France plans to summon Iran’s ambassador to address its claims the Islamic Republic was behind last month’s cyberattacks on local supermarkets.

A statement from a spokesperson for France’s Ministry for Europe and Foreign Affairs has blamed Shahid Kaveh, the cyber unit connected with the Electronic Warfare and Cyber Defence Organization of the Islamic Revolutionary Guard Corps (IRGC) for the October attacks.

Last month, major French food retailers, including Coopérative U,  E. Leclerc and Groupement Mousquetaires, said they had been hit by a cyberattack that affected their refrigeration systems.

In a statement issued yesterday (9 November), the Ministry for Europe and Foreign Affairs said the cyber incidents on the refrigeration systems of 700 retail stores “caused significant material damage” due to fires and ruined food estimated at “tens of millions of euros”.

France has condemned the cyberattacks in the “strongest terms”, described by the Ministry as “unprecedented in its scale and level of aggressiveness and has been the first offensive cyber campaign carried out purely for the purposes of sabotage on French soil”.

It added the cyber incidents also violated international law.

“In accordance with its 2026 National Cybersecurity Strategy, France is determined to make use of all the means of response at its disposal, including within the European Union and alongside its European and international partners in order to anticipate, prevent, deter and respond to destabilising and destructive actions against it in cyber space,” the Ministry statement read.

Further sanctions on Iran are also being considered in consultation with France’s European neighbours.

"Thanks to the work of government agencies, we know who is responsible: the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran," France's Foreign Minister, Jean-Noel Barrot, stated on X yesterday.

"Iran’s ambassador has been summoned. We will sanction those responsible and take all measures we deem necessary and proportionate to respond to these attacks and deter anyone who might consider carrying out similar ones."

Politico carried a statement from the Paris Prosecutors Office – Parquet de Paris – which plans to launch an investigation targeted at IRGC leaders.

“The attackers took remote control of the equipment via web interfaces to trigger abnormal defrost cycles of unlimited duration, while disabling the security alerts on the sensors that were supposed to activate once a certain temperature was exceeded,” the Office was quoted as saying.

Meanwhile, France’s Ministry for Europe and Foreign Affairs claimed the cyberattacks on supermarket fridges were not the first on the country by Iran.

One was against the Charlie Hebdo publication in 2023 and another on the Olympic and Paralympic games held in Paris in 2024. As a consequence of those incidents, the Ministry said the EU imposed sanctions on the Iranian cybersecurity firm Emennet Pasargad.

The accusations against Iran follow another round of similar cyberattacks across Europe last week, including in Sweden, Belgium and Luxembourg.

Supermarkets such as Carrefour, Colruyt Group, Delhaize and Coop were hit.

In the wake of those attacks, Michael Ferdinandsen, the CEO of Danish industrial cybersecurity company Secomea, said retailers needed tighter controls over remote access to operational equipment.

“For retailers, the question isn’t whether they need remote connectivity. They absolutely do. The question is whether they have sufficient control over who can access their equipment, what they can reach, and what they’re allowed to do,” Ferdinandsen said.