France Blames Iran's Revolutionary Guards for Supermarket Fridge Hacks

France has directly accused Iran's Islamic Revolutionary Guard Corps of carrying out the cyberattack that crippled refrigeration systems in roughly 700 supermarkets across the country. It's the first large-scale sabotage cyberattack on French national territory, and the government is treating it accordingly.

"The responsibility for this attack lies with Iran's Islamic Revolutionary Guard Corps," French Foreign Minister Jean-Noel Barrot said on Monday in Paris, speaking on the sidelines of an informal G7 ministerial meeting. It's a rare public attribution of a cyber operation to a foreign power by name, and it came with teeth: Barrot said France has summoned Iran's ambassador and will pursue retaliation.

What does the attack actually change for French security?

The incident moves state-linked cyber sabotage from theoretical risk to documented reality inside France. "This is the first large-scale cyberattack with an aim of sabotage on the national territory," Barrot said. "It hurts the nation's interests and the security of French citizens. We will take sanctions at the European level against all who are responsible" and "we will take any other proportionate and necessary measure to respond to this attack and dissuade those who would like to reproduce it."

For operators of connected infrastructure — and that includes anyone running internet-linked building controls, not just grocers — the message is blunt. The entry point here wasn't exotic. The attackers hit centralized fridge controllers, the internet-connected boxes that let contractors remotely monitor temperatures. Once inside, they manipulated settings and triggered prolonged defrost cycles, heating up refrigerators and freezers across hundreds of stores.

Think about that attack surface: hundreds of sites, one vendor ecosystem, one class of device, one settings menu. The damage didn't require destructive malware. It required access and patience.

Who is being pursued?

Paris prosecutors said Monday they've asked an investigative judge with wider probing powers to take over a case they opened last month. They're also seeking arrest warrants against the head of an Iranian cyber unit affiliated with the IRGC, plus two of his deputies.

Prosecutors said investigators identified attack methods characteristic of that offensive cyber unit. The evidence cited: the use of Farsi and IP addresses linked to devices located in Iran. Representatives for Iran's foreign ministry didn't immediately respond to a request for comment.

That forensic detail matters for practitioners. Attribution rested partly on linguistic and infrastructure fingerprints — the kind of evidence that increasingly anchors public government attributions, not just classified ones.

What does this change for European businesses?

Two things shift. First, France is pushing the response to the EU level, promising sanctions "against all who are responsible." That signals a coordinated European posture rather than a bilateral dispute, and it raises the cost calculus for state-linked units behind similar operations.

Second, the case gives security teams a concrete precedent to take to the board. A connected controller managing physical temperature across 700 locations became a national security incident involving a G7 foreign ministry and a formal criminal probe. Any device that remotely controls a physical process — cooling, heating, access, power — now has a named, documented worst-case scenario attached to it.

European supermarkets have already been rushing to patch vulnerabilities after the region-wide hack, and the French attribution will likely accelerate vendor audits of remote-monitoring systems. Contractors and managed-service providers holding credentials to those controllers face the sharpest scrutiny, since remote maintenance access was the very door the attackers walked through.

The next signal to watch is whether EU sanctions actually land, and whether other affected European countries follow France's lead in naming the IRGC publicly.