French officials announced on Monday, Nov. 9, 2026, that the Iranian government was responsible for a series of cyberattacks that disabled commercial refrigeration units across the country last month. The Paris prosecutor's office specifically attributed the hacks to "Shahid Kaveh," which it identified as a cyber-offensive unit of the Islamic Revolutionary Guard Corps (IRGC). French Foreign Minister Jean-Noël Barrot summoned the Iranian ambassador and stated that Iran would face consequences, including potential European Union sanctions.
The announcement followed an Oct. 11 cyberattack that targeted approximately 700 retail locations throughout France. According to the prosecutor's office, hackers gained remote control of the equipment to initiate indefinite defrost cycles and disable safety alerts. This caused refrigeration temperatures to rise, leading to food spoilage and approximately 20 fires when units overheated. Iran's mission to the United Nations did not respond to requests for comment, though the Iranian government typically denies involvement in malicious cyber operations.
The attacks occurred during a conflict involving the U.S. and Iran. Similar incidents occurred in August at six U.S. military commissaries, which are being investigated as suspected cyberattacks. More recently, a second wave of hacking targeted over 100 establishments across Belgium, Luxembourg, and Sweden, as well as several French blood banks. While blood bank employees were forced to move supplies to different storage units, no products or samples were reported damaged in that specific incident.
Investigators reported that the attackers exploited obsolete or outdated firmware on refrigeration controllers that were accessible via the public internet. The Paris prosecutor's office noted that the investigation identified IP addresses tracing back to Iran and the use of the Persian (Farsi) language. The FBI’s cybercrime branch issued a statement last week advising organizations to move industrial refrigeration controllers behind firewalls to prevent unauthorized access to system settings.
The scope of the disruption extends to healthcare infrastructure and military logistics. The targeting of French blood banks required the emergency transfer of medical supplies, while the August outages at U.S. military bases affected food services. Although a specific per-household cost has not been calculated, the loss of tens of millions of euros in inventory across hundreds of locations represents a financial strain on the retail sector that could influence food prices or insurance premiums for these businesses.
The legal and diplomatic precedent is significant, as French prosecutors have formally opened a judicial investigation into charges of fraudulent interference and causing damage dangerous to persons. This marks a shift toward treating cyber incidents as state-sponsored criminal acts. What happens next depends on the findings of the ongoing investigations. The French government has indicated it will pursue further EU sanctions against Iran, though no specific date for a vote or implementation has been set. Organizations using industrial cooling systems are currently advised by the FBI to update firmware and remove controllers from the public internet to prevent further breaches.