France Accuses Iran of Hacking 700 Food Stores

The French government formally attributed a series of destructive cyberattacks to Iranian military hackers on November 9, 2026.

The National Cybersecurity Agency, known as ANSSI, stated that actors linked to the Islamic Revolutionary Guard Corps gained control of refrigeration controllers at roughly 700 retail sites. These locations included supermarkets and butcher shops. The intruders increased the temperature settings during the night, causing the spoilage of food valued in the millions of dollars. The campaign also affected several small hydroelectric power plants, leading to moderate disruptions in operations.

Jean-Noel Barrot, the French Foreign Minister, characterized the incident as the first large-scale cyberattack designed for sabotage on French soil. He described the event as a major strike against national interests and public security. The Paris Prosecutor's Office has opened a criminal investigation into the Iranian cyber unit Shahid Kaveh. Prosecutors are currently seeking international arrest warrants for the group.

These attacks align with a pattern of targeting refrigeration systems across multiple continents in 2026. Similar disruptions occurred in Europe, Israel, and the United States. Grocery stores in Sweden and Ireland reported issues last week. In France, staff at a major blood bank had to manually save samples from heating up after a system compromise. The incident has prompted calls for the health sector to improve protection for critical biological products.

ANSSI officials identified the hackers through digital traces, including specific infrastructure, links to a propaganda outlet, and Farsi language code fragments. U.S. officials suspect Iran of the August attacks on military bases, though the Pentagon has not issued an official statement. A spokesperson for the Department of War Office of the Inspector General said the Criminal Investigative Service does not discuss ongoing cases. Iran has not yet responded to the French accusations.

Cybersecurity experts noted that the tactics fit the known strategy of Iranian hacking groups. Alex Orleans, head of threat intelligence at Sublime Security, said the Revolutionary Guard Corps likely aims to reassert power through disruptive operations. He observed that Shahid Kaveh is repeating a pattern seen in earlier attacks on American water treatment plants. Ari Ben Am, an adjunct fellow at the Foundation for the Defense of Democracies, described Shahid Kaveh as an offensive unit responsible for major operations. He pointed to the linked group Cyber Av3ngers, which the U.S. tied to attacks on Israeli-made systems in U.S. water facilities between 2023 and 2024. France also cited previous IRGC attacks on Charlie Hebdo and digital kiosks at the 2024 Paris Olympics.

Experts cited long-standing difficulties in securing operational technology that controls physical processes like cooling. These machines are often outdated, hard to patch without service disruption, and exposed to the internet for vendor maintenance. During a G7 meeting in Paris on Monday, Secretary of State Marco Rubio declined to comment on information sharing. He described the attackers as individuals who target refrigerators and said the news did not surprise him given the ongoing conflict between the U.S. and Iran.