Paris has pinned the October supermarket sabotage on a named Revolutionary Guards unit and asked for EU cyber sanctions. The request tests whether Europe’s long complaint about attribution was ever the real obstacle.

For two years, European governments facing sabotage on their own soil have given one reason for doing little: they could not prove who was responsible. On Monday, France took that reason off the table. Foreign Minister Jean-Noël Barrot attributed the 12 October attack on supermarket refrigeration systems to Shahid Kaveh, a cyber unit of Iran’s Islamic Revolutionary Guard Corps, identified three individuals as responsible, summoned the Iranian ambassador, and announced that Paris would seek EU cyber sanctions against everyone involved. A member state has now told its partners, in effect: here is the proof you said you lacked.

The particulars are precise. About 700 of France’s roughly 10,000 supermarkets lost control of their cold rooms overnight, with temperatures held near 50°C for about six hours. Intermarché alone reported losses in the tens of millions of euros in a single day. The Paris prosecutor, Laure Beccuau, opened a judicial investigation into organised cybercrime “committed to serve the interests of a foreign power,” targeting the unit’s leader and his two deputies and seeking international arrest warrants.

A technical finding, a diplomatic protest, and a criminal case arrived together. That combination is the standard Europe has always said it needs before it acts. The question now moves from Paris to the Council, where listings under the 2019 framework behind EU cyber sanctions are, in Council practice, adopted by unanimity. As a result, a single government can stop the Council from adopting the listings Paris wants, however strong the French evidence proves to be.

The first reactions set the terms. Kaja Kallas, the Union’s foreign policy chief, said Europe’s response “should be strong”, and foreign ministers are reportedly due to take up the French findings at the Foreign Affairs Council on 16 November. Tehran’s foreign ministry rejected the accusations as “unfounded and biased.”

Beyond the Freezer Aisle

Spoiled yoghurt makes for an easy headline, but the French findings point somewhere more serious. The joint report by C4, the crisis cell that brings together ANSSI, the DGSE, the DGSI, the armaments directorate, and cyber defence command, found that the infrastructure behind the supermarket operation was also scanning Schneider Electric controllers at small energy and water production sites. The same night, it reached several small hydroelectric installations, with moderate effects.

Seen this way, the grocery chains were a proving ground. An adversary able to hold hundreds of cold rooms at 50°C overnight has shown it can reach the same class of controllers that run pharmacies, vaccine stores, and pumping stations. Barrot called it the first large-scale cyberattack aimed at sabotage on French soil. Brussels already sees the pattern: after the November wave, Agriculture and Food Commissioner Christophe Hansen called the incidents “a deliberate attempt to disrupt our food supply chain.”

The Case for Caution

The hesitant capitals will not lack arguments, and they deserve a fair hearing. Two pro-Russian groups, NoName057(16) and Z-Pentest, claimed the European refrigeration attacks on 4 November in Telegram posts they later deleted. US intelligence, according to New York Times reporting, holds only a “low confidence” view that Iran was responsible and names no group. Analysts at SentinelOne, writing before the French announcement, judged responsibility for the European incidents unestablished.

There is a structural objection too. France’s finding covers the October wave alone. The second wave, which struck stores in Belgium, Estonia, Germany, Ireland, Italy, Luxembourg, the Netherlands, Portugal, and Sweden on 2 and 3 November, has no named author. Neither does the intrusion of 1 and 2 November into cold storage at three sites of France’s own blood service, carried out through a refrigeration supplier. A minister in Brussels or Tallinn could fairly say that her government is asked to punish an Iranian unit over an attack it did not suffer, while the one it did suffer remains an open file.

Timing adds a third complaint. Washington says the Iran war is effectively over, Qatar is carrying messages about a settlement, and the Revolutionary Guards are still setting tankers alight near Hormuz. Some governments will argue that a fresh listing complicates diplomacy just as it might deliver.

Why the Objections Do Not Hold

None of these objections disputes the French evidence. The Russian claims appeared and vanished without proof, from groups with a habit of boasting about operations they did not run. A low-confidence American assessment is not independent confirmation, but neither does it contradict Paris, and two of the men France has named, Hamid Reza Lashgarian and Mahdi Lashgarian, were already placed under US Treasury sanctions in February 2024 as officials of the Revolutionary Guards’ cyber command, after earlier attacks on industrial control systems. The SentinelOne review, for its part, predates a disclosure resting on four indicators: shared attack infrastructure, tactics matching earlier Shahid Kaveh operations, traces of Farsi, and Iranian IP addresses.

The two-waves argument cuts the other way. If the November incidents lack an author, the states hit in November, France included, should share their logs with ANSSI rather than leave the October attack unanswered. Making every incident hostage to the least understood one is precisely how a deniable campaign wins.

