France blames Iran for cyberattack that spoiled food at 700 shops
The French government identified the IRGC-linked unit Shahid Kaveh as the source of the destructive campaign, which also targeted hydroelectric plants.
By Abigail Brooks ·
France formally accused Iran on Monday of conducting a destructive cyber campaign against its critical infrastructure in October. The government stated that Iranian military hackers compromised refrigeration systems across the country, causing millions of dollars in food to spoil.
According to the French National Cybersecurity Agency, known as ANSSI, the attackers gained control of refrigeration controllers at roughly 700 retail locations. These sites included supermarkets and butcher shops. During the attacks, which occurred in the middle of the night, temperatures inside the units rose, ruining perishable goods. The hackers also targeted several small hydroelectric power plants, causing what ANSSI described as moderate effects.
Jean-Noël Barrot, the French Foreign Minister, called the operation the first large-scale cyberattack aimed at sabotage on French national territory. He described the incident as a major attack on the nation's interests and the security of its people. The Paris Prosecutor's Office has opened an investigation into Shahid Kaveh, a cyber unit the French government links to Iran's Islamic Revolutionary Guard Corps. Prosecutors are seeking international arrest warrants for the group.
This incident follows a pattern of attacks on industrial controllers in 2026. Similar strikes hit grocery stores in Sweden and Ireland last week. In France, employees at a major blood bank had to manually save blood samples when their refrigeration system failed last week. In Israel earlier this year, hackers linked to Iran claimed responsibility for sabotaging a food processing plant. They infected corporate computers, hacked office printers to display threatening messages, and used cameras for a propaganda video released in early October.
U.S. military commissaries experienced similar disruptions over the summer. Food spoiled after refrigerators and freezers heated up overnight. While U.S. officials suspect Iran was behind those base attacks, the Pentagon has not issued an official statement confirming the disruptions resulted from a cyberattack. Mollie Halpern, a spokesperson for the Department of War Office of the Inspector General, stated that the department does not discuss ongoing investigations.
ANSSI identified the hackers using digital clues. These included the specific infrastructure used by the attackers, a connection to a propaganda outlet, and traces of the Farsi language in the code. Alex Orleans, head of threat intelligence at Sublime Security, said the attacks fit a strategy to reassert Iranian power abroad. He noted that Shahid Kaveh has previously targeted American water treatment plants.
Cybersecurity experts point to the difficulty of securing operational technology. These machines control physical processes like cooling and pumping. They are often outdated, difficult to patch, and exposed to the open internet because vendors require remote access. Ari Ben Am, an adjunct fellow at the Foundation for the Defense of Democracies, described Shahid Kaveh as an offensive unit responsible for high-profile Iranian operations.
Iran has not responded to the accusations. At a G7 meeting in Paris, Secretary of State Marco Rubio declined to comment on whether the U.S. shared information with France. He described the attackers as "sickos" who attack refrigerators and noted that France is not directly involved in the war between the U.S. and Iran.
