France on Monday blamed Iran for last month’s massive cyberattack on supermarket fridges, summoned the Iranian ambassador and said it would seek European sanctions against those responsible. The change from where suspicion first pointed reflects both the evidence investigators say they found and the wider geopolitical backdrop.
When the attack hit on October 11-12, suspicion fell almost immediately on Russia, according to AFP. Part of the reason was France’s recent experience. French and other European officials have long accused Moscow of running a “hybrid warfare” campaign to sow division and undermine support for Ukraine. In December 2025, a pro-Russian hacking group claimed responsibility for an attack that halted deliveries by France’s postal service.
I found no report of the French government formally accusing Russia over the fridge attack. The early blame appears to have come from public and media speculation. Reports note that Moscow denied involvement.
What changed
Paris prosecutor Laure Beccuau said investigators found the attackers had used Farsi and IP addresses linked to devices located in Iran. France’s cybersecurity agency, ANSSI, attributed the attack to the Shahid Kaveh group, described as a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. Prosecutors said the hack bore the unit’s signature and relied on Persian-language tooling.
Foreign Minister Jean-Noël Barrot said he could confirm the attack was carried out by Iran’s Islamic Revolutionary Guard Corps, calling it an attack of unprecedented scale and aggressiveness. Paris has requested international arrest warrants against the unit’s leader and his two deputies. A judicial investigation was opened on suspicion that the attack was committed to serve the interests of a foreign power, in this case Iran.
The wider context
The attribution comes amid the US-Israel war with Iran, which began in February. French officials linked the attacks to pro-Iranian hacktivists working for Tehran, likely in response to that war. NPR reported that suspected Iranian hackers had earlier claimed a sabotage of an Israeli food processing plant, and published a video with a French-language taunt just before the French attacks. A US military commissary fridge failure in August is also being treated by the Pentagon as a suspected cyberattack, with Iran among the suspects.
Iran has yet to respond to the accusations. A second wave of attacks struck supermarkets in other European countries last week, and it remains unclear whether the two waves are related and who carried out the second. The attribution rests on the French government’s findings, which have not been independently verified in the reports reviewed.
