France attributes supermarket refrigeration sabotage to Iran—and wants Europe to follow

France has formally accused Iran of carrying out what it calls the first large-scale cyber campaign of pure sabotage on its territory: a remote attack, overnight on 11–12 October, that seized refrigeration controllers at more than 700 supermarket and retail sites, spoiled food, started fires and caused losses the foreign ministry estimates at several tens of millions of euros. The finding, issued on 9 November, is an official French attribution, not an independent adjudication. Iran’s foreign ministry had not issued a public reply by 10 November; some Iranian media dismissed the charge as baseless.

That distinction matters, because Paris is already trying to turn the accusation into European policy. Foreign Minister Jean-Noël Barrot said France summoned Iran’s ambassador on the Monday of the announcement “to lodge a very strong protest.” The government will propose new European Union sanctions on Iranian entities and individuals. On 10 November Barrot said those measures would include bans on entering EU territory, asset freezes and the immobilisation of financial assets, and said France was ruling nothing out.

What France says happened

The technical picture, as set out by the government’s Cyber Crisis Coordination Centre (C4), which includes the national cybersecurity agency ANSSI, is unusually concrete for an attribution statement. Attackers changed defrost settings on industrial refrigeration controllers, driving temperatures high enough to destroy stock. The C4 report records at least 15 fire outbreaks and lists large groups among those affected, including Casino, E. Leclerc, Coopérative U, Metro, Carrefour and Intermarché, as well as smaller food businesses. Press reporting has identified widely used remote-management software, including systems supplied by Denmark’s Danfoss, as a point of entry. The Belgian cybersecurity centre later warned that exposed Danfoss, Dixell and Copeland interfaces, default credentials and unpatched firmware were being exploited in a similar way.

Barrot, and the Quai d’Orsay declaration published the same day, described the October campaign as unprecedented in scale and aggression and as “the first large-scale cyber-attack aimed at sabotage on our national territory.” France also placed the episode in a longer file: earlier Iranian activity, it said, had targeted Charlie Hebdo in 2023 and a French video-display firm during the 2024 Paris Olympics. The EU already sanctioned the Iranian company Emmenet Pasargad in March 2026 in that earlier context. The new step is to treat a strike on food retail—civilian infrastructure that most shoppers never think of as critical—as an attack on “the nation’s interests and the security of the French people.”

The evidence Paris is willing to show

The C4 technical note, CERTFR-2026-CTI-009, does not claim a signed confession. It offers a “bundle of indicators”: infrastructure also used for reconnaissance against Schneider Electric industrial systems with techniques the centre associates with Shahid Kaveh; use of the FOFA scanning tool; a 13 October item on CyberbanNews, which France links to the unit; and traces of Farsi in the attack infrastructure. The unit, France says, sits inside the Islamic Revolutionary Guard Corps’ electronic and cyber centre and has previously been associated, including through hacktivist aliases, with industrial-control sabotage aimed mainly at Israel and the United States.

Paris prosecutor Laure Beccuau opened a judicial investigation against the head of Shahid Kaveh, his two deputies and others yet to be identified, on charges of organised attacks on an automated data system and organised dangerous damage, aggravated as committed to serve a foreign power—Iran—plus criminal association. Her office sought international arrest warrants. She cited a “characteristic” modus operandi, including the use of Farsi and internet addresses pointing to devices in Iran. Those points support a prosecution theory. They do not, by themselves, close the usual caveats of cyber attribution: identifiers can be spoofed, and infrastructure can be shared or rented. The honest way to report the file is to say that France has made a formal state attribution, has published some of its reasoning, and is now asking European partners to act on it.

A second wave that has not been attributed

The comparison is easily overstated. Around 2 November, a further wave of refrigeration attacks hit stores in Belgium, Luxembourg and other European countries. Belgium’s Centre for Cybersecurity named Belgium, Luxembourg, the Netherlands, Sweden, Ireland and Estonia; British reporting also included Finland. Dozens of Delhaize shops in Belgium and Luxembourg were among those affected, with smaller numbers at other chains. The method—forcing units into high-temperature defrost cycles, in some cases reportedly up to 50C—resembled the October attacks in France.

France’s 9 November attribution, however, concerns the October campaign on French territory. It does not formally assign the later European incidents, or a separate 2 November event at three cold-storage sites of the Établissement français du sang, to Shahid Kaveh. In the blood-service case, temperature and defrost thresholds were raised; alarms allowed staff to secure or move products, and the EFS said no blood products were lost and no health impact was identified. Belgium’s foreign ministry, as reported by VRT, has said it does not yet have indications allowing it to attribute the Belgian incidents to Iran, or to confirm a link with the French attacks. EU foreign policy chief Kaja Kallas struck the same cautious note: other European cyber incidents, “if they are attributed,” would also require a strong response. The next Foreign Affairs Council is the first obvious place for that argument.

The power in this dispute sits, for now, with the governments that can offer or withhold sanctions, not with the retailers who paid for spoiled stock, or with the vendors whose internet-exposed controllers made the attacks cheap to attempt. The burden has already fallen on shops, insurers and customers in France; a wider European bill is still being counted. What happens next depends less on another technical report than on whether France can persuade partners to treat its attribution as sufficient—and on whether Tehran, still officially silent, decides that silence is no longer a strategy.