warrants.

Foreign Minister Jean-Noël Barrot, speaking on the sidelines of G7 talks in Paris, called the attack "of unprecedented scale and aggressiveness" and "the first large-scale cyberattack aimed at sabotage on French soil," adding that it "will not go unanswered." The measures announced so far are a diplomatic summons and sanctions to be sought at the European level.

The attribution extends a series. ANSSI has previously linked attacks on France since 2020 to another Revolutionary Guard-affiliated group, Shahid Shoostari, including the 2023 hack of the satirical newspaper Charlie Hebdo and a 2024 attack on the organization of the Paris Olympics. Last week a separate attack tried to raise temperatures in French blood bank refrigeration before being thwarted, and supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia reported freezer and fridge failures in the same period, some forced to dispose of ruined food.

The refrigerators held 50 degrees for six hours on October 12; the answer, four weeks later, was delivered by ambassadorial summons.