🔍 Read the full analysis: France Says Iran’s Guards Hacked Supermarket Fridges: The Evidence on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France says the IRGC cyber unit Shahid Kaveh carried out an October 11–12 attack that altered refrigeration settings at about 700 supermarket sites, causing major food losses and at least 15 fires, according to official reports. France cites several technical and language indicators; the attribution is an official claim, not a court finding, and Iran had not publicly responded by Monday evening.
France on November 9 attributed an October 11–12 cyberattack on refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit France says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). French officials say altered defrost settings caused major food losses and at least 15 fires; the attribution is based on a collection of technical indicators, not a court ruling.
The French Cyber Crisis Coordination Centre (C4) said attackers changed refrigeration equipment’s defrost settings to high temperatures. Its report describes significant losses of goods and fires at at least 15 locations. France’s foreign ministry put the total food losses at several tens of millions of euros. The ministry said the attack affected more than 700 retail sites, while the C4 report described controllers at about 700 sites.
France’s attribution rests on what its technical report calls a bundle of indicators: shared attack infrastructure, use of an internet-scanning tool the report associates with the group, a propaganda channel that relayed the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to reporting by the Associated Press. France has not presented these indicators as a single conclusive piece of evidence.
France summoned Iran’s ambassador and said it would propose new European Union sanctions. Paris prosecutor Laure Beccuau opened a judicial investigation into the group’s alleged leader, two deputies and other possible participants. The prosecutor’s office is seeking international arrest warrants, the Associated Press reported. An investigation is not a conviction; the allegations have not been tested in court. Iran had not publicly responded by Monday evening, according to The Record.
France Says Iran’s Guards Hacked Supermarket Fridges: The Evidence
France attributes a disruptive attack on supermarket refrigeration systems to an IRGC cyber unit. The attribution is an official claim, not a court finding.
What France says happened
During the October 11–12 attack, attackers allegedly changed refrigeration controllers’ defrost settings to high temperatures.
French officials say attackers altered defrost controls at supermarket sites.
The changes reportedly led to major food losses and fires at at least 15 locations.
On November 9, France attributed the operation to Shahid Kaveh, which it says is affiliated with Iran’s IRGC.
Indicators behind the attribution
France cites several clues considered together, rather than one publicly conclusive piece of evidence.
Shared infrastructure
The French report cites attack infrastructure it associates with the group.
FOFA scanning
The report points to use of an internet-scanning tool it associates with Shahid Kaveh.
Farsi traces
French officials cite traces of Farsi and a propaganda channel that relayed the attack.
Iran-linked IP addresses
The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the Associated Press.
Operational risk for retailers
Connected building equipment can affect physical operations, not just information systems.
- Internet-facing management interfaces can create an avenue for remote disruption.
- France’s response team warned that exposed interfaces were contrary to good practice.
- Altered refrigeration settings can spoil food and disrupt stores.
- Officials reported fires, though public material does not detail how each was linked to equipment failures.
Diplomatic and legal response
France is pursuing state-level measures alongside a criminal investigation.
| Action | Status | What it means |
|---|---|---|
| Diplomatic | Announced | France summoned Iran’s ambassador and said it would propose new EU sanctions. |
| Judicial | Under investigation | Prosecutors are examining the alleged roles of the unit’s leader, two deputies and others. |
| International warrants | Being sought | Reported pursuit of warrants does not mean they have been issued. |
Food Losses and Cybersecurity Risks
The incident connects cyber risk to ordinary physical infrastructure. Supermarket refrigeration controllers are operational technology: systems that regulate equipment in buildings and industrial settings. If reachable over the internet and poorly secured, they can be altered remotely, with consequences that extend beyond data theft to spoiled food, disrupted stores and fire risks.
The French computer emergency response team had warned in October that the affected controllers exposed management interfaces to the internet, describing that configuration as “contrary to good practice.” That warning points to a practical security issue for retailers and other organizations using connected building equipment: internet-facing management access can create an avenue for disruption. The public material does not establish whether every affected site had the same exposure or configuration.
