home

France Blames Iran's Revolutionary Guards for the Hacking of Supermarket Fridges and Freezers

RAGE Global · France · Cyber · Developing · 8 min read

By Carlos KfouryPublished

Slide 01 of 06

  1. Breaking, 9 November 2026. A map of Europe and the Middle East with France in black and Iran in red, joined by a dashed red line labelled "Remote sabotage" between Paris and Tehran. Official, French government. Headline: "France blames Iran for hacked fridges." Paris says a cyber unit linked to the Revolutionary Guards sabotaged supermarket fridges and freezers across France in October. Sources: Jean-Noël Barrot, Paris prosecutors, Reuters. Map: Natural Earth.

Published on Instagram with this story · swipe or use the arrow keys

France formally accused Iran's Islamic Revolutionary Guard Corps (IRGC) on Monday 9 November 2026 of carrying out the October cyberattack that sabotaged commercial refrigeration at about 700 sites across the country. Foreign Minister Jean-Noël Barrot said the attack was carried out by the IRGC, announced that Iran's ambassador had been summoned, and said France would seek sanctions at European level. Paris prosecutors say they found Farsi and internet addresses pointing to devices in Iran. Iran has not publicly responded. The attribution is the French government's position; the forensic evidence has not been published.

Key takeaways

  • Official: Barrot: "I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran." He called it "an attack of unprecedented scale and unprecedented aggressiveness" and the first large-scale cyberattack for sabotage purposes on French territory.
  • The attack: on 11–12 October, hackers remotely switched on defrost cycles and pushed temperatures up in fridges and freezers at about 700 sites. Food spoiled and fires broke out.
  • The accusation: Paris prosecutors name Shahid Kaveh, an offensive cyber unit linked to the IRGC, and have asked for international arrest warrants for its leader and two deputies. No warrants are reported as issued.
  • The response: Iran's ambassador was summoned, France will push for EU sanctions, and a criminal investigation is under way in Paris.
  • Not established: a link to the August freezer failures at U.S. military commissaries, and to the wave of fridge hacks in other European countries.

Confidence: OFFICIAL for what French ministers and prosecutors have said; REPORTED for the technical findings, which RAGE X has not seen. Attribution to the IRGC is an allegation by the French state, not an independently verified finding.

What happened#

On the night of 11–12 October 2026, hackers gained remote access to the management systems of commercial refrigeration equipment in France and changed how the units ran. According to the prosecutors' account reported by the press, they:

  1. Connected remotely to the controls of fridges and freezers over the internet.
  2. Overrode them, switching on continuous defrost cycles and disabling safety alerts.
  3. Pushed temperatures up while the shops were closed.
  4. Left the stock to spoil. Fresh and frozen food was thrown away, and some units overheated and caught fire.

The French government's reporting puts the damage at about 700 sites, most of them supermarkets, with smaller butcher shops, a slaughterhouse and food factories also hit. Authorities and outlets give between 15 and about 20 fires, depending on the source. France's Foreign Ministry estimates the food losses at tens of millions of euros.

Who was hit#

Chain What it said
E.Leclerc Named among the chains hit
Intermarché Named among the chains hit
Carrefour About 80 supermarkets affected
Monoprix About 5 percent of its roughly 490 stores
Coopérative U More than 100 supermarkets targeted

The counts differ. Most outlets, citing the authorities, say about 700 sites. Al Jazeera reports more than 1,000 stores, and CNN about 700. RAGE X uses "about 700 sites" for the official figure and notes that the higher number could not be reconciled with it.

A second wave reached further. TechCrunch reports it also hit refrigerators used by French blood banks, forcing staff to move some blood to other cold storage; the French Blood Establishment said the attacks were stopped before any blood spoiled. Separately, dozens of supermarkets in other European countries were hit by a similar attack last week. Officials have not formally tied those incidents to the Iranian group.

