Cyber attack on supermarket fridges: Iran rejects French accusations

On Tuesday, November 10, 2026, Iran rejected France's "unfounded and unilateral accusations" about the cyberattack that hit the cold-water facilities of hundreds of supermarkets on the night of October 11-12. The day before, Paris had officially attributed this sabotage to Shahid Kaveh, a cyber-offensive unit affiliated with the Revolutionary Guards. The Iranian ambassador was received on Tuesday at the Quai d'Orsay, who expressed his "highest protest". [S4] [S33]

Computer sabotage with material consequences

Behind the term "connected refrigerators", the attack concerned refrigeration controllers deployed at about 700 sites in the French large distribution. According to the Paris Public Prosecutor's Office, cited by RFI and franceinfo, pirates took control of equipment remotely via their web interfaces. They triggered abnormal de-icing cycles, without time limits, while disabling temperature probe alarms. The marks Danfoss and Dixell are mentioned in particular. [S20] [S26]

The damage is therefore not limited to an interruption of service: lost goods, damage to property and fire departures are reported. The Quai d'Orsay estimates food losses at tens of millions of euros, without detailing its calculation. Fire reports differ: Blick reports at least 15 fire starts according to the French security services, while RFI quotes about 20 according to the Paris prosecutor. These formulations do not allow a final count to be established. [S33] [S4] [S20]

For traders, the question remains of taking over losses. The sources consulted do not specify the compensation or its final distribution. The Express reports that some equipment was out of date or used unupdated software. However, this finding is not sufficient to establish a legal fault of the operators, manufacturers or suppliers whose respective responsibilities are not determined in this information. [S21] [S33]

The French indices against the Iranian denial

The French allocation is based on the judicial investigations and the work of the Cyber Crisis Coordination Centre, which brings together, among other things, the intelligence services and the command of cyber defence. CERT-FR published a presentation of this work on 9 November. According to the Prosecutor's Office, the investigators noted a procedure characteristic of the unit concerned, traces of the use of Farsi and IP addresses referring to terminals in Iran. The authorities thus have a cluster of clues, not an isolated element. [S34] [S20]

Tehran challenges this assignment and asserts that it will take the necessary measures to safeguard its interests and security in the face of foreign activities which it calls illegal. The excerpts from his press release reported by Blick do not present a detailed technical refutation of the elements advanced by Paris. This denial remains the official Iranian position; The French accusation, even if stated publicly, does not constitute a criminal conviction of the persons involved. [S4] [S20]

Judicial information is aimed at Shahid Kaveh's chief and his two deputies. It deals with computer attacks and dangerous damage to organized bands, aggravated by the alleged use of foreign power. International arrest warrants were required. Europe 1 presents them as already issued, but the RFI and franceinfo reports do not confirm this step: request from the public prosecutor and actual issuance must remain distinguished. [S20] [S26] [S5]

An announced response, not yet fully defined

Jean-Noël Barrot states that France "does not forbid anything". The Minister for Foreign Affairs refers to bans on entry into European territory and to freezing of assets. The official declaration states, however, that Paris will propose new sanctions to its partners, without announcing their adoption. The European Union stands ready for a "quick and united" response, pending discussions between Member States. [S16] [S33] [S11]

The Minister is also considering non-public measures, presented as necessary and proportionate to punish perpetrators and deter further attacks. These statements do not confirm the execution of a computer counterattack. In terms of analysis, this confidentiality limits the public assessment of proportionality: without knowing the targets and the effects of the response, its consequences for those who may be affected cannot be assessed. [S8] [S33]

Do not attribute all attacks to the same perpetrator

The attribution concerns the sabotage of October in the large French distribution. It does not automatically impute to Iran subsequent incidents in other European countries or to the French Blood Establishment. The general manager of l'Anssi, quoted by franceinfo, points out that a similar procedure is not enough to identify the same attacker. On Tuesday, Jean-Noël Barrot also refused to comment on the attacks on an EFS refrigeration provider, Crédit Mutuel Arkéa and the Directorate of Public Finance, with investigations still under way. [S26] [S12]