The cybercrime unit of the Paris prosecutor’s office has formally opened a judicial investigation into the October cyberattack that disrupted refrigeration systems at hundreds of French retail sites, naming Iran as the state behind the operation.
In a statement issued Monday, prosecutors said the inquiry covers “fraudulent attacks on an automated data processing system by an organized group” and “damage caused by a method dangerous to persons, committed by an organized group.” The charges are aggravated by the allegation that the acts were carried out “with the aim of serving a foreign power, in this case Iran.”
Suspects Linked to Revolutionary Guard Unit
The investigation targets the head of an Iranian group identified as Shahid Kaveh, described as the “cyber offensive” unit affiliated with the Electronic and Cyber Center of the Islamic Revolutionary Guard Corps (CGRI-CEC), along with two of his deputies and any other individuals later identified.
According to the prosecutor’s office, the attack’s operating method was “characteristic of this unit,” citing “the use of Farsi and IP addresses pointing to terminals located in Iran.” Prosecutors have requested international arrest warrants against those implicated.
How the Attack Unfolded
During the night of October 11 to 12, a large-scale cyberattack targeted roughly 700 French supermarket and retail sites. Attackers seized remote control of refrigeration installations, raising temperatures and forcing distributors to discard large quantities of food. The intrusion also triggered around 20 fires at affected stores.
Prosecutors detailed that the attackers “took control of equipment remotely via web interfaces to launch abnormal defrost cycles of unlimited duration, while disabling the safety alerts of sensors meant to activate above a certain temperature.”
Government Response and Wider Impact
Trade Minister Jean-Noël Barrot reacted to the findings, holding Iran “responsible” for the attack on connected refrigeration units in France.
Similar incidents were reported in October in Belgium, Estonia, Finland, Luxembourg and Sweden. The events have highlighted the risks posed by internet-connected equipment, compounded by what officials suggest has been an underestimation of the threat by some economic actors.
