Relations between Paris and Tehran had been strained for years by the prolonged detention of French nationals on security charges. In July, France said Iranian security forces had assaulted two staff members of its embassy in Tehran and summoned Iran’s ambassador in Paris. It summoned him again in October over what it described as an Iranian government disinformation campaign about French high school protests. The cyberattack coincided with those protests and can be read in the context of rising tensions between the two capitals.
Paris attributed the attack to Shahid Kaveh, a cyber unit linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). The choice of France is striking. Unlike the United States and Israel, France has not taken part in strikes against the Islamic Republic of Iran and has sought to stay out of the war. Why, then, would the Revolutionary Guards target civilian facilities on French soil?
From Tehran’s perspective, France’s military role may matter more than its decision to stay out of offensive operations. The French Ministry of the Armed Forces confirmed that Rafale fighter jets had intercepted and destroyed Iranian missiles and drones threatening French interests or the airspace of regional partners. French forces based in the United Arab Emirates have taken part in air defense operations since the war began. France has also deployed defensive systems in the region, including in Saudi Arabia, to protect the kingdom’s oil infrastructure from Iranian missiles and drones.
Paris describes these operations as fulfilling its defense commitments. For the Revolutionary Guards, the practical result may have mattered more: French forces prevented some Iranian missiles and drones from reaching their targets. Tehran may therefore have judged France by its role in thwarting those strikes rather than by its diplomatic position.
Why target civilian infrastructure?
The attack on the night of October 11–12 differed from many previous cyber operations. The apparent aim was to cause material damage and disrupt civilian businesses. Targeting refrigeration systems gave the attackers a way to impose economic costs without launching a military strike.
The equipment may have been chosen in part because it was poorly protected. But the choice also made sense as a means of pressure. Disrupting food distribution affects an everyday service, making the consequences felt beyond the businesses directly hit.
The ability to cause damage, however, does not guarantee deterrence. An attack on civilian facilities could push France toward a tougher position even though it had stayed out of offensive operations against Iran. Against an already difficult economic backdrop, the disruption could also harden French public opinion against the Islamic Republic.
A response taking shape among allies
The October cyberattack is part of a broader pattern of activity that Western governments attribute to the Islamic Republic. On October 12, France, the United Kingdom, the United States, and several other countries issued a joint statement on violent and destabilizing activities they attributed to Tehran. It cited Britain’s assessment of Iranian involvement in the September 27 incident at RAF Fairford.
The statement shows that Western concerns go well beyond cyberattacks. Even before Paris publicly attributed the refrigeration attack to Iran, several governments were already working toward a common response to a wider range of threats.
One question remains: at what level are Revolutionary Guard cyber operations against France and other European countries authorized? Their strategic value will depend on whether they change those governments’ behavior in the direction Tehran wants. If the aim was to deter European countries from interfering with Iranian military operations, the attack could have the opposite effect: governments that had sought to stay out of the war may now see more reason to confront the Islamic Republic’s security apparatus directly.
