France Accuses Iran of Cyber Sabotage in Mass Fridge Attacks

By Grace Kim

France has formally accused Iran of sabotage after hackers took over refrigeration controllers at roughly 700 French retail sites in October, spoiling millions of dollars' worth of food. The Paris Prosecutor's Office has opened an investigation and is requesting international arrest warrants against the Iranian cyber unit Shahid Kaveh, which the French government links to the Islamic Revolutionary Guard Corps.

The French National Cybersecurity Agency (ANSSI) announced the attribution on Monday. It said Iranian military hackers raised refrigerator temperatures overnight at sites ranging from supermarkets to butcher shops. The same campaign hit several small hydroelectric power plants, with what ANSSI called "moderate effects."

What did French officials say?

Foreign Minister Jean-Noël Barrot called the campaign "unprecedented in both its scale and its level of aggression." He said it "marks the first large-scale cyberattack aimed at sabotage on our national territory, and it constitutes a major attack on the nation's interests and the security of the French people."

The Paris Public Prosecutor's Office confirmed its next step in a statement: "The Paris Public Prosecutor's Office is requesting the issuance of international arrest warrants."

France is the first government to formally assign blame for this wave of destructive attacks. Iran has not responded.

How did investigators identify the hackers?

ANSSI said analysts traced the operation through digital infrastructure used by the hackers, connections to a propaganda outlet, and "traces" of Farsi-language use in the attack code.

The attribution carries diplomatic weight. Announced on the day of a G7 meeting in Paris, it may prompt other affected states to act. Secretary of State Marco Rubio, asked whether the U.S. shared intelligence with France, declined to comment but said the "French are quite capable." He added: "What kind of sickos are these people? They attack refrigerators. France is not even involved in this, really." Rubio was referring to the war between the U.S. and Iran, which began in February.

Is this part of a wider pattern?

Yes. In 2026 alone, hackers have targeted refrigeration controllers across Europe, Israel and the United States.

• Grocery stores in Sweden and Ireland suffered similar attacks last week.
• Employees at a major French blood bank rushed to save blood samples when their refrigeration system was hit last week, prompting international calls to protect medical supplies.
• Suspected Iranian hackers calling themselves "Cyber Isnaad Front" claimed a spring attack on an Israeli food processing plant, infecting corporate computers, hijacking printers to output threats and hacking cameras for a propaganda video released in early October. That video included a taunt in French referencing education protests. Profero, an incident response firm, attributed the attack to an IRGC wing.
• Over the summer, refrigerators and freezers at commissaries on U.S. military bases failed overnight, spoiling food. U.S. officials reportedly suspect Iran, but the Pentagon has not confirmed a cyberattack. "Consistent with our policy and to preserve the integrity of the process, the DOD [Office of Inspector General] Criminal Investigative Service does not discuss ongoing investigations," spokesperson Mollie Halpern wrote to NPR.

Why does attribution matter for practitioners?

Alex Orleans, head of threat intelligence at Sublime Security, told NPR the attacks show the IRGC "attempting to reassert Iranian power abroad through both physically and psychologically disruptive operations" that remain "cost-effective" while Iran's resources stay tied down in war. He noted Shahid Kaveh's pattern: refining tradecraft against Israeli targets before "shifting their targeting to the same systems in the West." He cited August attacks on American water treatment plants, still unattributed by Washington, as precedent.

Ari Ben Am of the Foundation for the Defense of Democracies called Shahid Kaveh "an offensive cyber unit responsible for some of the greatest hits of Iranian offensive cyber [operations]." One tied group, Cyber Av3ngers, was linked by the U.S. government to attacks on Israeli-made systems in American water facilities in winter 2023-2024. France also cited IRGC-linked attacks on Charlie Hebdo and on digital kiosks at the 2024 Paris Olympics.

Why are refrigeration systems so hard to defend?

The campaign exposes a longstanding operational-technology problem. The machines controlling physical processes — water pumps, cooling systems — are often outdated and riddled with vulnerabilities. Operators cannot easily patch them because shutting systems down would disrupt critical services such as healthcare and transport. Many devices sit exposed on the open internet, partly because vendor contracts require remote maintenance. That combination makes the problem stubbornly hard to solve, and Monday's attribution puts OT security squarely on every European regulator's desk.

Takeaway: France has broken the attribution silence, and practitioners securing industrial control systems should expect governments, and attackers, to move next.