French authorities on Monday named Iran’s Islamic Revolutionary Guard Corps as the force behind an October sabotage campaign that pushed supermarket refrigeration systems toward defrost, summoned Tehran’s ambassador, and pledged European sanctions plus international arrest warrants against officers of the Shahid Kaveh cyber unit.

Foreign Minister Jean-Noël Barrot told reporters at a Group of Seven meeting in Paris that investigators could confirm the IRGC’s role in the overnight attack of 11–12 October. The Foreign Ministry condemned the operation in the strongest terms available under French law and said the ambassador had been called in to hear the accusation directly.

What the attackers changed

The sabotage targeted software from Danish engineering firm Danfoss that lets retailers manage cold units from a distance. Hackers raised setpoints on refrigeration controllers, and in some stores temperatures climbed toward 50 degrees Celsius before staff arrived. Chains including Carrefour, Intermarché, Coopérative U, Monoprix and E.Leclerc reported spoiled chilled and frozen stock, while smaller butchers and cooperatives were also affected.

French investigators said the campaign was unprecedented on national territory for combining scale with purely destructive intent, rather than theft or ransom. The interior-facing Cyber Crisis Coordination Centre, which draws on ANSSI, military cyber command and civilian intelligence agencies, published a five-page attribution report Monday tying the operation to Shahid Kaveh, a unit previously linked to reconnaissance against U.S. water utilities.

Costs, fires, and a second wave

Officials estimate food losses and equipment damage in the tens of millions of euros. At least 15 fires were linked to the refrigeration tampering. The same operation also probed Schneider Electric gear at small hydroelectric sites in France, though ANSSI described that disruption as moderate.

France has not yet publicly attributed a separate early-November wave that hit European meat suppliers and sites connected to the national blood service. Prosecutors and cybersecurity agencies are still tracing whether the second cluster shares infrastructure with the October raids.

Paris prosecutor Laure Beccuau said her office opened a judicial investigation against the head of Shahid Kaveh, two deputies and other suspects still being identified, and requested international arrest warrants. Investigators cited Farsi-language artefacts, reused infrastructure and tooling patterns associated with earlier Shahid Kaveh activity.

Barrot said France would propose new European Union sanctions on Iranian entities and individuals tied to the fridge attacks and other malicious cyber activity. Tehran has not issued an official response; some state-linked outlets have dismissed the allegations as baseless. The attribution lands as Western capitals weigh how far industrial-control sabotage can escalate while the U.S.–Iran war posture remains tense.

What retailers face next

Grocery operators are reviewing remote-maintenance contracts and segmentation for building-management networks. Danfoss and national regulators have urged patch verification and offline overrides. French officials said additional public and nonpublic measures remain on the table under the country’s 2026 national cybersecurity strategy.