France names Iran’s Guards for fridge sabotage and vows sanctions; Kallas’s “strong” EU response surfaces only in Arab News

Full analysis

What happened Why it matters How each country tells it Room for disagreement Our assessment Sources and evidence

What happened

On the night of October 11 to 12, hackers entered the refrigeration control systems of French supermarkets and turned the country’s cold chain against it. They forced the units into continuous defrost and pushed temperatures up until fridges and freezers reached around 50°C in some stores; NOS puts the number of affected supermarkets at about 700, a figure Arab News and the Hindustan Times carry as well, while RTL says hundreds. Chains including Intermarché and E.Leclerc had to throw away stock (NOS). In Paris, workers binned spoiled meat and melted ice cream, and some refrigeration units heated so far they caught fire (Hindustan Times); the Hindustan Times reports the exposure lasted around six hours. RTL names the units’ maker as the Danish firm Danfoss.

On Monday November 9, Paris prosecutor Laure Beccuau opened a judicial investigation against the head of the Shahid Kaveh group, an offensive cyber unit affiliated with the Electronic and Cyber Center of Iran’s Islamic Revolutionary Guard Corps, his two deputies, and any other person who may be identified. RTL lists the offences as fraudulent access to an automated data-processing system in an organised gang and degradation by a dangerous means in an organised gang, both aggravated by having been committed to serve a foreign power — Iran — plus criminal association. RTL and Daily Sabah both report that arrest warrants are being sought; Daily Sabah specifies international arrest warrants. The investigation is a joint effort by France’s anti-cybercrime office OFAC and the DGSI domestic intelligence service (RTL). The prosecutor’s case rests on IP addresses tracing to devices in Iran, use of Farsi, and a modus operandi characteristic of the unit (RTL, NOS).

Foreign minister Jean-Noël Barrot moved from investigation to accusation the same day. "I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran," he said, in wording carried by Arab News and the Hindustan Times. Barrot called the attack unprecedented in scale and aggression, the first large-scale sabotage cyberattack on French soil and a major attack on the nation’s security, and vowed to implement sanctions at the European level and summon the Iranian ambassador to lodge a very strong protest (RTL, NOS, Arab News, Hindustan Times). Arab News notes Barrot put the French target count at 700 sites.

The French attack was not isolated. NOS reports that at the start of this month unknown attackers hit cooling systems at companies in the Netherlands, Belgium, Luxembourg and Sweden, with at least seventeen Dutch businesses affected — butcheries and neighbourhood shops among them — though large Dutch supermarkets escaped. In Belgium, dozens of supermarkets including Carrefour and Delhaize were sabotaged, and a butcher in Hove put his damage in the tens of thousands of euros (NOS). Arab News reports that on November 2 grocery stores across at least nine other European countries were hit. The Hindustan Times describes a later wave this month affecting more than 100 establishments across Europe and disrupting refrigeration at French blood banks, forcing staff to move blood supplies. Daily Sabah names Britain, Germany, Italy and Portugal among the countries reporting similar attacks. Tehran had not responded to France’s allegations as of the Hindustan Times’s filing.

Why it matters

Each outlet frames the event differently. RTL, France’s own broadcaster, treats the attribution as established legal fact and leads on the court file, not the diplomatic row: the investigation, the named unit, the exact charges. It is the only source quoting Barrot calling this the first large-scale sabotage cyberattack on French soil. The Dutch NOS keeps its distance in the headline — "France thinks Iran was behind the attack" — attributes the claim to French outlets BFM and France24, and brings the story home with the seventeen Dutch businesses hit and the Belgian butcher’s losses. Turkey’s Daily Sabah never uses the verb "accuses" at all: it says France "probes Iran-linked cyberattacks," credits the IRGC finding explicitly to Le Figaro, and casts the episode as a warning about vulnerable commercial infrastructure. Saudi Arabia’s Arab News states the IRGC attribution as settled and adds the one line no other outlet carries — EU foreign policy chief Kaja Kallas, speaking after Barrot, saying "our response should be strong." The Hindustan Times reads it as an infrastructure-warfare template, with the set’s most technical detail: outdated firmware left units vulnerable, some caught fire, and the second European wave touched French blood banks.

How each country tells it

• 🇫🇷
  RTL · France · original reporting

  France’s own domestic press treating the attribution as established legal fact, leading with the judicial investigation opened against the Shahid Kaveh chief rather than the diplomatic row.
• 🇳🇱
  NOS · Netherlands · carries BFM TV and France24

  The hedged European-ally reading that frames attribution as France’s belief under investigation, while adding the attack’s fallout at home — at least seventeen Dutch businesses hit.
• 🇹🇷
  Daily Sabah · Turkey · carries Le Figaro

  A carefully distanced reading that keeps the link loose — ‘probes’, ‘Iran-linked’ — and casts the episode as a warning about vulnerable commercial infrastructure.
• 🇸🇦
  Arab News · Saudi Arabia · wire copy

  The Gulf reading that states the IRGC attribution as settled fact and adds the EU-level response via Kaja Kallas.
• 🇮🇳
  Hindustan Times · India · wire copy

  An infrastructure-warfare reading from a non-aligned capital, presenting an ‘unprecedented’ strike on critical infrastructure as a template for future attacks.

Room for disagreement

The strongest case against reading this as a settled escalation is that France’s attribution rests on indicators — IP addresses, language, modus operandi — that Iran can dismiss as circumstantial without producing anything. Tehran’s silence, noted only by the Hindustan Times, leaves that denial unwritten but available. More telling is the hedging outside France’s own press: Daily Sabah, a state-linked Turkish daily and Iran’s neighbour, refuses to write that France accuses anyone, keeping the link at "Iran-linked" and sourcing the IRGC finding to Le Figaro rather than the prosecutor. If a second EU member state were to view the evidence the same way, the European-level sanctions Barrot promised could stall into a French solo measure, and the episode would read as a contested attribution rather than an established fact.