🔍 Read the full analysis: France Says Iran Was Behind Supermarket Fridge Hacks: Its Evidence on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France says an Iranian Revolutionary Guard cyber unit carried out an October attack that disrupted supermarket refrigeration systems at about 700 retail sites, causing food losses and at least 15 fires. Its published case relies on several indicators, including shared attack infrastructure, a scanning tool associated with the unit, a propaganda channel and traces of Farsi; the attribution has not been tested in court.
France on November 9 attributed an October cyberattack on refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit France says is affiliated with Iran’s Islamic Revolutionary Guard Corps. French officials say the attack caused major food losses and at least 15 fires; the government has summoned Iran’s ambassador and plans to propose new European Union sanctions.
The attack took place overnight from October 11 to 12, according to a report from France’s Cyber Crisis Coordination Centre, or C4. The report says attackers changed refrigeration equipment’s defrost settings to high temperatures. It records significant losses of goods and fires in at least 15 cases. France’s foreign ministry put food losses at several tens of millions of euros. The Associated Press reported that temperatures reached 50 degrees Celsius for about six hours and that Intermarché said it lost tens of millions of euros in one day.
France’s published attribution rests on a bundle of technical indicators, rather than a single piece of evidence. The C4 report says the attack infrastructure was also used around the same time to scan Schneider Electric equipment used in small and medium energy and water facilities. It says the Modbus industrial protocol on port 502 had been used by Shahid Kaveh since at least April 2026, and that the attackers used FOFA, an internet-scanning tool the report associates with the unit.
The report also cites a propaganda channel, CyberbanNews, relaying the attack from October 13, and traces of Farsi in the attack infrastructure. The Paris prosecutor’s office, as reported by the AP, added that investigators identified IP addresses linked to devices in Iran. These are French government and prosecutor claims; they have not been established through a court judgment.
France’s Iran accusation and the evidence
France says an Iranian cyber unit attacked supermarket refrigeration systems. Its case combines technical clues, while the attribution remains untested in court.
What the attack changed
France’s report says attackers altered refrigeration controllers’ defrost settings to high temperatures.
- Food losses worth several tens of millions of euros, according to France’s foreign ministry.
- Fires were recorded in at least 15 cases.
- Connected equipment can disrupt operations and food supplies.
- France says exposed management interfaces went against good practice.
The published evidence
France points to a bundle of indicators rather than one decisive clue.
Shared activity
The report says the attack infrastructure also scanned Schneider Electric equipment.
FOFA scanning
France associates the internet-scanning tool FOFA with Shahid Kaveh.
Farsi traces
The report cites traces of Farsi in the attack infrastructure.
CyberbanNews
The propaganda channel relayed the attack from October 13.
What happens next
France has moved from public attribution to diplomatic and legal action.
France summoned Iran’s ambassador and plans to propose new EU sanctions.
Paris prosecutors are investigating the alleged role of the unit’s head, two deputies and others.
The investigation must establish whether the claims can be supported in court.
Costs for Retailers and France
The incident shows how a cyberattack on connected refrigeration equipment can cause physical damage and financial losses without targeting checkout systems or customer data. Changing a control setting can threaten food supplies, disrupt store operations and, in this case, lead to fires, according to France’s report. The foreign ministry says losses reached several tens of millions of euros, although the source material does not give a final audited total.
The French response also moves the matter beyond technical attribution. France has summoned the Iranian ambassador, said it will propose new EU sanctions, and opened a judicial investigation. The case may test how European governments respond when they publicly attribute damaging cyber operations to a foreign state, while the underlying evidence remains subject to scrutiny and any criminal prosecution is still at an early stage.
Popular right now
Shark NV752 Rotator Powered Lift-Away TruePet Upright Vacuum, Bordeaux
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Blue Velvet
Samsung 43-Inch M70H Series 4K Mini LED Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
Three parts of the French state presented the case on November 9. The foreign ministry issued a formal declaration saying France was in a position to attribute the destructive actions to Shahid Kaveh, which it described as affiliated with the IRGC’s electronic and cyber centre. Foreign Minister Jean-Noël Barrot confirmed the attribution at a G7 meeting in Paris. Separately, C4 published a five-page technical report through France’s national cybersecurity incident response team, CERT-FR.
The justice system has begun its own process. Paris prosecutor Laure Beccuau opened a judicial investigation into the alleged role of Shahid Kaveh’s head, two deputies and other people who may be identified. The AP reported that the alleged offences include acting to serve the interests of a foreign power, in this case Iran, and that prosecutors are seeking international arrest warrants. An investigation is not a conviction, and the warrants have not been reported as executed.
The C4 report also attributes other operations against France since 2020, including a 2023 attack on the Charlie Hebdo website and an attempt to hijack video display screens during the Paris 2024 Olympics, to a separate IRGC unit called Shahid Shoostari. Those earlier allegations are distinct from the supermarket attack and do not, by themselves, prove who was responsible for it.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Evidence and Legal Questions Remain
France has published indicators supporting its attribution, but the material described so far is a combined case of circumstantial technical clues, not a court-tested finding. The available source material does not provide a full independent assessment of the indicators, explain how investigators established the links between the infrastructure and the named unit, or show whether alternative explanations were ruled out.
Iran had not publicly responded by Monday evening, November 9, according to The Record. It is also unclear whether the country will challenge France’s evidence, whether the proposed EU sanctions will win support, and whether authorities will execute the sought international arrest warrants. The final scale of the damage and the full list of affected retailers are not specified in the material provided.
Sanctions and Investigation Ahead
France says it will propose new EU sanctions in response to the attack. No specific measures or timetable are given in the source material, so the proposal’s scope and support from other member states remain open.
The Paris judicial investigation will seek to establish who was involved and whether the allegations can be supported in court. Prosecutors are seeking international arrest warrants for the unit’s head and two deputies, according to the AP. Further information from French authorities, a response from Iran, or developments in the legal process could clarify the evidence and consequences.
The incident also points to a practical security issue raised by French cybersecurity officials: the affected controllers had management interfaces exposed to the internet, which France’s computer emergency team had warned was contrary to good practice. The source material does not say what protections retailers have since added or whether all affected systems have been secured.
Key Questions
What happened to the supermarket refrigeration systems?
France’s C4 report says attackers changed refrigeration controllers’ defrost settings to high temperatures overnight on October 11–12, causing losses of goods and at least 15 fires.
Who does France say was responsible?
France attributes the attack to Shahid Kaveh, which it describes as a cyber-offensive unit affiliated with Iran’s Islamic Revolutionary Guard Corps. This is France’s accusation, not a court finding.
What evidence has France published?
The report points to shared attack infrastructure, use of the FOFA scanning tool, a propaganda channel that relayed the attack and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran.
How much damage did the attack cause?
France’s foreign ministry said food losses amounted to several tens of millions of euros. The report described significant product losses and at least 15 fires. The provided material does not give a final independently audited total.
What happens next?
France says it will propose new EU sanctions, while the Paris prosecutor pursues a judicial investigation and seeks international arrest warrants for the unit’s head and two deputies. Iran had not publicly responded by Monday evening, November 9, according to The Record.
Source: ThorstenMeyerAI.com
