France’s Paris Prosecutor’s Office has escalated its response to a sweeping Iranian hacking campaign by formally requesting international arrest warrants targeting the IRGC-linked cyber unit Shahid Kaveh.
The legal move follows a wave of destructive intrusions that disabled refrigeration controllers at roughly 700 French retail locations, from supermarkets including Intermarché and Cooperative U to independent butcher shops, spoiling millions of dollars worth of food overnight in October.
France’s National Cybersecurity Agency, ANSSI, identified the perpetrators through digital footprints left in the attack infrastructure, links to a known Iranian propaganda outlet, and traces of Farsi language embedded in the malicious code.
French Foreign Minister Jean-Noël Barrot described the campaign as “unprecedented in both its scale and its level of aggression,” calling it the country’s first major sabotage-oriented cyberattack on domestic soil.
Beyond the food supply, Iranian-linked hackers also targeted several small hydroelectric power plants across France, with ANSSI reporting what it characterized as “moderate effects” on those facilities.
France is the first government worldwide to officially assign responsibility for this pattern of attacks, which cybersecurity experts say stretches from Europe to Israel to American military installations throughout 2026.
Grocery chains in Sweden and Ireland suffered near-identical intrusions just last week, and a French blood bank was forced into an emergency response after its refrigeration system was compromised, threatening the integrity of stored blood samples.
Alex Orleans, head of threat intelligence at cybersecurity firm Sublime Security, argued that the refrigeration targeting reflects a deliberate IRGC strategy, saying “Iran’s cyberattacks against refrigeration systems likely represents the IRGC attempting to reassert Iranian power abroad through both physically and psychologically disruptive operations.”
Orleans added that “this unit has once again refined its tradecraft through attacks on Israeli targets before shifting their targeting to the same systems in the West,” pointing to a spring attack on an Israeli food processing plant by a group called “Cyber Isnaad Front” that cyber firm Profero attributed to Iran’s Revolutionary Guard Corps.
Ari Ben Am, an adjunct fellow at the Foundation for the Defense of Democracies’ Center on Cyber and Technology Innovation, characterized Shahid Kaveh as “an offensive cyber unit responsible for some of the greatest hits of Iranian offensive cyber [operations],” noting its ties to the Cyber Av3ngers group linked to attacks on US water treatment facilities in late 2023 and early 2024.
The French attribution also drew attention to earlier IRGC-linked operations against French targets, including a cyberattack on satirical magazine Charlie Hebdo and an intrusion targeting digital kiosks deployed at the 2024 Paris Olympics.
U.S. military commissaries experienced eerily similar overnight spoilage events over the summer, though the Pentagon has declined to confirm a cyberattack was involved and has issued no official attribution despite reported suspicions pointing toward Iran.
At a G7 gathering in Paris on Monday, Secretary of State Marco Rubio sidestepped questions about whether Washington provided intelligence to assist France’s attribution, though he offered a pointed reaction, asking “What kind of sickos are these people? They attack refrigerators. France is not even involved in this, really,” referencing the ongoing US-Iran conflict that began in February.
Cybersecurity professionals warn that the vulnerability exploited in these attacks, industrial refrigeration controllers connected to the open internet, reflects a systemic weakness in operational technology that remains deeply difficult to address because operators cannot afford downtime in sectors like healthcare and food logistics.
Iran has not publicly responded to the French accusations, but analysts suggest Paris’s formal attribution and legal action could pressure other affected nations to follow with their own official findings.
