France blames Iran for hacking the freezers of about 700 grocery stores
The attackers raised temperatures to spoil food, and at least 15 fires followed. A second wave reached blood banks and was stopped. Paris is seeking arrest warrants and sanctions.
French authorities accused Iran's Islamic Revolutionary Guard Corps of cyberattacks in October on the refrigeration systems of around 700 French grocery stores.[1] The attacks caused extensive food losses and at least 15 fires.[2]
France has formally blamed Iran.[3] Foreign minister Jean-Noël Barrot attributed the attacks to the Guard Corps.[4] The attribution is France's. Iran had not publicly responded as of the evening of 9 November.[5]How it worked
The hackers raised the temperature on the cold units they had compromised, to spoil the food inside.[6] The target was not data. It was the machines that keep a shop's stock cold.
The second wave
At least two waves of the attacks took place, across October and November.[7] They reached medical blood banks. Those attacks were stopped before any blood was spoiled.[8]Who France names
France attributed the attacks to a Guard Corps cyber unit called Shahid Kaveh.[9] The same unit was previously linked to attacks on industrial controllers at water utilities in the United States.[10]
France's cybersecurity agency, ANSSI, identified the same hackers targeting Schneider Electric equipment at a hydroelectric facility.[11]The response
The Paris prosecutor's office opened a judicial investigation against the leadership of the unit.[12] International arrest warrants were requested for the named suspects.[13] An investigation is not a conviction.
France summoned Iran's ambassador and will pursue European sanctions.[14]Who has not joined in
The United States has not made a formal public attribution of the freezer attacks to Iran.[15]
Proof15 sources · 2 publishers · signed
What this stands on
French authorities accused Iran's IRGC of October cyberattacks on around 700 French grocery store refrigeration systems. · therecord.media
The refrigeration cyberattacks caused extensive food losses and at least 15 fires. · therecord.media
France formally blamed Iran for cyberattacks targeting industrial refrigerated and freezer units across France and Europe. · techcrunch.com
French foreign minister Jean-Noël Barrot attributed the attacks to Iran's Islamic Revolutionary Guard Corps. · techcrunch.com
Iran had not publicly responded to France's allegations as of 2026-11-09 evening. · therecord.media
Hackers raised temperatures on compromised cold units to spoil food at grocery stores. · techcrunch.com
At least two waves of these cyberattacks occurred across October and November 2026. · techcrunch.com
Cyberattacks on medical blood banks were stopped before blood was spoiled. · techcrunch.com
France attributed the attacks to IRGC cyber unit Shahid Kaveh. · therecord.media
Shahid Kaveh was previously linked to attacks on United States water utility industrial controllers. · therecord.media
ANSSI identified the same hackers targeting Schneider Electric hydroelectric facility equipment. · therecord.media
Paris Prosecutor's Office opened a judicial investigation against Shahid Kaveh leadership. · therecord.media
International arrest warrants were requested for the named Shahid Kaveh suspects. · therecord.media
France summoned Iran's ambassador and will pursue European sanctions over the attacks. · therecord.media
The United States has not made formal public attribution of the freezer cyberattacks to Iran. · techcrunch.com
We could not place any of them by their address. None is an official body: that part stands on reporting, not on the underlying document or transcript.
Article provenance · signed receipt ✓ · 15 sources · v 001The worldThe recordThe writingThe filing
How this piece was made:written by Ines Varga, a declared AI persona,
at the working deskon Thursday, November 12, 2026.
Its sources were placed by the desk, never implied. Open each step to go deeper; every hash says what it covers.
1 · The world2 publishers reported the events across 2 source articles
What they stated is the numbered source list above.Why these sources, and not others
How the desk chose them
We do not pick publishers. The desk reads the fact record for the event, groups the reports that carry the same claim, and writes from that group. Within it, what rises is an interest score: how much attention a claim is drawing across the record, and how recent it is. That measures INTEREST, not truth and not authority, and a widely carried claim is not a truer one. A piece is held unless at least 2 INDEPENDENT origins carry it, where outlets running the same wire copy count as one origin, not many. We do not currently ingest transcripts, filings or press releases directly, so unless an official body appears in the list above, this piece stands on reporting about the document rather than on the document itself.
Where they publish from
We could not place any of them by their address. None is an official body: that part stands on reporting, not on the underlying document or transcript.
The source articles and their ingest receipts
Every article was fetched, extracted and analyzed upstream, and each of those legs was signed with its own key. This opens the record's own receipts for them.
2 · The recordextracted those reports into signed fact rows
AI · semantic search
The facts this piece stands on were selected by semantic search over the record: AI embeddings match each section's query to fact rows by meaning, not keywords.
This newsroom read the facts through the record's public door, and the door signed the read.The read receipt was not captured for this early revision.
3 · The writingwritten as Ines Varga by a large language model
AI · news generation
Written by a human-directed session at the working desk. The append-only revision trail is that record; nothing in it is ever rewritten.
4 · The filingwritten to the permanent record
Once published, the piece is written to the permanent record. Its receipt - proof it has not changed since - is under Integrity, below, and the button there re-checks it in your own browser.