France blames Iran's Revolutionary Guards for hack on supermarket fridges

France has formally attributed last month's cyberattack on supermarket refrigeration systems to Iran's Islamic Revolutionary Guard Corps (IRGC), and Paris prosecutors have opened a judicial investigation into the hacker group they hold responsible. The Times of Israel reported that Paris prosecutor Laure Beccuau said in a statement that the case targets the head of a group called Shahid Kaveh, which she described as "an offensive cyber unit" tied to the IRGC's Electronic and Cyber Center, along with his two deputies and anyone else investigators may identify.

French Foreign Minister Jean-Noël Barrot said the Revolutionary Guards were behind the attack and that Iran would face consequences, according to N12. Ynet reported that Iran's ambassador was summoned to the foreign ministry in Paris for a reprimand, and that investigators found the attackers had used Persian and that IP addresses traced back to devices inside Iran.

What the attack did

The hackers got into the control systems of refrigerators and freezers at food stores. N12 reported that the intrusions shut down cooling units in supermarkets and shops across France and caused temperatures to rise sharply. Ynet, which referred to the incident by the nickname the "hot fridges" attack, put the number of affected stores in the hundreds. The Jerusalem Post said French officials suspect the disruption hit refrigeration at hundreds of businesses in October, and placed it within a broader pattern of cyberattacks connected to war.

The reports differ on scope. Most describe the attack as hitting stores in France, while The Times of Israel described supermarket refrigerators being targeted across Europe.

Who the Revolutionary Guards are

The IRGC is a branch of Iran's armed forces that operates alongside the regular military and answers to the country's supreme leader. Beyond its military role it runs intelligence and cyber operations. According to the prosecutor's statement as reported by The Times of Israel, Shahid Kaveh sits under the IRGC's Electronic and Cyber Center, abbreviated IRGC-CEC. Ynet described the group as an offensive cyber unit used by Tehran.

The group's name appears in slightly different transliterations across the Hebrew-language reports. Ynet and N12 render it in a form matching Shahid Kaveh, while the Telegram news channel Abu Ali Express spelled it differently. This article uses the spelling given in the prosecutor's statement as quoted in English.

The legal steps

Accounts of the warrants vary in detail. Ynet reported that the prosecution is seeking international arrest warrants against senior figures in the group. Abu Ali Express reported that Paris prosecutors decided to issue an international arrest warrant against the group's leader, while N12 said a warrant had been issued against the organisation's leaders. The prosecutor's statement quoted by The Times of Israel describes a judicial investigation naming the head of the unit and his two deputies, but the quoted portion does not itself mention warrants.

A judicial investigation in the French system places a case under an investigating judge, who can direct inquiries and issue warrants. Since the named individuals are believed to be in Iran, any warrant would depend on international cooperation to be enforced.

The diplomatic response

Summoning an ambassador is a standard way for a government to register a formal protest. Ynet called the meeting a reprimand, while Abu Ali Express described it as a summons for clarification. Abu Ali Express also reported that the European Union is expected to impose sanctions in response; no other report carried that claim.

Why it matters to readers following Israel

Israeli outlets covered the French announcement closely because Iranian state-linked hacking groups have repeatedly targeted Israeli and Western infrastructure. The Jerusalem Post framed the supermarket incident as part of a wider wave of war-linked cyberattacks. The French case is notable for attaching named suspects and a criminal process to an attack on civilian commercial systems.

What the reports do not say

None of the reports carries a response from Iran to the accusation or to the summoning of its ambassador. The reports do not give a precise count of affected stores, an estimate of financial losses or spoiled goods, or the names of the group's head and deputies. The expected EU sanctions rest on a single report, and it is not clear whether the arrest warrants have been issued or are still being sought.