France has accused Iran’s Islamic Revolutionary Guard Corps (IRGC) of orchestrating a coordinated cyber-attack last month that remotely compromised supermarket refrigeration systems, spoiling millions of euros worth of fresh and frozen food across hundreds of retail stores nationwide.
French Foreign Minister Jean-Noël Barrot condemned the incident during a press briefing on Monday, November 9, 2026, labelling it as an assault of unprecedented scale and aggressiveness against national territory. According to BBC coverage, Barrot confirmed that Paris has summoned the Iranian ambassador to lodge a formal protest and intends to pursue retaliatory economic measures at the European Union level.
The Scope of the October Refrigeration Sabotage
The security breach began on October 11, when unauthorized operators gained remote access to software management tools supplied by the Danish engineering firm Danfoss. This software regulates commercial cold-storage units across major European food retailers.
Hackers systematically manipulated thermostat settings overnight, driving internal temperatures up to 50 degrees Celsius (122 degrees Fahrenheit) while stores remained closed. Al Jazeera reported that the resulting thermal spikes caused widespread spoilage, melted internal equipment, and triggered localized fires across roughly 700 retail locations in France.
Major French supermarket chains bore the brunt of the initial intrusion. Coopérative U reported more than 100 affected stores, while Intermarché and its discount brand Netto recorded over 300 impacted locations. Additional damage was sustained at outlets operated by Carrefour, Monoprix, and E.Leclerc.
Expanding Investigations and International Outreach
Following the initial French disclosures, the Paris prosecutor’s office opened formal criminal proceedings. CNN noted that the prosecutor named an offensive cyber unit known as Shahid Kaveh, which operates under the authority of the IRGC electronic and cyber center.
Investigators have requested international arrest warrants for the head of the Shahid Kaveh unit and two of his deputies, citing Farsi language artifacts and digital internet protocol traces pointing directly to Iran.
The state-backed cyber incursions did not stop at French borders. Earlier this month, a secondary wave of refrigeration hacks disrupted more than 100 additional stores across Belgium and Luxembourg, alongside smaller numbers of incidents in Sweden, Ireland, the Netherlands, Estonia, and Finland. Authorities are still examining whether these multi-national intrusions share a direct operational link with the French incidents.
| Incident Date | Primary Target Region | Impacted Retailers | Attributed Entity |
|---|---|---|---|
| October 11–12, 2026 | France (Approx. 700 stores) | Intermarché, Coopérative U, Carrefour, Monoprix, E.Leclerc | Shahid Kaveh Unit (IRGC) |
| Early November 2026 | Western and Northern Europe | Stores in Belgium, Luxembourg, Sweden, Ireland, Netherlands, Estonia, Finland | Under Investigation |
Cyber Attribution Remains Complex Despite Official Statements
Despite definitive statements from French diplomatic and prosecutorial officials, independent verification remains complex. Attribution in cyberspace is exceptionally difficult because hostile actors routinely route traffic through proxy infrastructure to obscure their physical locations.
