France accuses Iran's Revolutionary Guards over supermarket cyberattacks; prosecutor opens investigation

As reported by BBC News, Deutsche Welle and France 24. The allegations below are theirs, not Vocemundi's.

French Foreign Minister Jean-Noël Barrot on Monday, 9 November 2026, publicly attributed the October cyberattacks on French supermarkets to Iran's Islamic Revolutionary Guard Corps (IRGC). BBC News reported that he spoke at a news conference. The attribution is the French government's position.

Barrot said France would implement sanctions at the European level against those responsible. According to Al Jazeera, he also said the Iranian ambassador had been summoned.

The Paris prosecutor, Laure Beccuau, said a judicial investigation had been opened against the head of Shahid Kaveh and his two deputies. She described Shahid Kaveh as an offensive cyber unit affiliated with the IRGC's Electronic and Cyber Centre. The prosecutor's office said it was requesting international arrest warrants.

The attacks took place on 11 October. Several outlets specify the night of 11-12 October. Hackers gained remote control of systems that regulate the temperature of supermarket refrigeration units. Hundreds of supermarkets across France were affected.

Temperatures in some stores rose to 50C overnight, according to authorities cited by Al Jazeera. BBC News described this figure as reported. DW and Al Jazeera said some units caught fire. Al Jazeera also reported that equipment melted in some cases.

According to Al Jazeera, retailers said food worth millions of euros was spoiled. Coopérative U said more than 100 of its supermarkets were hit. Al Jazeera reported that Carrefour said 80 supermarkets were affected and Monoprix said about 5% of its roughly 490 stores were hit. E.Leclerc was also hit, according to Al Jazeera, which reported that the systems were made by an unnamed Danish company.

Daily Sabah, citing Le Figaro and a source familiar with the investigation, reported that French intelligence services attributed the attacks to the IRGC.

Further attacks on supermarket refrigeration have since been reported in other European countries. BBC News said it is not known whether these incidents are linked to the attacks in France.

What is disputed

• Intermarché and its Netto brand: BBC News reported 180 stores affected; Al Jazeera reported at least 300.
• Arrest warrants: France 24 said the request covers the leader of Shahid Kaveh; Al Jazeera said the leader and his two deputies.
• Last week's incidents: BBC News reported dozens of supermarkets hit in seven other European countries. DW reported similar incidents in French supermarkets and a failed attempt, reported by authorities, to hack cooling units at blood banks.
• A Le Monde summary described refrigerators as shut down; other outlets report that temperatures were raised.

What each side says

France 24 quoted Barrot as saying: "I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran." He called the attack "unprecedented in both its scale and its level of aggression", according to France 24.

Beccuau's statement, as quoted by France 24, said the investigation also targets "any other individuals who may be identified".

BBC News reported that Iran had yet to respond. The reports reviewed by Vocemundi do not include any Iranian response. They also do not describe the evidence behind France's attribution.

Vocemundi note: this story relays allegations published by BBC News, Deutsche Welle and France 24. Vocemundi did not have access to the underlying evidence or documents and has not independently verified these claims. The people and organisations named are presumed innocent; their response is included where it was available.

Analysis

France's move combines a public attribution, a criminal investigation and a call for European Union sanctions. The next steps could include discussions among EU member states on sanctions. Their scope and timing are not described in the reports reviewed by Vocemundi. The arrest warrants are described only as requested. Their practical effect would depend on cooperation from other states. Any Iranian response could shape the diplomatic course. A key open question is whether the incidents later reported elsewhere in Europe are linked to the October attacks. The reports reviewed by Vocemundi do not establish such a link. They also do not show how the attackers gained access to the systems.

Produced by the Vocemundi newsroom with AI assistance.