France has accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of orchestrating a cyberattack that disrupted refrigeration systems at hundreds of supermarkets across the country, warning that Tehran could face further consequences, including additional European Union sanctions.
French Foreign Minister Jean-Noël Barrot said on Monday that Iran’s ambassador had been summoned to the Foreign Ministry following the findings. He also warned that further EU sanctions against Iran could be imposed.
The attacks, which began on Oct 11, affected around 700 commercial premises across France, according to a joint report by French intelligence and cybersecurity agencies.
Investigators said at least 15 fires broke out after hackers remotely increased the temperatures of commercial refrigerators and freezers, causing some units to overheat.
The disruption left supermarket employees scrambling to dispose of spoiled meat and melted ice cream, with the financial damage potentially reaching tens of millions of euros nationwide, according to one supermarket owner.
The attacks also affected small butcher shops, a slaughterhouse and food processing factories.
In their report, French authorities identified Shahid Kaveh, described as a cyber offensive unit linked to the Revolutionary Guards, as being behind the hacking campaign.
Three alleged associates were also named: Hamid Reza Lashgarian, Mahdi Lashgarian and Reza Salarvand.
Authorities said the hackers operated through several front groups posing as vigilante hacking organisations, including CyberAveng3rs and Cyber Isnaad Front.
French investigators linked Shahid Kaveh to the attacks by examining the digital infrastructure used to compromise the refrigeration systems, comparing the methods with previous cyberattacks attributed to the unit and identifying traces of the Persian language within the attack infrastructure.
Paris prosecutors have requested international arrest warrants targeting those believed to be responsible.
The Iranian mission to the United Nations did not respond to requests for comment. Tehran has routinely denied involvement in malicious cyber operations.
The October attacks were followed by another wave of cyber incidents this month, affecting more than 100 establishments across Europe. Some refrigeration systems used by French blood banks were also compromised, forcing staff to transfer blood supplies to alternative cold storage facilities.
The alleged sabotage has drawn international attention, with government agencies and cybersecurity companies investigating possible links to Iran.
Microsoft had privately linked Iran to the October attacks at least two weeks before France made its announcement, according to three people familiar with the matter. Microsoft declined to comment.
The investigation has also expanded to the United States, where refrigerators at at least six military commissaries stopped working in August.
The Pentagon is treating the incidents as suspected cyberattacks and has been working with French officials. A source familiar with the investigation said the US military considers Iran a suspect, although the probe remains ongoing.
The Pentagon said on Monday that it was aware of speculation surrounding a possible cyber incident but declined to provide further details, citing security reasons.
Cybersecurity experts have suggested that the attacks may have been relatively easy to carry out because some affected refrigeration units were obsolete or running outdated firmware.
Saher Naumaan, a senior threat researcher at cybersecurity firm Proofpoint, said the incidents highlighted vulnerabilities in connected refrigeration systems rather than necessarily demonstrating Iran’s advanced cyber capabilities.
The attacks have also prompted warnings from US officials that further cyber disruptions could follow.
