France has attributed to the Islamic Revolutionary Guards Corps of Iran a series of cyberattacks that affected nearly 700 sites in the large-scale retail sector on October 11 and 12, 2026. These attacks targeted the temperature-control systems of refrigeration equipment, causing stock losses and, according to the information released, at least 15 fires.
The French Minister of Europe and Foreign Affairs, Jean-Noël Barrot, announced the summoning of the Iranian ambassador and noted sanctions and retaliatory measures envisaged by Paris.
According to information released by French authorities, the National Agency for Information System Security (ANSSI) was alerted on October 12, 2026 to a cyberattack targeting the cooling controllers of around 700 sites in the large distribution sector.
The attackers compromised telemanagement modules enabling remote control of the temperature of freezers, refrigerated display cases and cold rooms.
In the night from Sunday 11 to Monday 12 October, the defrost parameters of these equipment were changed to reach high temperatures.
This manipulation led to stock losses and, according to reports, at least 15 fires.
A cyber-offensive unit implicated
While initial information did not formally identify those responsible, French authorities now say they have elements allowing attribution of the attacks to a cyber-offensive unit called Shahid Kaveh.
This attribution rests notably on several technical and operational indicators: the characteristics of the IT infrastructure used, the use of identifiable tools, the dissemination of the attack by a propaganda organ presented as linked to Shahid Kaveh, and the presence of traces of Persian language in the attack infrastructure.
These elements constitute, according to the French authorities, a convergence of indicators allowing them to designate the presumed authors.
Jean-Noël Barrot accuses the Islamic Revolutionary Guards Corps
In a statement dedicated to this affair, France’s top diplomat, Jean-Noël Barrot, described the cyberattacks of October 11 and 12 as a campaign “of unprecedented scale and aggressiveness.”
The minister directly blamed the Islamic Revolutionary Guards Corps of the Islamic Republic of Iran.
“Today, thanks to the work of state services, we know the responsible parties: the Islamic Revolutionary Guards Corps of the Islamic Republic of Iran,” he said.
He also announced the summoning of the Iranian ambassador.
“We will sanction the authors and take all measures we deem necessary and proportionate to respond to these attacks and deter those who might consider reproducing them,” declared Jean-Noël Barrot.
A judicial investigation opened in Paris
Judicially, the Paris prosecutor’s office has opened an investigation notably into offenses aggravated by the circumstance of having been committed “in order to serve a foreign power.”
This qualification comes in a context where the French authorities emphasize a possible state dimension to the attacks.
The investigation will notably help establish individual responsibilities and the precise circumstances of the operation. The attribution announced by the French authorities does not, in itself, constitute a judicial decision establishing the guilt of persons who may be implicated.
No direct claim of responsibility nor ransom demand had been reported in the early information related to this cyberattack.
The case also illustrates the risks linked to the compromise of industrial control systems, whose consequences can go beyond digital disruption to directly affect physical equipment and the preservation of products.
