France Blames Iran's IRGC for Cyberattacks That Disrupted Refrigeration at About 700 French Sites

On Monday, French Foreign Minister Jean-Noel Barrot announced that the Iranian ambassador had been summoned to the foreign ministry. The reason was a run of cyberattacks that, since October 11, had knocked out commercial refrigerators and freezers at hundreds of businesses across France. Barrot also warned that Iran could face further European Union sanctions.

The announcement came only minutes after Reuters reported that French investigators privately suspected Iran. A joint report from French intelligence and cybersecurity agencies puts the number of affected sites at around 700. They included supermarkets, butcher shops, a slaughterhouse and food-processing factories.

The physical damage was real. Hackers allegedly manipulated refrigerator temperatures and caused some units to overheat, and at least 15 fires broke out. Supermarket employees threw away large quantities of spoiled meat and melted ice cream. One French supermarket owner estimated that the nationwide damage could run into tens of millions of euros.

A second wave of intrusions followed this month, affecting more than 100 establishments across Europe. This round also disrupted refrigerators used by French blood banks, and staff had to move some blood supplies to alternative cold-storage facilities.

The French report points to Shahid Kaveh, which it describes as a cyber offensive unit linked to Iran's Revolutionary Guards. It names three alleged associates: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand. According to the report, the hackers worked through front groups posing as vigilante hacking organisations, among them CyberAveng3rs and Cyber Isnaad Front. French authorities say they reached their conclusion by examining the digital infrastructure used to sabotage the refrigeration systems, matching the intrusion patterns to other operations attributed to the unit, and finding traces of the Farsi language in that infrastructure. Paris prosecutors separately said they had requested international arrest warrants for those allegedly responsible. Iran's mission to the United Nations did not respond to requests for comment, and Tehran has routinely denied carrying out malicious cyber operations.

France is not the only country looking at such incidents. In August, refrigerators at at least six US military commissaries stopped working. The Pentagon is treating those incidents as suspected cyberattacks and is coordinating with French officials. A person familiar with the investigation told Reuters that the US military considers Iran a suspect, though the probe continues. On Monday the Pentagon said it was aware of speculation about a possible cyber incident but declined to give details, citing security concerns. Three people familiar with the matter also told Reuters that Microsoft had privately linked Iran to the October attacks at least two weeks before France went public. The company declined to comment.

Experts say the episode exposes how weakly some commercial infrastructure is defended. Cybersecurity specialists previously told Reuters that the attacks looked relatively easy to carry out. The manufacturer of several affected units said some were obsolete or running outdated firmware, which may have made them easier to compromise. Saher Naumaan, a senior threat researcher at Proofpoint, said the incidents say less about Iran's cyber capabilities than about how vulnerable the targeted systems were.

US officials have also warned of the possibility of further cyber disruptions amid the Iran war, which began in February. What to watch next: whether the EU moves on new sanctions, whether the arrest warrants lead anywhere, and what the Pentagon concludes about the commissary outages.