France investigates the possible involvement of Iran’s Islamic Revolutionary Guard in the cyberattacks that affected the refrigeration systems of hundreds of European supermarkets during the month of October. French intelligence services suspect that Tehran-backed hackers could be behind an operation that made it possible to remotely tamper with the temperatures of cold-storage rooms and freezers, causing million-euro losses of food and material damage in numerous establishments. The investigation now focuses on determining whether the attack was carried out by a cyber unit linked to the Iranian regime.
As reported by Reuters this Monday, November 9, citing two sources familiar with the investigations, French authorities believe there is evidence of the involvement of Iran-backed computer groups. For its part, information attributed to sources close to the probes and gathered by Le Figaro points specifically to Shahid Kaveh, an organization of cyber operations related to Iran’s Islamic Revolutionary Guard. However, the attribution has not yet been formally made public through an official communication that would allow the group’s responsibility to be considered proven.
The Paris Prosecutor’s Office investigates a group linked to Iran’s Islamic Revolutionary Guard
The investigation is being carried out by the Paris Prosecutor’s Office, through its units specialized in cybercrime. Among the main hypotheses is the involvement of Shahid Kaveh, an organization cited for its alleged connection to the offensive capabilities of Iran’s Islamic Revolutionary Guard.
According to the information published about the investigations, investigators are examining the possible responsibility of the group’s leaders and of other participants who may be identified. Reports have also been made of the issuance of international arrest warrants against officials of the organization, although this point has not been independently confirmed through publicly available judicial documentation.
The Iranian lead represents a new step forward in investigations that, until now, had not allowed anyone to determine publicly who was behind the attacks. In October, the French Prosecutor’s Office confirmed the opening of proceedings to identify those responsible and assess the damage, while the National Agency for the Security of Information Systems of France (ANSSI) began analyzing the vulnerabilities exploited by cybercriminals.
For the moment, the Iranian authorities have not recognized any involvement in these events. The investigation remains open and must determine both who authored the intrusions and the possible existence of coordination among the attacks recorded in different European countries.
How were the cyberattacks against European supermarkets carried out
The first major wave occurred overnight from October 11 to 12, when the attackers managed to access remotely the systems that regulate the temperature of the refrigeration facilities of numerous French supermarkets. The cybercriminals modified operating parameters and caused some units to reach temperatures as high as 50 degrees, far above what is necessary to keep fresh and frozen food.
The incident affected around 700 establishments in France, according to data communicated by the authorities. Among the affected chains were Intermarché, Carrefour, Monoprix, E.Leclerc and Coopérative U. The establishments had to remove large quantities of products due to the break in the cold chain, while in certain facilities fires or outbreaks related to malfunctioning of the equipment were also recorded.
The economic consequences were considerable. Some operators calculated losses of tens of millions of euros, resulting from both the destruction of food and service interruptions and the need to review the affected facilities. Investigators found that some of the equipment was operating with outdated computer programs or without recent security updates, a circumstance that could have made unauthorized access easier.
The problem was reproduced again at the beginning of November, when a second wave of attacks affected cooling systems in different European countries. Among the installations reached were supermarkets and equipment used to keep health products, including refrigeration systems related to the storage of blood plasma in France.
In this latter case, the monitoring mechanisms made it possible to detect anomalies before there was a loss of blood products, according to French health authorities. It has not yet been established that both waves were carried out by the same people, although similarities in the operation of the attacks are part of the investigations.
France investigates a possible sabotage operation against civil infrastructure
The possible involvement of a structure linked to Iran's Islamic Revolutionary Guard introduces a geopolitical dimension to incidents that initially seemed focused on the computer systems of the food distribution sector. The objective of the attacks would not necessarily have been to steal information or demand a ransom, but to directly alter the operation of physical equipment, with consequences for the supply and preservation of essential products.
This type of sabotage has raised concern among European cybersecurity bodies because it shows that apparently conventional installations, such as the refrigeration rooms of a supermarket, can become vulnerable targets when their control systems are connected to the internet. The risk also affects other sectors that use industrial devices controlled remotely, such as health, energy, or logistics.
France maintains contacts with other European countries and with the United States to analyze whether the incidents are related to similar operations recorded outside the continent. However, the existence of technically similar attacks does not prove that all of them respond to the same campaign, nor that they were ordered by a State.
For now, French judicial investigation will have to clarify the involvement of Shahid Kaveh and the eventual responsibility of its leaders. Attribution to the Revolutionary Guard continues to be a research hypothesis, while European authorities strengthen surveillance over connected infrastructures to prevent new supply interruptions and economic losses.