Why Paris points at Tehran#

Item What was said
Evidence cited Farsi in the attack infrastructure and internet addresses linked to devices in Iran; a match with the pattern of earlier attacks by the same group
Accused Shahid Kaveh, an offensive cyber unit linked to the IRGC
Legal step Paris prosecutors have asked for international arrest warrants for the unit's leader and two deputies
Iran No public response. Tehran routinely denies cyber operations

French authorities have not released the forensic material behind the attribution. A joint French intelligence and cybersecurity report names alleged associates of the unit; RAGE X does not name them, because they have not been charged or tried and the claims are untested.

How the attackers got in. The breach began on 11 October with unauthorised remote access to refrigeration management software supplied by the Danish firm Danfoss. Danfoss said a limited number of systems in France were affected, and that those ran outdated firmware. The head of France's national cybersecurity agency, ANSSI, has said the attackers exploited "elementary" weaknesses, such as devices left open to the internet and weak passwords. So the attribution is about who, not how hard it was: the attack looks to have needed little sophistication.

France's response#

  • Diplomatic: Iran's ambassador was summoned to lodge "a very strong protest against this extremely grave act."
  • Sanctions: Barrot said: "We will implement sanctions at the European level against all those responsible for this attack." EU sanctions need the agreement of member states, so none are in force yet.
  • Judicial: a criminal investigation led by Paris prosecutors is under way.
  • Government: Prime Minister Sébastien Lecornu instructed ANSSI to investigate.

Not the first#

Fridge failures have been reported outside France too. In late August, freezers at at least six U.S. military commissaries failed, in at least one case switching into defrost mode and heating the contents. The Pentagon is treating the incidents as a suspected cyberattack and has not publicly confirmed that hackers were responsible. A Korea Times report, citing one unnamed person, says the Pentagon considers Iran a suspect; that is a single anonymous source. Reuters says it could not establish whether the American incidents, the French campaign and the latest European wave are connected.

What is known#

Item Status
Refrigeration at about 700 French sites was sabotaged on 11–12 October Official (French authorities)
The IRGC carried out the attack Official claim by France; evidence not published
Prosecutors cite Farsi and IP addresses pointing to Iran Reported
Arrest warrants requested for the unit's leader and two deputies Reported, not reported as issued
Iran's ambassador summoned; EU sanctions to be sought Official
Iran's response None public
Link to the August U.S. commissary failures Not established
Link to the wave in other European countries Not formally attributed

Our read · RAGE Intel assessment

What is established is the damage and France's accusation. What is alleged is the chain between them: that an IRGC cyber unit chose, and ordered, the sabotage. That rests on French statements and on indicators such as language and addresses, which are real evidence but can be planted, and which France has not shown in full.

The case matters more for what it shows than for who did it. The attack needed no advanced tools, only internet-connected building controls with weak passwords and old firmware, and the cost fell on shoppers, shop owners and, briefly, a blood supply, not on soldiers. Equipment of this kind sits in supermarkets, hospitals, ports and warehouses in every country, which makes cheap sabotage of ordinary infrastructure a realistic tool for a state at war, or in a standoff, to use against a country that has no obvious military target.

This is an assessment, not a finding. It will change if France publishes its forensic evidence, if the arrest warrants are issued, if Iran responds, or if the August and European incidents are shown to belong to the same campaign.

What to watch#

  • Evidence: whether Paris or ANSSI publishes the technical findings behind the attribution.
  • Sanctions: whether EU member states agree to measures against the people named, and how fast.
  • Iran: any public response from Tehran, and any move against French interests.
  • The wider picture: whether officials formally link the European wave and the U.S. commissary failures to the same group.
  • Security fixes: whether retailers and vendors patch exposed refrigeration systems.

This story is developing. RAGE X will update it as new information is confirmed.

Sources#

Continue the assessment

Today's conflict risk

The daily RAGE INDEX scores global conflict risk across six theaters, with sources and forecasts.

Read the RAGE INDEX

Reach readers like these

RAGE X sells sponsored content across RAGE Intel, RAGE War and RAGE Global by proposal, always labelled as sponsored.

Request a campaign proposal