Pirate refrigerators: France accuses Iran and announces a European response

On 9 November 2026, France accused the Iranian Revolutionary Guards of orchestrating cyber attacks on French refrigeration facilities in October. Jean-Noel Barrot announces the convening of the Iranian ambassador and a European response. Reuters, BBC and Deutsche Welle report the same official attribution: Paris designates the cyber-offensive unit Shahid Kaveh, while justice investigates its alleged perpetrators. [S1] [S2] [S3]

Digital sabotage with material consequences

On the night of October 11-12, the attackers compromised refrigeration monitors and changed their de-icing parameters to impose high temperatures, explains the report of the Cyber Crisis Coordination Centre, which includes the National Intelligence Service and the National Intelligence Service. It identifies approximately 700 targeted large distribution sites and at least 15 fire starts. Small butchers, a slaughterhouse and agri-food plants are also among the known victims. [S8]

Employees had to evacuate boxes of damaged meat and melted ice, Reuters reports. The Quai d'Orsay estimates food losses at tens of millions of euros, without publishing detailed breakdown. For traders, damage therefore combines destruction of goods and material damage, well beyond a computer interruption. [S1] [S7]

Counts per sign are not stabilized: BBC documentation mentions 180 affected Intermarket and Netto stores, compared to at least 300 in Al Jazeera's article. These figures should not be added together. The national perimeter itself is formulated as "approximately 700 sites" in the technical report and "more than 700" in the diplomatic declaration. [S2] [S6] [S7] [S8]

Published indices, a responsibility still under judicial scrutiny

The French allocation is based on an "indice cluster", according to the technical report published on 9 November. The services cite an infrastructure also used to recognize other industrial equipment, methods and a research tool already associated with Shahid Kaveh, the relay of the attack through a propaganda channel linked to this unit and traces of Farsi in the offensive infrastructure. It is therefore not a public accusation based solely on the language used. [S8]

This report provides elements that did not appear in some early media presentations. The claim that Paris would not have provided any technical explanation must therefore be nuanced: evidence is now public, but it constitutes an analysis of the French services, not a judicial decision establishing the guilt of the persons concerned. [S2] [S8]

The Paris prosecutor, Laure Beccuau, announced a judicial investigation against Shahid Kaveh's chief, his two deputies and any other person who could be identified. The prosecution requested international arrest warrants, reports Reuters and Al Jazeera. These applications are neither valid for the confirmed issuance of warrants nor for the conviction. Requested by Reuters, the Iranian mission to the United Nations had not responded at the time of publication. [S1] [S3] [S6]

Do not confuse the different waves

At the beginning of November, other attacks hit refrigeration facilities in several European countries. The BBC states that the link with the French episode of October is not established. The similarities between the targets therefore do not automatically allow all these incidents to be attributed to the same sponsor. [S2]

Information about French blood reserves also diverges: Reuters reports that refrigerators have been affected, requiring the transfer of certain reserves, while Deutsche Welle refers to an attempted hacking. These descriptions do not allow a common assessment to be established, nor do they lead to a loss of blood products. [S1] [S3]

Sanction authors, protect operators

The Ministry of Foreign Affairs announces that it will propose new European sanctions against individuals and entities involved. It also reserves additional measures, public or non-public, which it presents as "necessary and proportionate". These are French commitments, not new European sanctions already adopted. Their content remains indispensable to assess their scope and proportionality. [S7]

The responsibility for sabotage must be distinguished from that for securing equipment. According to Reuters, the manufacturer of many affected units reports that some were obsolete or used old firmware, which could have facilitated intrusions. This is not enough to establish an individual fault of a trader, manufacturer or provider: maintenance obligations and remote access conditions remain to be examined. [S1]

For operators and their employees, the diplomatic response does not regulate compensation for damages. The advertisements consulted do not specify insurance coverage or a specific compensation mechanism. The purpose of the survey is to identify those responsible; financing of material consequences remains a separate question at this stage and without a detailed answer. [S1] [S7]