France formally blames Iran for supermarket fridge cyberattacks, vows EU sanctions

French Foreign Minister Jean-Noël Barrot made the announcement at a G7 foreign ministers' meeting in Paris on Monday, saying the attack was "unprecedented in both its scale and its level of aggression" and that the Iranian ambassador had been summoned "to lodge a very strong protest against this extremely grave act."

The first wave of hacks on 11-12 October hit more than 700 supermarket locations in France, including chains such as Intermarché, Carrefour, Monoprix, Coopérative U and E.Leclerc. Attackers remotely overrode temperature controls, pushing some thermostats as high as 50°C (122°F) overnight, spoiling fresh and frozen food. In some stores, the heat sparked fires and triggered sprinklers, causing water damage.

A second wave on 2 November struck dozens of stores across at least seven European countries, including Sweden, Belgium, Luxembourg, Estonia, Finland, Ireland and the Netherlands, as well as three French blood bank locations, though no donated blood was lost.

Barrot said the hacking was carried out by the IRGC and described it as "the first large-scale cyberattack aimed at sabotage on French soil, and it represents a major threat to our national interests and the security of the French people. That is why it will not go unanswered." He said France would "implement sanctions at the European level against all those responsible for this attack."

The Paris public prosecutor, Laure Beccuau, said on Monday that an investigation had been opened against the head of the cyber unit Shahid Kaveh, his two deputies, and others yet to be identified. Shahid Kaveh is a hacking cluster linked to the IRGC's electronic and cyber centre. Beccuau said investigators had identified "a modus operandi" characteristic of the group, including "the use of Farsi and IP addresses traced back to devices located in Iran." The charges include "fraudulent attacks on an automated data processing system committed as part of an organised crime ring and of causing damage dangerous to persons," aggravated by being committed to serve a foreign power.

At least some of the affected refrigerator units used temperature control systems from Danish firm Danfoss, whose software allows retailers to manage cold units remotely. Danfoss said it was working with customers to fix the problems.

France's Foreign Affairs Ministry said in a statement that the cyberattacks caused “significant material damage, including fires, and the estimated loss of food and other goods amounting to tens of millions of euros” and represented “a major threat to the interests of the Nation and the security of French citizens.” Authorities said this was not the first time Iran had targeted France with “destabilisation acts,” citing a hack on satirical newspaper Charlie Hebdo in 2023 and hostile actions during the 2024 Olympic Games.

The European Union's foreign policy chief, Kaja Kallas, said the Foreign Affairs Council meeting on 16 November would provide an opportunity to discuss the attacks. "If they are attributed, our response should be stronger," she said.

French cybersecurity agency director Vincent Strubel said that while the modus operandi of the incidents was similar, “nothing at this stage allows us to confirm that it is the same attacker.”

Iran has not yet responded to the allegations. The U.S. government is also reportedly investigating whether freezer units on military bases were hacked, and U.S. officials have reportedly linked a freezer-related cyberattack to Iran, but the intelligence community has not made a formal public attribution.

The French Blood Establishment said technicians were alerted by alarm systems and disconnected the cold stores before any blood was destroyed.

The IRGC was designated a terrorist organisation by the European Union this year, after France dropped its long-held opposition to the designation.