France names an IRGC cyber unit for the supermarket fridge sabotage, and reaches for EU sanctions

France’s national cybersecurity agency ANSSI attributed the 12 October operation to a group it calls Shahid Kaveh, described as a cyber unit affiliated with the Islamic Revolutionary Guard Corps, and said it had separately attributed other attacks on France since 2020 to a second IRGC-linked group, Shahid Shoostari. Roughly 700 of France’s approximately 10,000 supermarkets were affected, including stores of Intermarché, Coopérative U and Leclerc; BFMTV reported the attackers connected remotely to refrigerators and freezers and raised temperatures by switching on defrost cycles. Foreign Minister Jean-Noël Barrot called it “an attack of unprecedented scale and aggressiveness” and “the first large-scale cyberattack aimed at sabotage on French soil,” and said France would “impose sanctions at the European level against all those responsible.” Iran’s Foreign Ministry rejected the accusation on 10 November as “baseless and hostile,” saying it was “intended to divert public opinion from France’s destructive policies toward Iran.”

Paris prosecutor Laure Beccuau opened a formal judicial investigation on 9 November into suspected organised cybercrime with the aggravating circumstance of “having been committed to serve the interests of a foreign power — in this case, Iran.” Investigators found the attackers used Farsi and IP addresses linked to devices located in Iran. Two figures in circulation need marking. The “tens of millions of euros” of single-day losses reported by AP is Intermarché's own estimate, a company self-report rather than an audited loss. A count of around 20 fires linked to the refrigeration failures appears in cybernews and in none of the AP, CNN or PBS copy we reviewed; this desk is not carrying it. Qz reports prosecutors are seeking international arrest warrants, and a cybernews subhead refers to three identified Iranians, but no names or primary prosecutor’s document have been obtained.

Assessment: The load-bearing weakness is not the evidence but who has seen it. ANSSI’s technical work has not been independently reviewed, and cybernews relays a 9 November X post by New York Times reporter Dustin Volz, citing three sources, saying US agencies hold a low-confidence assessment of Iranian responsibility — an aggregator’s account of a social-media post citing anonymous sources, two removes from primary, and worth nothing until the underlying NYT piece lands. If it holds, France has made a hard public attribution and asked the Council for sanctions on evidence its closest partners rate low-confidence. Watch which member states co-sponsor a listing, and the Danfoss and Dixell patch state in Gulf retail.