French Foreign Minister Jean-Noel Barrot confirmed that the Islamic Revolutionary Guard Corps of Iran executed "unprecedented" cyber-attacks on 700 food distribution sites in France during October. Speaking at a G7 meeting in Paris, Barrot stated that responsibility lies with the Iranian Revolutionary Guards and vowed to implement sanctions at the European level against all those responsible for this attack. French prosecutors opened an investigation into the hacks shortly after the minister’s announcement. The attacks targeted major supermarket chains, disrupting operations across the country.
A second wave hits Europe
The initial October incidents were followed by a second wave of hacking this month that hit more than 100 establishments across Europe. This expansion included refrigerators used by French blood banks, prompting employees to move some of the blood to other cold storage units. Cyber experts had previously raised concerns that the attacks may have been part of Russia’s ongoing hybrid warfare against Europe, though the Kremlin has denied any involvement. The seemingly straightforward nature of the refrigerator hacks and their repetition across multiple countries prompted speculation about who might be responsible amid ongoing concerns over Russia’s suspected sabotage campaign in Europe, the war between the US and Iran and the global rise of AI-powered cyberattacks.
Attribution and response
Barrot described the attack as unprecedented in both its scale and its level of aggression. He credited government departments for identifying the perpetrators through outstanding work. Iran’s mission to the United Nations did not return messages seeking comment, consistent with Tehran’s routine denial of carrying out malicious cyber operations. The French government plans to impose sanctions at the European level against those responsible. The disruption forced grocery stores to manage inventory manually while technical teams worked to restore systems. Blood bank staff prioritized patient safety by transferring supplies to alternative facilities immediately upon discovering the compromise. The incident highlights the vulnerability of critical infrastructure to state-sponsored digital intrusions. No further details on the specific malware used or the exact duration of the outage have been released publicly.
