Reporting snapshot · 10 November 2026 (Asia/Karachi). France announced the attribution on 9 November but has not published the intelligence behind it, and Iran has not responded formally. The link between the French attacks and the later incidents in other European countries is not established.
What happened
France accused Iran’s Islamic Revolutionary Guard Corps on 9 November of carrying out the cyberattacks that raised temperatures in supermarket fridges and freezers across France in October, prompting a criminal investigation and a promise of European sanctions.
Foreign Minister Jean-Noël Barrot said the attack was “unprecedented in both its scale and its level of aggression” and amounted to “a major attack on the nation’s interests and the security of the French people”, the BBC reported. He said Iran’s ambassador had been summoned to receive “a very strong protest” and those responsible would face sanctions, the Guardian reported. Barrot promised “Europe-wide sanctions” and said Paris would take “any other necessary and proportionate measures”.
The same day, Paris public prosecutor Laure Beccuau said she had opened an investigation into the head of Shahid Kaveh, a cyber unit linked to the IRGC, his two deputies and others yet to be identified. The probe covers “fraudulent attacks on an automated data processing system committed as part of an organised crime ring” and “causing damage dangerous to persons”, offences the prosecutor said were aggravated by being committed for a foreign power, the Guardian reported.
The hackers struck on 11 and 12 October, taking control of supermarket refrigeration software. More than 100 Coopérative U stores and 180 Intermarché and Netto outlets were affected, the BBC reported, and as many as 700 shops across France reported problems, according to the Guardian. Temperatures rose above 50C (122F) in some stores and food was destroyed, the Guardian reported, while Reuters reported that some units caught fire.
A second wave in early November hit more than 100 stores in seven European countries and cold stores used by France’s blood service. It is not known whether the incidents are linked, the BBC reported.
How investigators built the case
The French case rested on technical traces and the unit’s known methods. Beccuau said investigators had identified a “modus operandi” characteristic of Shahid Kaveh, including “the use of Farsi and IP addresses traced back to devices located in Iran”, the Guardian reported. Shahid Kaveh is described as an offensive cyber unit affiliated with the IRGC’s electronic and cyber centre.
Gérôme Billois, a partner at the cybersecurity consultancy Wavestone, told the Guardian that Shahid Kaveh had been active since 2020 and was known mainly for attacks on water distribution systems in the United States. “For the moment they are attacking easy equipment, but as a state group that has the means, the determination and the time, we should be prepared to see attacks on other systems like water or electricity,” he said.
The technical path was mundane. The refrigeration systems were managed remotely through software supplied by Danish engineering firm Danfoss, the BBC reported. Some units were obsolete or running outdated firmware, Reuters reported, and experts said the attackers appeared to have exploited default passwords, the Guardian reported. Rafe Pilling of the cybersecurity firm Sophos told the Guardian that the attacks “were not particularly complex”.
France has not published the intelligence behind its attribution. The BBC noted that governments rarely do, because attribution is difficult and hackers can disguise their location. Iran’s mission to the United Nations did not respond to requests for comment, Reuters reported, while some Iranian media outlets dismissed the allegations as baseless. Tehran has routinely denied carrying out malicious cyber operations.
Why it matters
The French statement is the first formal attribution of this type, implicating a state in a destructive cyberattack on civilian food infrastructure. It marks how the Iran war, which began in February, has widened beyond military targets into civilian supply systems.
The immediate effects were commercial and physical. Supermarkets threw away tons of meat, dairy and frozen food, and some refrigeration units overheated and caught fires. One French supermarket owner estimated the nationwide cost at tens of millions of euros, Reuters reported.
The political consequences are still taking shape. The European Union designated the IRGC a terrorist organisation in January, the Guardian reported. The EU’s foreign policy chief, Kaja Kallas, said the bloc’s foreign affairs council would discuss the incident the following Monday, and that attribution to Iran would call for “a strong response”.
The case also exposes a less dramatic problem. The affected equipment was ordinary commercial refrigeration, connected to the internet so that retailers could monitor temperatures and troubleshoot remotely. That convenience created a path into physical equipment with no direct connection to the war. Reuters reported that cyber incidents during the conflict have also targeted the Los Angeles transit system, US water treatment plants and ships bound for the United States. Refrigeration malfunctions at several US military bases in August are being investigated as possible deliberate attacks, the BBC reported, citing Reuters.
The conflict has already produced developments that reach this region, including the US strikes on Iran’s Qeshm Island this month that KhabarWire reported here. The fridge attack adds a civilian dimension that is easier to copy than a military cyber operation.
What it means for Pakistan
No Pakistani institution has been accused of involvement in the French attacks, and no Pakistani facility has been publicly identified as a victim of a similar operation.
On 5 November, Pakistan’s National Cyber Emergency Response Team issued an advisory that cited the European refrigeration attacks as an example of how a digital intrusion can have physical and commercial consequences. It warned that weaknesses at third-party service providers, connected internet-of-things devices and industrial control systems could expose oil and gas facilities, water utilities, power generation, manufacturing plants and transport systems. KhabarWire reported the advisory in detail.
The weaknesses identified in France — remote access to temperature controllers, default passwords and outdated firmware — are general to networked cooling systems, not specific to France. Where Pakistani cold stores, food processors, pharmacies or blood banks manage refrigeration over the internet, the same failures can apply. There is no public inventory of how many such systems are exposed, and no confirmed Pakistani incident of this kind, so the scale of the risk remains unknown.
Pakistan’s cyber enforcement has concentrated on fraud and call-centre scams, including the National Cyber Crime Investigation Agency’s raid on a Karachi call centre this month that KhabarWire covered here. The French case points to a different harm: sabotage that does not steal data or money but damages equipment and disrupts the food supply. The practical implication is that guidance for critical infrastructure has to reach the operators of ordinary commercial equipment, not only banks and utilities.
What is still uncertain
Iran has not responded officially. Its UN mission did not comment to Reuters, and some Iranian outlets have rejected the allegation. That leaves open whether Tehran will treat the French move as a diplomatic signal, a legal challenge or grounds for retaliation.
France has not published the technical evidence behind the attribution. The prosecutor’s case describes a method and traces, but no court has tested the claim, and the investigation has not produced a conviction. Attribution is a judgment about probability, not a fact proved by a single log file.
It is unclear whether the October attack and the November wave across Europe are part of the same campaign. The blood-service incident has not been formally linked to either. Investigators have not said whether the operation was ordered by the IRGC’s leadership or carried out with some autonomy by the Shahid Kaveh unit.
The sanctions are still a promise. The EU foreign affairs council was due to discuss the issue, but the scope and timing of any measures have not been announced. France has said it will take further steps without saying what they are.
For Pakistan, the 5 November advisory did not name an affected institution or confirm any incident. It is not public whether regulators have ordered audits of connected cooling or industrial systems, or whether operators have changed default credentials and remote-access settings since the warning.
What happens next
The French investigation will test whether the prosecutor’s evidence can support a case against named individuals in a unit that operates outside France. The EU will decide whether the attribution translates into new sanctions, and how quickly.
For retailers and cold-chain operators, the test is whether internet-exposed controllers are taken off the public network, default passwords replaced and obsolete units isolated. The French attacks showed that those steps matter even when the target is not a bank or a power plant.