On diplomacy, EU cyber sanctions target persons and entities. They leave untouched the state-to-state channel that Doha, or anyone else, is running.

The Test for EU Cyber Sanctions

The instrument exists, and it works. In July the Council added eight individuals and four entities to the list in a single decision. Iranian operators are not new to it either: in March the Council listed Emennet Pasargad, a Tehran company, in part for breaching a French subscriber database and offering it for sale. The legal question is closed. What remains is political.

Europe also has a habit worth naming. When London linked Iran to the September incident at RAF Fairford, France and its partners issued a joint statement that “took note” of the British finding. Such wording is polite, and it binds nobody. Paris now wants the other 26 governments to accept a French intelligence judgment as grounds for legal measures, in a case where the American assessment is weaker than the European one. For once, Europe would lead on attribution rather than follow it.

If EU cyber sanctions can follow only those findings that every capital has verified for itself, the regime will bite only on operators careless enough to be caught twenty-seven times over. A deterrent conditioned on unanimous forensic certainty deters no competent adversary.

What the Council Should Do

First, governments should treat a member state’s formal attribution, backed by an open judicial investigation, as a sufficient basis for a listing unless they can set out specific technical doubts within a fixed period. Unanimity cannot be overridden, but it need not mean obstruction. Article 31(1) of the Treaty on European Union lets a government that cannot endorse a decision abstain without blocking it. If it qualifies its abstention with a formal declaration, it is not obliged to apply the decision, but must accept that the decision commits the Union and refrain from any action likely to conflict with it. There is a limit: if the governments abstaining in this way represent at least one third of the member states, comprising at least one third of the Union’s population, the decision is not adopted. France and ten other governments urged greater use of this route in their letter of 1 September.

A longer-term question sits behind this. Article 31(2) allows the Council to act by qualified majority when it adopts a decision implementing an earlier unanimous one. The European Parliament argues that adding names to an existing sanctions list is exactly such an implementing decision. In Case C-883/24, lodged in December 2024, it asks the Court of Justice to annul Council Decision (CFSP) 2024/2643, the regime targeting Russia’s destabilising activities, in so far as its Article 4(1) requires listings to be decided “by unanimity,” claiming a breach of Articles 31(2) and 40 of the Treaty. No ruling has been published. Article 31(2) also lets any government halt a qualified-majority vote by citing vital and stated reasons of national policy, so no listing should be designed on the assumption that Parliament will win.

Second, the countries hit on 2 and 3 November should pool their forensic data through the Union’s existing cyber crisis networks, so that the second wave is either tied to the first or ruled out within weeks rather than left in permanent ambiguity.

Third, the listing should stay narrow: the Shahid Kaveh leadership already named by Paris, plus the entities that supplied its infrastructure. A tight list is harder to block and easier to defend before the General Court.

Responsibility and Vulnerability Are Separate Problems

EU cyber sanctions answer the question of who was responsible. They do nothing about why the attack worked. That second question belongs to cybersecurity law, and here the Union’s coverage is thin. The NIS2 Directive covers food businesses engaged in wholesale distribution and industrial production and processing. As the Finnish Food Authority, which supervises the Directive in that sector, spells out, retail trade and storage fall outside that category. A supermarket chain does not enter NIS2 through the food entry, so the Directive’s risk-management and incident-reporting duties do not reach its cold rooms on that basis.

The suppliers that monitor refrigeration remotely are a harder case. NIS2 covers managed service providers above the medium-size threshold, defined as firms that install, operate, or maintain other businesses’ systems, including remotely. Whether remote refrigeration monitoring meets that definition is unsettled, and national transposition laws may answer it differently.

Paris has homework of its own here. France is one of four member states the Commission referred to the Court of Justice on 8 July for failing to transpose NIS2. The bill that would do so, adopted by the Senate in March 2025, reached the floor of the National Assembly only this week, after being pulled from the agenda in October. A government asking its partners to stand behind its intelligence would strengthen that request by completing its own cyber law.

Listing Shahid Kaveh would deal with the last attack. Closing these gaps would make the next one harder. The Commission should issue guidance confirming that remote management of refrigeration and building controls counts as a managed service, and use the review of NIS2 to consider bringing the operational technology of large food retailers within its scope, before an attacker moves from freezers to hospitals.

Europe’s case on hybrid attacks has always rested on the claim that proof is the obstacle. France has now supplied it. If the Council still cannot move on EU cyber sanctions, then attribution was never the difficulty. The difficulty was whether European governments will stand behind one another’s findings when doing so carries a cost.