Estonian member of the European Parliament Riho Terras called for a stronger European Union (EU) response to cyberattacks after France blamed an Iran-linked unit for disrupting refrigeration systems at more than 700 retail locations.
France’s Ministry for Europe and Foreign Affairs said refrigeration controls at more than 700 retail sites were targeted overnight on Oct. 11-12. It valued the spoiled food at tens of millions of euros. France’s National Cybersecurity Agency (ANSSI) said at least 15 fire incidents were reported and that equipment at several small hydroelectric installations was also targeted.
France identified Shahid Kaveh as affiliated with the Electronic Warfare and Cyber Defence Organization of Iran’s Islamic Revolutionary Guard Corps (IRGC). ANSSI cited infrastructure characteristics, signing tools, a propaganda outlet linked to the unit and Persian-language traces as evidence supporting the attribution. Paris said it would summon Iran’s ambassador and propose additional EU sanctions against Iranian entities and individuals.
In an interview with Euronews, Terras said retailers also shared responsibility, citing insufficient financing and too few system upgrades. He described connected devices such as lights and freezers as “not protected properly.” Terras urged the EU to “attribute these attacks to state actors” and “use our package of tools.”
The French attribution concerns the October campaign. The European Union Agency for Cybersecurity (ENISA) reported another cluster of refrigeration-system incidents on Nov. 1-2, which affected member states were investigating. The Établissement français du sang (EFS), France’s blood service, said a Nov. 2 incident at one refrigeration-equipment provider affected cold-room controls at three of its sites, but no blood products were lost. Le Figaro, citing AFP, reported that the Paris prosecutor’s office had not confirmed a link between that incident and the supermarket case.
CERT-FR, France’s national computer emergency response team, said internet-facing management interfaces for refrigeration controllers violate security best practices and advised removing their public access. Its alert did not establish that the affected retailers used those configurations. Under the EU’s NIS2 Directive, covered organizations must reduce cybersecurity risks and report significant incidents; the directive covers some food-sector businesses, not every operator. France’s statement also cited cyber activity involving Charlie Hebdo in 2023 and systems connected to the Paris 2024 Olympic and Paralympic Games, as well as EU sanctions against Emmenet Pasargad in March 2026. France gave no timetable for its proposed sanctions.
