France blames Iran for cyberattacks that spoiled food at 700 shops

The French government officially accused Iran of conducting a destructive cyberattack on the country's critical infrastructure in October. The French National Cybersecurity Agency, ANSSI, reported that Iranian military hackers compromised the refrigeration controllers at approximately 700 retail locations, including supermarkets and butcher shops. The intruders raised the temperatures inside these units during the night, resulting in the spoilage of millions of dollars' worth of food. ANSSI also noted that the campaign targeted several small hydroelectric power plants, causing what the agency described as moderate effects.

The attacks followed a pattern of similar incidents across the globe in 2026. In the spring, suspected Iranian hackers claimed responsibility for sabotaging an industrial food processing plant in Israel. They infected corporate computers with malware and used office printers to display threatening messages. In August, food spoiled in refrigerators and freezers on U.S. military bases, and grocery stores in Sweden and Ireland experienced similar disruptions last week. France is the first nation to formally assign blame for this wave of attacks.

ANSSI identified the hackers by analyzing digital infrastructure, connections to a propaganda outlet, and traces of the Farsi language within the attack code. The French government linked the operation to Shahid Kaveh, a cyber unit associated with Iran's Islamic Revolutionary Guard Corps. Foreign Minister Jean-Noël Barrot stated that the campaign marked the first large-scale cyberattack aimed at sabotage on French national territory. He described it as a major attack on the nation's interests and the security of its people.

The Paris Prosecutor's Office has opened its own investigation into the Shahid Kaveh unit. The office is requesting the issuance of international arrest warrants. French officials pointed to previous Iranian cyberattacks against French targets, including the satirical magazine Charlie Hebdo and digital kiosks at the 2024 Paris Olympics, as context for this new operation.

Cybersecurity experts said the focus on operational technology, such as cooling systems and water pumps, reflects a long-standing challenge in the field. These machines are often outdated and difficult to patch without interrupting essential services. They are frequently exposed to the open internet due to vendor contracts that allow for remote maintenance. Alex Orleans, head of threat intelligence at Sublime Security, said the attacks represent an attempt by Iran to assert power through physically and psychologically disruptive operations while its resources remain tied up in the war.

The U.S. Department of War has not yet officially attributed the August attacks on military base refrigerators to Iran, though officials suspect Iranian involvement. Mollie Halpern, a spokesperson for the Department of War Office of the Inspector General, stated in an email that the Criminal Investigative Service does not discuss ongoing investigations. Secretary of State Marco Rubio addressed the French accusation during a G7 meeting in Paris on Monday. He declined to comment on information sharing but noted that the French are capable. Rubio expressed surprise at the targets, asking, 'What kind of sickos are these people? They attack refrigerators.'

Iran has not yet responded to the French accusations. The timing of the announcement coincided with the G7 meeting in Paris, where leaders discussed the ongoing conflict between the U.S. and Iran that began in February. The French government's move to publicly attribute the attacks may prompt other affected countries to take similar action.