Paris alone names Iran’s Guards over fridge sabotage as Reuters counts nine other European countries hit

Full analysis

What happened Why it matters How each country tells it Where accounts conflict Room for disagreement Our assessment Sources and evidence

What happened

On Monday, November 9, France’s Foreign Ministry formally accused the Islamic Republic of Iran of the cyberattack that, on the night of October 11 to 12, took control of refrigeration systems in hundreds of French supermarkets. The communiqué, quoted by L’Opinion, named Shahid Kaveh, a cyber unit linked to the Revolutionary Guards. It said the attacks caused considerable material damage, fires and food losses "estimées à plusieurs dizaines de millions d’euros." It called them the first cyber-offensive campaign on French soil run purely for sabotage, and it announced European sanctions. Reuters, in copy carried by the Moscow station Business FM, reports that Foreign Minister Jean-Noël Barrot threatened Tehran with EU-level sanctions and that an Iranian envoy was summoned the same day. TIB reported on November 9 that the Paris prosecutor had also opened a judicial investigation against Shahid Kaveh’s chief and two deputies and was seeking arrest warrants.

The method was crude and physical. According to Reuters, the attackers seized control of the refrigeration units and switched them to defrost. In some cases they heated the chambers above 50 degrees Celsius, spoiling everything inside. Reuters adds that hackers also broke into refrigerators of the French blood service. Hilal al-Obaidi, a researcher at the European Center speaking to Sky News Arabia in material carried by the Lebanese site Tayyar.org, put the toll at about 700 large stores and roughly 15 fires. That is an analyst’s count, not a figure from the French government.

On the evidence, NRC reports that Barrot pointed to technical indicators found by French investigators, among them Iranian IP addresses used in the attack. Al-Obaidi went further. He said the investigation rests on servers, identifiers and accounts using names such as "Cyber Avengers," "Hydro Kitten" and "Storm 784." No other source ties those personas to the French file. L’Opinion noted the surprise of the attribution itself, because Russia, the usual suspect in French cyber incidents, was not the one named.

Tehran answered on Tuesday. NRC reports that Foreign Minister Abbas Araghchi rejected the accusations as "unfounded" and "one-sided." Writing on X, he said the French government cannot manage refrigerators, let alone its population’s grievances, and is shifting the blame for its own failures onto others. The Armenian outlet 1in.am made Araghchi’s response its headline.

France was not the only country hit. NRC lists Belgium, Ireland, Sweden, Estonia and the Netherlands as places where cooling systems were hacked in recent weeks, and reports that intelligence services there have named no culprit. Reuters’ list is longer: those five plus Luxembourg, Finland, Italy and Portugal, nine countries beyond France. The two lists reconcile, since NRC’s five all appear among Reuters’ nine.

The backdrop is the war between Iran and the United States and Israel. NRC recounts that strikes by those two countries in February killed senior Iranian officials, including Supreme Leader Ali Khamenei, and that Iran retaliated against regional allies such as the United Arab Emirates. France at first kept its distance from the strikes. After an Iranian drone hit Cyprus in March, it sent the aircraft carrier Charles de Gaulle to the eastern Mediterranean. In September, Emmanuel Macron sent troops and air defenses to Saudi Arabia to protect energy infrastructure. NRC also points to the March wiper attack on the U.S. medical firm Stryker, claimed by the Iran-linked group Handala, as evidence of a wartime rise in Iranian cyber operations.

Why it matters

By France’s own description, this is a new category of attack on its territory: sabotage with no espionage motive, aimed at the food chain rather than at a hardened state target. Rafe Pilling of Sophos, quoted by NRC from the Financial Times, said the value lies in the signal as much as the damage. Disrupting refrigeration, he said, is very visible, has tangible consequences and can potentially be done at scale.

Peyman Jafari of the College of William & Mary gave NRC the strategic logic. As he describes Tehran’s view, Washington wants the Iranian economy hit so hard that people cannot buy bread, and Iran’s answer is that it can cause chaos in other countries too. In that reading, European grocery shelves become a way to press Washington. The attribution also feeds a campaign Paris was already running, since NRC notes France leads the push inside the EU for tougher sanctions on Tehran. Sanctions at EU level, however, need partners whose own investigations have so far named no one.

How each country tells it

• 🇫🇷
  L’Opinion · France · original reporting

  Explains how and why Paris named Iran. It quotes the Foreign Ministry’s November 9 communiqué calling the October 11-12 attacks the first cyber-offensive campaign on French soil conducted purely for sabotage, and notes the surprise that Russia, the usual suspect, was not the culprit.
• 🇦🇲
  1in.am · Armenia

  Its headline makes Iranian Foreign Minister Araghchi’s response to the French charge the news.
• 🇳🇱
  NRC · Netherlands · original reporting

  Asks what Tehran would gain. It reports that Barrot cited Iranian IP addresses among the technical indicators, carries Araghchi’s mocking denial, and quotes an Iran scholar who calls Iranian responsibility plausible but unproven.
• 🇷🇺
  Business FM · Russia · carries Reuters

  Under a flat ‘France accused Iran of attacks on refrigerators’ headline, it relays Reuters: Barrot blames the Revolutionary Guards, Iran’s chargé d’affaires was summoned on November 9, and EU-level sanctions were threatened.
• 🇱🇧
  Tayyar.org · Lebanon · carries Sky News Arabia

  Carries two analysts speaking to Sky News Arabia. They put the attack at about 700 large stores and roughly 15 fires, name hacker personas ‘Cyber Avengers,’ ‘Hydro Kitten’ and ‘Storm 784,’ and cast Iran as running a ‘fifth column’ of cells inside Europe and Britain.

Where accounts conflict

The central dispute is who did it. The French government, through the communiqué and Barrot, names the Revolutionary Guards’ Shahid Kaveh unit and cites technical indicators, including Iranian IP addresses. Araghchi calls the charge unfounded and one-sided and offers no counter-evidence beyond the claim that France is covering its own failures. Neither side’s material, as reported, has been published for outside examination.

A smaller discrepancy concerns who was summoned. NRC reports that France summoned the Iranian ambassador. Reuters, via Business FM, says it was Iran’s chargé d’affaires. The difference matters because it sets the diplomatic level at which Paris chose to protest.

Room for disagreement

The strongest case that this becomes a European accusation rests on the pattern. Nine countries reported the same kind of intrusion within weeks of the French attack. Pilling says Iranian state-backed groups routinely exploit weak or default passwords on internet-facing systems, which is exactly the access a single campaign could reuse from Helsinki to Lisbon. Jafari says Iran’s anger is aimed at Europe broadly, because American aircraft took off from European bases to bomb Iran. Al-Obaidi cites the head of Britain’s MI5 describing 50 arrests this year in Iran-linked cases. France also moved from attack to attribution in under a month, so the other governments may simply be slower rather than unconvinced.