France has claimed Iran was behind attacks that saw supermarket refrigerators hacked and overheated.
Last month, hackers took advantage of a known flaw in internet-connected industrial refrigeration systems at hundreds of supermarkets in France, driving temperatures above 50ºC, sparking fires and floods while damaging food.
Similar attacks followed last week against fridges in Belgium, the Netherlands, and other European countries, as well as targeting French blood banks, threatening to turn supplies into "black pudding".
French prosecutors said via a statement that the "unprecedented" attacks in October were the fault of the Shahid Kaveh cyber crime group, affiliated with Iran's Islamic Revolutionary Guard Corp, noting the latter has carried out attacks against France since at least 2020.
Laure Beccuau, Paris public prosecutor, said that the "modus operandi" matched the Iranian group, claiming that attackers used Farsi and IP addresses that were traced back to devices in Iran.
Gary Barlet, Public Sector CTO at Illumio, said it wasn't a surprise the attacks were state-sponsored by Iran.
"France has pointed the finger at Iran, and honestly, if that's confirmed, it isn't a surprise," he said. "Iran-linked groups have a track record of going after exposed, internet-connected equipment.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
Call for sanctions
The Paris Public Prosecutor's Office is now investigating and has issued international warrants against several members of Shahid Kaveh, while the France ministry for Europe and Foreign affairs said it would call for new sanctions against Iran from its European allies.
Jean-Noël Barrot, the minister for Europe and Foreign Affairs, called for "Europe-wide sanctions" in order to "protest in the strongest possible terms against this extremely serious act."
"Thanks to the remarkable efforts of government agencies, I am able to confirm that the Islamic Republic of Iran’s Revolutionary Guards are responsible for this attack," Barrot said, speaking at the G7 summit in Paris, according to reports.
"This is an attack of unprecedented scale and aggressiveness," Barrot added. "It is the first large-scale cyberattack aimed at sabotage on French soil, and it represents a major threat to our national interests and the security of the French people. That is why it will not go unanswered."
Josiah Smith, Director of Operations at OPSWAT, called for sanctions against Iran as well as action against affiliated cyber crime groups.
"Sanctions should hit the IRGC cyber units, the officials who directed them, and the front groups, such as CyberAveng3rs, used to hide the operation," Smith said. "The EU cyber sanctions framework already allows asset freezes and travel bans. Use it and extend listings to the state entities that backed the campaign. Naming individuals is a start, but the pressure has to reach the state that runs these units."
Barlet added that France's move to pursue sanctions was the right one.
"It's not yet clear what form those sanctions will take, so that will be interesting to see," he said. "But this needs to happen more often. Too often an attack gets publicly called out, there's outrage, and then nothing happens. It sends a message to attackers that the cost of doing this is close to zero."
That said, Smith noted that sanctions alone won't stop such attacks from happening in the future.
"The French campaign hit around 700 commercial sites, and a second wave reached more than 100 establishments across Europe," he added. "Retailers and food distributors need to know every connected controller and who can reach it, keep OT off the public internet and out of corporate networks, and scan every file moving in or out.”