France Iran Cyberattack Probe Names IRGC Unit Over 700 Stores

The France Iran cyberattack case moved from suspicion to formal attribution on Monday, November 9, 2026, when France blamed Iran's Islamic Revolutionary Guard Corps for the October 11-12 cyberattack that disrupted refrigeration and freezer controls at about 700 French supermarket sites. French Foreign Minister Jean-Noel Barrot said the attack was carried out by the IRGC, and Paris prosecutors opened a judicial investigation while seeking international arrest warrants.

How did the hackers reach the fridges?

According to Paris Prosecutor Laure Beccuau's Nov. 9 statement, quoted by franceinfo, the attackers remotely accessed refrigeration controllers made by Danfoss and Dixell through web interfaces. They then launched abnormal defrost cycles of unlimited duration and disabled temperature alarm probes, causing major food losses and about 20 fires, prosecutors said.

Barrot told reporters, according to AFP via The Guardian, "I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran." He added, "This attack is unprecedented in both its scale and its level of aggression." He said France would push for sanctions at the European level against those responsible, and he summoned Iran's ambassador to France on Monday to protest.

Why is France treating this as more than a cyber incident?

Beccuau said the probe targets the head of the Iranian group Shahid Kaveh, an offensive cyber unit affiliated with the IRGC Electronic and Cyber Center, along with his two deputies and anyone else identified. The charges include fraudulent access to automated data processing systems by an organized gang, damage by means dangerous to people by an organized gang, aggravation linked to serving a foreign power, and criminal conspiracy.

Investigators cited several indicators tying the campaign to the unit: the method used, Farsi-language traces, and IP addresses pointing to terminals located in Iran. The investigation involves OFAC, France's anti-cybercrime office, and DGSI, the domestic intelligence service.

What happens next in the France Iran cyberattack case?

France's cyber agency, ANSSI, had previously blamed "basic security failures," saying companies did not follow its recommendations. The weak point was ordinary store equipment exposed to the internet, not a sophisticated exploit chain, which makes the case a warning for operational technology, or OT, the systems that control physical equipment. Britain's NCSC has issued similar warnings about AI cyber attacks on infrastructure.

Reuters noted that the hacks would rank among the most disruptive cyberattacks of the war with Iran that began in February 2026, after alleged incidents involving the Los Angeles transit system, US water treatment plants and ships bound for the United States. A second wave of supermarket attacks this month hit more than 100 sites across Europe, including Belgium, Luxembourg, Sweden, Ireland and Estonia, and even blood bank refrigerators in France, but investigators there have not publicly linked the November incidents to Iran. Iran's UN mission did not respond, and Tehran routinely denies malicious cyber operations.

This is a rare case in which a cyber incident quickly became a diplomatic and legal one. France's move combines public attribution, arrest warrants, and potential EU sanctions in a single response. For retailers, the lesson is cheap compared with the damage: an exposed controller is as risky as an open door. The case also adds to wider concern about Iran-linked risks to digital infrastructure.