France accuses Iran of the cyberattack against refrigerators in October

France on Monday accused Iran's Revolutionary Guard of being behind the large-scale cyberattacks that targeted hundreds of connected supermarket refrigerators in October, promising sanctions "on a European scale".

"I can confirm that the responsibility for this attack lies with the Islamic Republic of Iran's Revolutionary Guard Corps. It is an attack of unprecedented scale and unprecedented aggression," said Foreign Minister Jean-Noël Barrot, on the sidelines of a meeting with his G7 counterparts in Paris.

"We obviously (...) summoned the Iranian ambassador to France on Monday to protest very strongly against this extremely serious act. We will take sanctions at the European level against all those responsible for this attack," he added.

The Revolutionary Guards "have been carrying out acts of terrorism and sabotage all over the world for a long time (...). But, what are these sick people doing attacking refrigerators? France is not even really involved" in the conflict between the United States and Iran, reacted US Secretary of State Marco Rubio, who was in Paris.

On the judicial front, investigating judges were tasked on Monday with an investigation targeting in particular "the head of the Iranian group Shahid Kaveh, an offensive cyber unit affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps (IRGC-ECC)" and "his two deputies", announced Paris prosecutor Laure Beccuau in a statement.

This cyberattack, which took place on the night of October 11-12, targeted "supermarket refrigeration controllers of the Danfoss and Dixemm brands, targeting approximately 700 large distribution sites in France" and "caused significant food losses and around twenty fires," she recalled.

- Farsi language -

Investigators have "uncovered, with the support of specialized state services, a modus operandi of attack characteristic of this unit (Shahid Kaveh, editor's note), the use of Farsi and IP addresses pointing to terminals located in Iran," she specified.

The Cyber Crisis Coordination Centre (C4), which brings together various state services including the National Cybersecurity Agency of France (ANSSI) and the foreign intelligence service (DGSE), mentioned in a statement a "body of evidence indicating the Islamic Revolutionary Guard Corps as the sponsor, and the Shahid Kaveh unit as the executor".

"The techniques used in these actions are known to have been used by the Shahid Kaveh unit since at least April 2026," explains C4, which also adds that "traces of the use of Farsi were found in the attack infrastructure" and that the operation "was relayed on the propaganda organ CyberbanNews, associated with the Shahid Kaveh unit, as early as October 13, 2026."

The investigation, conducted by the Office against cybercrime (Ofac) and the General Directorate for Internal Security (DGSI), established that "the attackers had taken control of the equipment remotely via web interfaces to launch abnormal defrosting cycles of unlimited duration, while disabling the security alerts of the probes supposed to activate beyond a certain temperature," explained Laurence Beccuau.

- "Sabotage" -

For the French foreign minister, this is "the first large-scale cyberattack for the purpose of sabotage on national territory" and a "major attack on the interests of the Nation and the security of French men and women".

In early November, supermarkets in Belgium, Estonia, Finland, Ireland, Italy, Luxembourg, the Netherlands, Portugal and Sweden were in turn hit by a cyberattack, with the temperature of their refrigerators soaring.

The specialized press had pointed to attacks carried out by two pro-Russian hacker groups, NoName057(16) and Z-Pentest, already known for other operations in Europe in recent years. The Kremlin denied any involvement in these cyberattacks on November 5.

The European Union's foreign policy chief, Kaja Kallas, was informed on Monday, along with her G7 counterparts, that the cyberattack against refrigerators in France was attributed to Iran.

"We have the Foreign Affairs Council next Monday, so we will have the opportunity to discuss this, because these cyber incidents occurring in Europe, if they are attributed, also call for a strong response from us," she argued following Jean-Noël Barrot.

Engaged in a standoff with the United States, raising fears of a new escalation between Washington and Tehran since the Israeli-American strikes launched on February 28, Iran is regularly accused of resorting to asymmetric means to achieve its goals.