> ## Content Index
> Fetch the complete content index at: https://thecoverwire.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# France blames Iran's Revolutionary Guards for supermarket fridge hacks
- URL: https://thecoverwire.com/france-blames-iran-fridge-hacks-cyber-war-exclusion/
- Published: 2026-11-10T06:10:09.000Z
- Updated: 2026-11-10T06:10:09.000Z
- Description: An official state attribution is evidence the market's model cyber war exclusion names, though that wording also needs a major impact on a state.
- Author: CoverWire
- Tags: Cyber, Lloyd's, #desk-risk

- French foreign minister Jean-Noël Barrot said on 9 November that responsibility for the October attack on supermarket refrigeration lies with Iran's Islamic Revolutionary Guard Corps, the BBC and franceinfo reported.
- The LMA's model cyber war exclusion, LMA5567A, says the evidence parties consider on attribution may include formal or official attribution by the government of the state where the affected system is located.
- The BBC reported it is not known whether a later wave of attacks across Europe, which reached UK food suppliers, is linked.

France's foreign minister has blamed Iran's Islamic Revolutionary Guard Corps for the October hacking of supermarket fridges and freezers, giving insurers the kind of official state attribution that an LMA model cyber war exclusion names as evidence.

"I am in a position to confirm that responsibility for this attack lies with the Islamic Revolutionary Guard Corps of the Islamic Republic of Iran," Jean-Noël Barrot, the foreign minister, said on 9 November, in CoverWire's translation of remarks [reported by franceinfo](https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/cyberattaque-contre-des-frigos-de-supermarches-le-parquet-de-paris-ouvre-une-enquete-visant-une-unite-des-gardiens-de-la-revolution-iraniens%5F8274806.html?ref=thecoverwire.com). He called the attack "unprecedented in both its scale and its level of aggression", summoned Iran's ambassador and said those responsible would face sanctions, [the BBC reported](https://www.bbc.co.uk/news/articles/cmg474vk6dyqo?ref=thecoverwire.com). Iran has not responded officially, and some Iranian media outlets dismissed the allegations as baseless, according to the BBC.

The Paris prosecutor has opened an investigation into the head of an offensive cyber unit named Shahid Kaveh, which it said is affiliated with the IRGC, and his two deputies, franceinfo reported. The prosecutor said about 700 retail sites were hit on the night of 11 to 12 October through remote access to refrigeration controls, and investigators cited a characteristic method of attack, the use of Farsi and IP addresses pointing to devices in Iran.

Since 31 March 2023, Lloyd's has required standalone cyber policies in risk codes CY and CZ, at inception or renewal, to carry a state-backed cyber-attack exclusion with "a robust basis" for agreeing how an attack will be attributed, [according to Market Bulletin Y5381](https://assets.lloyds.com/media/35926dc8-c885-497b-aed8-6d2f87c1415d/Y5381%20Market%20Bulletin%20-%20Cyber-attack%20exclusions.pdf?ref=thecoverwire.com). One of the LMA's model clauses, [LMA5567A](https://lmalloyds.com/wp-content/uploads/2025/09/LMA5567A.pdf?ref=thecoverwire.com), says the evidence considered "may include formal or official attribution by the government of the state in which the computer system affected by the cyber operation is physically located", and leaves the insurer's burden of proof unchanged.

That clause's exclusion for non-war cyber operations applies only where a state becomes an "impacted state", meaning one suffering a "major detrimental impact" on its functioning through disruption to an essential service, or on its security or defence. The clause defines essential services as including financial institutions, health services and utilities. Whether supermarket refrigeration meets that test is untested, and which wordings French retailers carry is not known.

Insurers told Reuters after the October attack that cyber policies typically do not cover physical losses, as CoverWire [reported on 4 November](https://thecoverwire.com/fridge-hack-uk-food-firms-insurers-warn-spoilage-cover-gap/), when a second wave reached UK food suppliers. The BBC reported on 9 November that it is not known whether the French and later European attacks are linked.

Related coverage: [Insurers warn spoilage from fridge hacks may fall outside cover](https://thecoverwire.com/fridge-hack-uk-food-firms-insurers-warn-spoilage-cover-gap/); [Coalition found 1,506 exposed fridge panels before French store attack](https://thecoverwire.com/danfoss-storeview-panels-exposed-coalition-scan/).

## Sources

- [BBC News: France accuses Iran of supermarket fridge hacking (9 November 2026)](https://www.bbc.co.uk/news/articles/cmg474vk6dyqo?ref=thecoverwire.com)
- [franceinfo: La France accuse l'Iran de la cyberattaque contre des frigos de supermarchés (9 November 2026)](https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/cyberattaque-contre-des-frigos-de-supermarches-le-parquet-de-paris-ouvre-une-enquete-visant-une-unite-des-gardiens-de-la-revolution-iraniens%5F8274806.html?ref=thecoverwire.com)
- [LMA5567A War and Cyber Operation Exclusion No. 4 (18 January 2023)](https://lmalloyds.com/wp-content/uploads/2025/09/LMA5567A.pdf?ref=thecoverwire.com)
- [Lloyd's Market Bulletin Y5381: State backed cyber-attack exclusions (16 August 2022)](https://assets.lloyds.com/media/35926dc8-c885-497b-aed8-6d2f87c1415d/Y5381%20Market%20Bulletin%20-%20Cyber-attack%20exclusions.pdf?ref=thecoverwire.com)