France attributes supermarket freezer and blood bank hacks to Iran's IRGC, vows EU-wide sanctions

France formally blames the IRGC

France has formally attributed October's mass cyberattacks against supermarket refrigeration equipment, along with subsequent incidents including an intrusion at a French blood bank, to Iran's Islamic Revolutionary Guard Corps (IRGC).

Speaking to reporters in Paris on Monday, Foreign Minister Jean-Noël Barrot said he could confirm the IRGC's responsibility, describing the campaign as an act of "unprecedented scale and aggression" and, according to TechCrunch, "the first large-scale act of sabotage on our national territory". Barrot added that the attacks would "not go without consequences". TechCrunch notes that Reuters first reported France's attribution, citing sources ahead of the minister's remarks.

The Guardian reports that Barrot made the announcement during the G7 summit in Paris, that Iran's ambassador has been summoned in protest, and that Europe-wide sanctions will be imposed on those responsible. The matter has now been handed to the French justice system.

Thousands of units sabotaged

According to The Guardian, the initial attacks on 11 and 12 October hit as many as 700 French supermarkets and shops. Hackers took control of digital thermostats on thousands of freezers, fridges and chiller cabinets and pushed temperatures from as low as -27C to above 50C in some cases. Thousands of tons of perishable food had to be discarded, and in some stores the heat triggered fires that set off sprinkler systems, adding water damage to the losses.

TechCrunch describes two waves of attacks running through October and into November that broke into web-based controllers managing fleets of industrial cold units across France and wider Europe. The Guardian reports that retailers in 11 European countries, including the UK, Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden, reported refrigeration problems in the days after the French incidents.

The French Blood Establishment (EFS) was also targeted, with attackers raising temperature and defrost thresholds on cold stores holding blood products to what the service called a very high level. Alarm systems alerted technicians, who disconnected the stores before any supplies were destroyed. The Guardian notes that it is not clear whether the blood bank intrusion is connected to the supermarket attacks.

Separately, a regional branch of Crédit Mutuel reported losing more than €100 million in a cyberattack on Friday and said part of the sum had been recovered, The Guardian reports, without stating a connection to the refrigeration campaign.

The evidence and the investigation

Paris public prosecutor Laure Beccuau said specialist investigators and government agencies had identified a modus operandi characteristic of Shahid Kaveh, a cyber warfare unit linked to the IRGC, according to The Guardian. The indicators included the use of Farsi and IP addresses traced back to devices located in Iran.

Her office has opened an investigation against the head of Shahid Kaveh, his deputies and others yet to be identified, on charges covering organised attacks on automated data-processing systems and causing damage dangerous to persons, aggravated by the attacks serving a foreign power.

Part of a wider pattern

TechCrunch places the French attacks within a series of destructive operations attributed to Iran this year, including hacks on US water providers and disruption at medical device maker Stryker. The US government has linked earlier attacks to pro-Iranian hacktivists, reportedly viewing them as a response to the US-Israel-led war with Iran that killed its supreme leader in February. US officials have reportedly also connected the freezer attacks to Iran, although no formal American attribution has been made, and the US is reportedly examining whether freezer units on military bases were affected.

Security researchers have warned that the web-based controllers used to manage these fleets of equipment are vulnerable to remote compromise, and TechCrunch reports that some affected models made by Danish manufacturer Danfoss no longer receive security fixes.

Gérôme Billois of the cybersecurity firm Wavestone told The Guardian that Shahid Kaveh has been active since 2020 and previously focused on US water distribution systems, and warned that a state-backed group with such means and patience could move on to targets such as water or electricity infrastructure. Kaja Kallas, the EU's top foreign affairs official, said the incidents would be discussed at the foreign affairs council the following Monday, according to The Guardian.

Why it matters

France is treating this as a watershed moment: the first large-scale physical act of sabotage on its soil attributed to a state actor, rather than data theft or ransomware. The campaign demonstrates how unpatched, internet-facing industrial controllers, the kind embedded in supermarket freezers, can be turned into instruments of national-level disruption affecting food supply, retail and the medical cold chain. With the EU having already designated the IRGC a terrorist organisation this year and Paris promising Europe-wide sanctions, the attribution sets up a diplomatic and legal response that could further escalate tensions with Tehran. It also raises urgent questions for vendors and operators of industrial IoT equipment, who now face pressure to secure or retire controller models that no longer receive security updates.