• France has publicly attributed a wave of cyber attacks on commercial refrigeration systems to Iran’s Islamic Revolutionary Guard Corps (IRGC).
  • Foreign Minister Jean-Noël Barrot said the EU will impose sanctions on Iran and promised further consequences.
  • The attacks, which began in October, have disrupted hundreds of businesses across France and spread to other European countries and the US.

France Points Finger at IRGC

France is escalating its response to a series of cyber attacks on commercial refrigeration systems, with Foreign Minister Jean-Noël Barrot publicly attributing the campaign to Iran’s Islamic Revolutionary Guard Corps (IRGC). In a statement on Thursday, Barrot said there would be EU sanctions against Iran and “consequences” for the attacks, which have disrupted operations at hundreds of commercial premises in France and beyond.

The attribution marks a shift from investigating equipment sabotage to formally assigning responsibility to an Iranian state organization. The attacks, which first emerged in October, involved hackers manipulating refrigeration controls to cause food spoilage and, in some cases, equipment damage. Retailers including Intermarché and Coopérative U reported significant losses, with approximately 150–200 Intermarché stores and nearly 100 Coopérative U outlets affected, according to figures cited by NPR. Carrefour (EURONEXT:CA) stores were also among those hit.

A further wave of refrigeration failures was reported on November 2 in Belgium, Estonia, Finland, Ireland, Luxembourg, the Netherlands, and Sweden. Investigators have not yet established whether all incidents are connected to the same campaign. On November 5, five US agencies, including CISA and the FBI, warned that attackers were targeting refrigeration controllers worldwide, though they did not name a responsible actor.

The campaign has also extended to healthcare infrastructure: three French regional blood banks experienced refrigeration-related incidents, raising concerns about the resilience of temperature-sensitive supply chains. No patient injuries or unusable blood supplies have been reported.

Sanctions and Consequences

The EU already has a cyber-sanctions framework, established in 2019, that allows targeted measures such as asset freezes and travel bans against those responsible for significant cyberattacks. Barrot’s announcement signals that France intends to treat the attacks as state-backed hostile activity rather than ordinary cybercrime. However, the announcement does not yet specify which individuals or entities will be designated. The EU previously sanctioned Iranian company Emennet Pasargad in March 2026 over cyber operations, including activities involving France and Sweden.

A French public attribution could strengthen the case for a coordinated international response, but responsibility for each country’s incidents still requires separate evidentiary assessment. US military investigators and French law enforcement have been cooperating on the refrigeration outages.

Industry Impact and Response

The attacks have highlighted the vulnerability of internet-connected cooling equipment. Danfoss, a supplier of refrigeration-management systems identified in affected French installations and in US military procurement records, said it was aware of incidents affecting a limited number of systems in France and is assisting customers. The company noted that some older controllers can no longer receive updated security software and recommended updated firmware, removing direct internet exposure, and protecting remote access. There is no evidence that Danfoss’s own corporate network was breached.

Economically, the attacks have led to inventory losses, repair costs, and increased spending on monitoring and network protection. No aggregate loss figures have been verified, and there is no evidence of a measurable effect on French inflation, GDP, or major financial markets. The broader issue is the tension between remote-management efficiency and security, as aging machinery not designed for secure internet access remains exposed.

What’s Next

In the short term, the key developments to watch are the publication of supporting evidence for France’s attribution, the identification of proposed EU sanctions targets, and confirmation of whether the November European attacks belong to the same campaign. Operationally, US agencies have urged operators to remove controllers from direct internet access, secure remote connections, separate refrigeration controls from business networks, replace default passwords, and retire unsupported equipment.

Longer term, experts warn that refrigeration sabotage could migrate from food retail to more critical cold-chain services, including medicines and laboratory materials. Sanctions may impose costs on identified operators, but reducing the technical weaknesses that enabled the attacks—exposed remote controls, obsolete firmware, and inadequate network separation—remains essential.

Correction: An earlier version of this article misstated the number of Intermarché stores affected. The figure is approximately 150–200, not 150–300.