The diplomatic response also raises the stakes. France’s planned EU sanctions proposal and its pursuit of international warrants turn the attribution into more than a technical assessment. They signal that the government is treating the alleged operation as a matter of national security and criminal law, while the legal process still has to establish individual responsibility.
Popular right now
Hisense E6SR Series 55-Inch 4K UHD Hi-QLED Roku Smart TV
Vitamix VX1 Professional-Grade Blender, 64 oz, Black
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
As an affiliate, we earn on qualifying purchases.
From October Attack to Attribution
The attack took place overnight from Sunday, October 11, to Monday, October 12, according to the C4 report published on November 9. France’s public attribution came roughly four weeks later. The report was issued through CERT-FR as CERTFR-2026-CTI-009 and sets out the technical basis for the government’s position.
Three parts of the French state spoke publicly on November 9. The foreign ministry issued a formal declaration naming Iran and Shahid Kaveh. At a G7 meeting in Paris, Foreign Minister Jean-Noël Barrot also named the IRGC. The technical report came from C4, which brings together France’s cybersecurity agency ANSSI, military cyber command, the defence procurement agency and the DGSE and DGSI intelligence services.
The French report also attributes earlier operations against France since 2020 to a separate IRGC unit, Shahid Shoostari. Those allegations include an attack on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics. They are separate from the supermarket incident, whose attribution is the focus of the November announcement.
“France “is in a position to attribute to Iran” the destructive actions, carried out by “the cyber-offensive unit SHAHID KAVEH.””
— France’s foreign ministry
Evidence and Allegations Still Untested
France has published several indicators supporting its attribution, but the cited material does not amount to a judicial determination of who carried out the attack. Cyber operations can use infrastructure that obscures an operator’s location or identity; the French report’s evidence must be assessed as a combined set of clues, rather than treated as a publicly established court finding.
It is also unclear from the available reporting how many controllers were directly accessed, how many stores suffered losses, or how the reported fires were linked to specific equipment failures. The source material gives a broad site count and a minimum number of fires, but does not provide a full incident-by-incident accounting. Iran’s response was not publicly available by Monday evening, according to The Record.
The prosecutor’s investigation remains at an early stage. The alleged unit members have not been convicted, and the reported pursuit of international arrest warrants does not establish that the warrants have been issued or that the named individuals will be apprehended.
Sanctions and the French Investigation
France says it will propose new EU sanctions; the source material does not specify when the proposal will be submitted or whether other member states will support it. Any sanctions decision would require further action at the European level.
In France, the judicial investigation will examine the alleged roles of Shahid Kaveh’s head, two deputies and any other people identified by investigators. The next public developments may include further details from prosecutors, decisions on international arrest warrants, or a response from Iran. Until then, the government’s attribution remains the central official account, while the legal allegations remain unproven.
Key Questions
What happened to the supermarket refrigeration systems?
France’s C4 report says attackers changed defrost settings to high temperatures at controllers serving about 700 retail sites during the October 11–12 attack. Officials reported major food losses and at least 15 fires.
Who does France say was responsible?
France attributes the operation to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps. This is the French government’s attribution, not a court ruling.
What evidence has France cited?
The French report cites shared attack infrastructure, use of the FOFA scanning tool, a propaganda outlet that relayed the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the Associated Press.
How much damage was reported?
France’s foreign ministry described food losses as several tens of millions of euros. The C4 report said there were significant goods losses and fires in at least 15 cases. The available source material does not give a complete site-by-site damage total.
Has Iran responded, and have suspects been convicted?
Iran had not publicly responded by Monday evening, according to The Record. The Paris prosecutor has opened an investigation and is seeking international arrest warrants, but no conviction is reported; the allegations remain untested in court.
Source: ThorstenMeyerAI.com
