France on Monday formally blamed Iran's Revolutionary Guard for the Oct. 12 cyberattack that disabled refrigeration systems in roughly 700 of the country's 10,000 supermarkets, summoned the Iranian ambassador and opened a judicial investigation into organized cybercrime committed for a foreign power.

The attribution converts a supply-chain disruption into a state-level diplomatic and legal case. For operators of connected infrastructure in Europe, that shift carries practical consequences: the same toolkit that cooked supermarket fridges now sits at the center of European sanctions proceedings.

What did the attack actually do?

In the early hours of Oct. 12, attackers remotely took control of refrigeration systems in hundreds of supermarkets and independent stores across France. Temperatures climbed to 50 degrees Celsius (122 Fahrenheit) for about six hours, forcing stores to discard fresh and frozen goods.

The Intermarché chain reported losses of "tens of millions of euros" in a single day — a figure that puts the cost of a six-hour temperature spike on par with a major regional outage.

Who does France blame?

The national cybersecurity agency, ANSSI, attributed the operation to the Shahid Kaveh group, described as a "cyber unit" affiliated with the Islamic Revolutionary Guard Corps. Paris prosecutor Laure Beccuau said the investigation targets the group's leader, his two deputies and any other individuals identified in connection with the case.

Investigators found the attackers used Farsi and IP addresses linked to devices located in Iran, Beccuau said. The Paris prosecutor's office is seeking international arrest warrants.

The formal investigation, opened Monday, covers suspected organized cybercrime with the aggravating circumstance of "having been committed to serve the interests of a foreign power — in this case, Iran," Beccuau said.

What is the political response?

The French Foreign Ministry condemned the attack "in the strongest possible terms." Foreign Minister Jean-Noël Barrot, speaking on the sidelines of G7 talks in Paris, said the Iranian ambassador was being summoned to "strongly protest against this extremely serious act."

"This is an attack of unprecedented scale and aggressiveness," Barrot said. "It is the first large-scale cyberattack aimed at sabotage on French soil, and it represents a major threat to our national interests and the security of the French people. That is why it will not go unanswered."

"We will impose sanctions at the European level against all those responsible for this attack," he added, vowing "any other measures needed" to respond and deter future attacks.

Is this part of a wider campaign?

The pattern extends beyond one night in October. Last week, a separate cyberattack on several French blood banks tried to raise temperatures to extremely high levels but was thwarted before blood products or samples were damaged. ANSSI and Paris prosecutors are investigating.

Also last week, supermarkets in Sweden, Belgium, Luxembourg, Ireland and Estonia reported freezer and fridge failures apparently caused by cyberattacks, forcing some to dispose of ruined food.

ANSSI has attributed other attacks against France since 2020 to a second group, Shahid Shoostari, also affiliated with the Revolutionary Guard Corps. Those operations targeted satirical newspaper Charlie Hebdo in 2023 and the organization of the Paris Olympic Games in 2024.

What should practitioners take from it?

The case rewrites the risk profile of ordinary building-management equipment. Refrigeration controllers — rarely treated as crown-jewel assets — delivered the first large-scale sabotage cyberattack on French soil, in the government's own words. Retailers across at least six European countries absorbed food losses from the same class of intrusion within weeks.

Attribution now moves quickly from incident to named units, named individuals and arrest warrants, with sanctions attached. Boards that budget for data-theft scenarios should price physical-destroy attacks on connected hardware with the same seriousness.