France has formally blamed Iran for the October cyberattack that tampered with refrigeration controllers at about 700 supermarkets and food sites across the country, saying the campaign caused at least 15 fires and food losses worth tens of millions of euros.
In a statement published November 9, 2026, France’s Ministry for Europe and Foreign Affairs attributed the attacks to Shahid Kaveh, a cyber-offensive unit of the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps (IRGC). The ministry called it the first cyber-offensive campaign carried out purely for sabotage on French soil.
What happened overnight on October 11 to 12
According to a joint report published by CERT-FR on behalf of France’s Cyber Crisis Coordination Center (C4), attackers compromised the cold controllers at roughly 700 retail sites during the night of Sunday, October 11, into Monday, October 12. They changed defrost settings to high temperatures, which led to major product losses and, in at least 15 cases, fires.
The C4 was alerted on October 12. The report names the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups among the affected retailers. It also lists other victims in the food sector, including several small butcher shops, a slaughterhouse and cooperative food processing plants.
BreachNews covered the initial attack when stores were still emptying spoiled freezers and cold rooms.
Small hydroelectric sites were targeted too
The C4 said it also saw attacks on several Schneider Electric devices at small hydroelectric installations in France during the same period. It linked that activity to the same campaign and described the effects on the targeted equipment as moderate.
Why France points to Shahid Kaveh
The report lists 4 pieces of evidence behind the attribution:
- The infrastructure used in the refrigeration attack was also used, in the same period, to scan Schneider Electric equipment at small energy and water sites, using Modbus on port 502, a technique the unit has used since at least April 2026.
- The operators used the FOFA internet scanning platform, which the C4 says this attack group routinely uses.
- CyberbanNews, a propaganda outlet the C4 ties to Shahid Kaveh, promoted the refrigeration attack as early as October 13, 2026.
- Investigators found traces of Farsi in the attack infrastructure.
The C4 says Shahid Kaveh is led by Reza Salarvand and Mahdi Lashgarian, and that the unit works behind hacktivist personas including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front. The report also names Hamid Reza Lashgarian as head of the IRGC’s electronic and cyber center.
According to the C4, the unit claimed a November 2023 campaign against Israeli industrial control maker Unitronics through its CyberAveng3rs persona, and claimed a large sabotage campaign against Israeli and U.S. targets in March and April 2026 that included Israeli refrigeration equipment. The report says the unit has held scripts to scan, access and control Schneider Electric, Siemens and Rockwell industrial equipment since at least June 2024.
Older IRGC operations against France
The same report attributes earlier operations to a second IRGC unit, Shahid Shoostari, also known publicly as Emennet Pasargad. The C4 confirmed that unit targeted Charlie Hebdo in 2020 and was behind the January 4, 2023 defacement of the magazine’s online shop and theft of its database. It also tied the unit to a July 2024 compromise of a French company that runs video display screens, where attackers tried to show images protesting Israeli athletes at the Paris 2024 Olympic and Paralympic Games. That attempt was caught before any images were displayed.
Ambassador summoned and new EU sanctions proposed
France said it will summon Iran’s ambassador and propose new European Union sanctions against Iranian individuals and entities involved in the attack and in other malicious cyber activity. The ministry added that France reserves the right to take further public and non-public measures. The EU already sanctioned Emennet Pasargad in March 2026, according to the statement.
The statement and the C4 report cover only the October 11 to 12 campaign in France. Neither document links Shahid Kaveh to the November 2 wave that hit more than 100 supermarkets in other European countries, or to the vendor attack that tampered with cold storage at French blood service EFS.
U.S. agencies issued a related warning
On November 5, CISA, the FBI, HHS, USDA and the Department of Transportation published a joint fact sheet warning that attackers are targeting unpatched or internet-exposed refrigeration and cold chain controllers worldwide. The agencies did not name a threat actor.
Their advice for operators of these systems includes:
- Take controller panels and other control system devices off the public internet, and put any required remote access behind an updated firewall or edge device.
- Change default passwords and use phishing-resistant multifactor authentication where possible.
- Place operational technology on a separate network segment from business systems.
- Keep firmware current and replace end-of-life controllers that no longer get updates.
- Limit which devices and IP addresses can change settings, and make sure temperature alarms reach staff quickly.
