700 French food shops hit by Iran-linked hack

Iranian hackers raised the temperature in the refrigerators of 700 French retail locations overnight.

The French National Cybersecurity Agency, known as ANSSI, identified the breach as part of a coordinated campaign in October. Attackers controlled cooling systems at supermarkets and butcher shops, causing food to spoil. The operation also affected several small hydroelectric plants, though operational impacts there remained moderate.

French Foreign Minister Jean-Noel Barrot called the intrusion the first large-scale cyberattack designed for sabotage on French soil. He described the event as a major strike against national interests and public security. The Paris Prosecutor's Office opened a case against the Shahid Kaveh unit, which links to the Islamic Revolutionary Guard Corps. Investigators are seeking international arrest warrants for the suspected operatives.

This incident follows a pattern of attacks on cooling infrastructure across multiple continents in 2026. Similar disruptions hit grocery stores in Sweden and Ireland last week. In the United States, food spoiled at military bases over the summer when refrigerators and freezers spiked in temperature overnight.

A separate event in Israel this spring involved the Cyber Isnaad Front. That group claimed responsibility for sabotaging an industrial food plant by infecting computers and hijacking office printers for threatening messages. A propaganda video from that attack included a taunt in French regarding education protests. The cybersecurity firm Profero attributed the Israeli strike to a Revolutionary Guard wing.

ANSSI officials pinpointed the hackers through digital infrastructure clues and traces of Farsi language in the code. They also found connections to a specific propaganda outlet. U.S. officials suspect Iran was behind the August attacks on military bases, but the Pentagon has not issued an official statement. A spokesperson for the Department of War Office of the Inspector General said the Criminal Investigative Service avoids commenting on active cases to preserve their integrity.

Experts view the tactics as a way for the Revolutionary Guard to assert power through physical and psychological disruption. Alex Orleans, head of threat intelligence at Sublime Security, noted that Shahid Kaveh is repeating methods seen in attacks on American water treatment plants earlier this year. He said the unit refined its skills on Israeli targets before moving to Western systems.

Ari Ben Am, an adjunct fellow at the Foundation for the Defense of Democracies, described Shahid Kaveh as a primary offensive unit for Iranian cyber operations. He pointed to a linked group, Cyber Av3ngers, which the U.S. government connected to attacks on Israeli-made systems in U.S. water facilities from 2023 to 2024. France cited previous IRGC strikes against French interests, including targets at Charlie Hebdo and digital kiosks during the 2024 Paris Olympics.

Security professionals point to long-standing vulnerabilities in operational technology that controls physical processes like cooling. These machines are often outdated and difficult to patch without stopping services. Vendors frequently require them to be exposed to the open internet for maintenance. Iran has not yet responded to the French accusations.

Secretary of State Marco Rubio spoke during a G7 meeting in Paris on Monday. He declined to detail information sharing but described the attackers as sickos who attack refrigerators. He said the news does not surprise him given the ongoing conflict between the U.S. and Iran.