France blames Iran's Revolutionary Guards for the supermarket fridge cyberattacks and vows European sanctions
France on Monday formally blamed Iran's Islamic Revolutionary Guard Corps for last month's cyberattacks on supermarket refrigeration across France, saying a Guards-linked cyber unit, Shahid Kaveh, raised temperatures at about 700 commercial sites on 11 October, starting at least 15 fires. Foreign Minister Jean-Noël Barrot called it the first large-scale cyber sabotage on French territory, summoned Iran's ambassador and promised sanctions at European level. Paris prosecutors have opened an investigation into the unit's head and his two deputies, and have requested international arrest warrants. Iran's mission to the United Nations did not respond to requests for comment.
Checking in progress
This story is still being checked. Claims below are published as claims — never dressed as facts — and each one moves only when the evidence earns it.
- Collecting reportsDone
- Grouping the versionsDone
- Checking claims7 of 7 claims checked
- 4Human gateWe are here
7 of 7 claims checked so far · step 4 of 4: Human gate
Key points
- France's foreign minister says Iran's Revolutionary Guards carried out the 11 October fridge and freezer attacks — the first large-scale cyber sabotage on French territory, in his words.
- French agencies name the Guards-linked unit Shahid Kaveh, three alleged associates, and 700 targeted sites with at least 15 fires.
- Paris prosecutors have opened an investigation into the unit's head and his two deputies, and requested international arrest warrants.
Show more (1)
- Iran's ambassador was summoned and European sanctions promised; Iran's UN mission did not respond.
Watch: the moment itself
Direct video sits at the top of Vozia's evidence ladder — the moment itself, from its owner. Embedded from its home platform; we never download or re-host it.
Video: FRANCE 24 English · Watch on YouTube
What happened
The October attacks were among the most disruptive cyber incidents of the Iran war that began in February: hackers remotely raised temperatures in supermarket refrigeration, in some cases setting units on fire and spoiling whole inventories of food.
France made the attribution minutes after Reuters reported that investigators privately suspected Iran, and a second wave of similar hacking this month hit more than 100 establishments across Europe, including refrigerators used by French blood banks.
Both sides, in their own words
Both sides heard. Neither believed for free. Publishing a side's version is not endorsing it — the claim checks below are where verdicts live.
Side A · France — the foreign ministry, security agencies and prosecutors
- Foreign Minister Jean-Noël Barrot: responsibility for the attack lies with Iran's Islamic Revolutionary Guard Corps; it was unprecedented in scale and aggression and the first large-scale act of sabotage on French territory.
- The joint agency report: the Guards-linked unit Shahid Kaveh carried out the campaign through front groups, and 700 commercial sites were targeted, with at least 15 fires.
- Paris prosecutors have opened an investigation into the unit's head and his two deputies and requested international arrest warrants.
Side B · Iran
- Iran's mission to the United Nations did not return messages seeking comment on the French attribution.
- Iran routinely denies carrying out malicious cyber operations.
Independently verified
7 claims independently verified — listed in the claim-by-claim check below.Not yet verified
Nothing outstanding.What we know / what we don't know yet
What we know
- That France has publicly attributed the attacks to the Revolutionary Guards and its Shahid Kaveh unit, and the measures it says it is taking.
- The French report's figures: about 700 sites targeted on 11 October and at least 15 fires.
What we don't know yet
- Iran's response to the attribution — none had been given in the reporting read.
- The technical evidence behind the attribution — France has not published it.
- Whether the same unit carried out this month's second wave of hacking across Europe.
Show more (1)
- Whether the requested arrest warrants will be issued, and what sanctions the European Union will adopt.
Claim by claim
Show all claims (7)
Why this label: Barrot's words are the French government's own public attribution, made on the sidelines of the G7 foreign ministers' meeting in Paris and reported in the same terms by Reuters and CNN. The attribution itself is France's finding, based on evidence France has not published; it is verified here as France's stated position and conclusion, and Iran's response is carried separately.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: The unit, the named men, the front groups and the linking method are the French agencies' report as reported in full by Reuters. The three men are named as alleged associates in an investigation; none has been convicted.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: The date, the 700 sites, the fires and the effects are the French report's figures as reported by Reuters; the cost figure is one supermarket owner's estimate, carried as an estimate.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: The investigation is the prosecutor's own statement, reported by Reuters, CNN and TechCrunch; the warrant request is Reuters' report of the prosecutors' statement.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: The summons and the sanctions promise are Barrot's own statements, reported by Reuters and CNN in the same terms.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: The second wave and the blood-bank impact are reported by Reuters, with TechCrunch reporting the blood-service detail in the same terms. Whether the same unit carried out the second wave has not been stated in the reporting read.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: The non-response and the standing denial are Reuters' reporting; no Iranian statement on this attribution had been published in the reporting read.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why it matters
A state publicly blaming another state's military for physical sabotage of civilian food supplies — and answering with sanctions and arrest warrants — is an escalation of the Iran war onto European soil by other means. France's evidence has not been published, so the attribution now stands as a test of how much of it allies and courts accept.
Background
Hackers take control of supermarket refrigeration and freezer systems across France, raising temperatures; at least 15 fires break out and large amounts of food spoil.
A second wave of similar hacking hits more than 100 establishments across Europe and affects refrigerators used by French blood banks.
France publicly blames Iran's Revolutionary Guards; the ambassador is summoned, sanctions are promised, and prosecutors open an investigation into the Shahid Kaveh unit's leaders.
Update history
No silent edits. Every change is written here, with its time.
- Latest
Published in Checking state — France's attribution and investigation are on the record, and Iran's response is still awaited.