France Blames IRGC-Linked Unit for October Cyberattacks on 700 Supermarket Refrigeration Sites

On the weekend of October 11 and 12, refrigeration systems at about 700 supermarket sites across France began warming up. Someone had reached into the equipment remotely, and in some stores the result was that entire stocks of perishable food had to be thrown away. Four weeks later, French officials have said who they believe was behind it.

Speaking on the sidelines of the G7 foreign ministers' meeting in Paris, Foreign Minister Jean-Noel Barrot told reporters, as quoted by AFP, that the attack was carried out by Iran's Islamic Revolutionary Guard Corps. He called it unprecedented in both scale and aggression, and described it as the first large-scale cyberattack aimed at sabotage on French national territory. In his words, it was a major attack on the nation's interests and on the security of the French people.

Barrot said France would answer at the European level, promising sanctions against all those responsible. He added that Paris would take any other necessary and proportionate measures, public or otherwise, to respond and to deter anyone tempted to repeat the act. France has also summoned Iran's ambassador in Paris, where Barrot said a very strong protest was lodged over what he called an extremely grave act.

The judicial side is moving too. The Paris prosecutor's office has opened an investigation into Shahid Kaveh, a cyber unit linked to the IRGC. Prosecutor Laure Beccuau said the inquiry will look at the unit's head and two of his deputies, though she did not name any of the three. She described Shahid Kaveh as an offensive cyber unit affiliated with the IRGC's Electronic and Cyber Centre. Little else is publicly known about it, though analysts have noted that the IRGC has pushed further into cyber warfare in recent years.

Beccuau laid out how investigators believe the intrusions worked and why they point to this unit. A hallmark of its methods, she said, is the use of Persian and of IP addresses tracing back to terminals in Iran. The attackers allegedly got into supermarket equipment through web interfaces and changed refrigeration settings, triggering abnormal, indefinite defrost cycles. At the same time, the alarms meant to go off when temperatures crossed set limits were disabled, so the warming would not have been flagged by the systems built to catch it.

France is not the only place where such trouble has surfaced. On November 2, grocery stores in at least nine other European countries were hit by a suspected cyberattack on freezer systems. Barrot's announcement concerned only the French incidents, and the source does not say who was behind the November 2 disruption. Separately, dozens of flights across European aviation have been targeted by false bomb alerts in recent days, and the origin of those threats remains unclear. European officials have also long warned of cyberattacks from Russia, given the continent's support for Ukraine.

The accusation lands against a tense backdrop. The United States and Israel fought a war against Iran that began with the killing of Supreme Leader Ali Khamenei on February 28. European countries did not take part, but French officials have accused Iran of spreading misinformation tied to protests that have affected France over the past month.

EU foreign policy chief Kaja Kallas, speaking after Barrot, said the response should be strong, adding that she had only just learned the attacks had been attributed to Iran. What that response looks like, and whether the European sanctions Paris wants materialize, is the next thing to watch, along with what the Paris investigation turns up about the three officials it is examining.