France accuses the Iranian Revolutionary Guards of organizing the cyber attack on the refrigerators in October. Approximately 700 large distribution sites were affected. On Monday 9 November 2026, Jean-Noël Barrot announced a diplomatic response and the upcoming European sanctions. The Paris Public Prosecutor’s Office is providing judicial information to officials of an Iranian cyber unit and requires international arrest warrants.
The French announcements move the record of sabotage to the public allocation of the operation. They concern attacks on French refrigeration installations on 11 and 12 October. They alone do not make it possible to attribute to the same group all similar incidents subsequently reported elsewhere in Europe.
Judicial information against Shahid’s officials Kaveh
The Paris prosecutor, Laure Beccuau, announced the opening of a judicial investigation against the leader of the Iranian group Shahid Kaveh. Its two deputies are also involved, as well as any other person whom the investigations would identify. The Public Prosecutor ‘ s Office presents this organization as an offensive cyber unit attached to the Electronic and Cyber Center of Revolutionary Guards.
The procedure involves fraudulent intrusions into organized computer systems and damage to people. The Prosecutor ‘ s Office has requested international arrest warrants. This request does not mean that the persons concerned were arrested or that a court established their guilt.
The judicial record is therefore not limited to the suspicion of an isolated Iranian national. The French authorities question an organised structure and its chain of responsibility. The instruction shall specify the individual roles, means employed and acts attributable to each. The persons concerned remain presumed innocent.
Cyber attack on refrigerators: the clues advanced by France
An official report published on the same day sets out the elements chosen by the French services. The Cyber Crisis Coordination Centre, or C4, designates the Revolutionary Guards as an alleged sponsor. He attributes execution to the Shahid Kaveh unit. This body brings together, inter alia, ANSSI and the internal and external intelligence services.
The allocation is based on several reconciliations. Technical investigators note the re-use of infrastructure for reconnaissance operations against industrial equipment. They identify methods already associated with this unit, as well as the use of a tracking tool that it usually uses. Traces of Farsi also appear in the attack infrastructure.
The report also mentions the dissemination of information on sabotage by CyberbanNews on 13 October. The French services present this channel as a communication organ associated with Shahid Kaveh. They bring these observations closer to other campaigns against industrial equipment, particularly in the United States and Israel.
These elements constitute the public argument for French attribution. Using a language or a search tool, considered in isolation, would not be sufficient to identify a sponsor. The services present them here as a consistent set. Their technical analysis and criminal procedure follow two distinct approaches. One assigns one operation, the other has to establish individual responsibilities.
Approximately 700 affected sites and fire departures
The C4 indicates that it was alerted on 12 October after the night compromise of cold controllers. Attackers had changed deicing settings to impose high temperatures. The goods suffered significant losses. The official report lists at least 15 cases of fire departure.
The victims belong mainly to the large distribution. The document cites Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. He also mentioned small butchers, a slaughterhouse and cooperative agri-food plants. The perimeter thus exceeds supermarket shelves, even if they concentrate the establishments concerned.
The material consequences explain the seriousness of the case. The misappropriation of orders not only disrupts software: it alters the operation of devices that store food. Operators must remove products that have become unfit for sale and check facilities. They must restore safe conservation before rebuilding stocks.
The French services also report concurrent attacks on small hydro installations. They attach them to the same operation, while describing moderate effects. These facilities are other targets identified by French services. The report does not mention any general interruption of electricity supply related to this operation.
Barrot announces a diplomatic and European response
Jean-Noel Barrot publicly accused the Revolutionary Guards of leading the attack. The French Minister for Foreign Affairs presents it as a sabotage operation of an unprecedented scale and aggression on the national territory. He announced the convening of the Iranian ambassador to protest to Tehran.
The head of French diplomacy also announced that European sanctions would be imposed against those responsible. At this stage, it is a French announcement on future measures. The list of persons or entities concerned and the timetable for application remain to be specified.
The distinction is that diplomatic challenges, prosecutions and sanctions follow different procedures. The measures mentioned on Monday remain to be implemented at European level.
Link to other incidents still to be established
In early November, other European businesses reported disturbances in their refrigeration equipment. Incidents also affected blood storage facilities in France. Proximity of targets and effects feeds rapprochements. It does not demonstrate that all these attacks are part of the same operation.
The French attribution published on 9 November specifically concerns the sabotage of the French controllers on 11 and 12 October. It does not automatically regulate the origin of other episodes. Requested by a news agency, the Iranian mission to the United Nations had not responded in the first information published on Monday.
The next steps now concern the follow-up to the prosecutor’s requests and the definition of the European response announced by Paris. The investigation has yet to specify criminal responsibility. The consequences of this attack have reached food stocks and store safety.
Cover: illustration photograph of January 21, 2016. The photographed shop is not presented as a victim of the attacks. Photo: Raysonho @ Open Grid Scheduler / Grid Engine, Wikimedia Commons, CC0 1.0. Boxing and editorial dressing Libnanews.
Comments