🔍 Read the full analysis: Why France Is Blaming Iran’s Guards For Supermarket Fridge Hacking on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
France said on November 9 that an Iranian Revolutionary Guard Corps cyber unit, Shahid Kaveh, carried out an October attack that disrupted refrigeration controllers at about 700 French retail sites. The attribution is based on a bundle of technical and language indicators; Iran had not publicly responded by Monday evening, and the allegations have not been tested in court.
France on November 9 attributed an overnight attack on refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit France says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The attack changed defrost settings, causing substantial food losses and at least 15 fires, according to a French government technical report; the attribution is an official French claim, not a court finding.
France’s Cyber Crisis Coordination Centre (C4) said the controllers’ defrost parameters were changed to high temperatures during the night of October 11–12. The centre’s report says the disruption led to “significant losses of goods” and fires in at least 15 cases. The foreign ministry put losses at several tens of millions of euros and said more than 700 sites were affected. The Associated Press reported that temperatures reached 50°C for about six hours and that Intermarché alone reported losses of tens of millions of euros in one day.
The attribution draws on several indicators, rather than a single piece of publicly disclosed proof. France’s five-page CERT-FR report cites shared attack infrastructure also used to scan industrial equipment, use of the FOFA internet-scanning tool, a propaganda outlet’s relay of the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP.
France summoned Iran’s ambassador and said it would propose new EU sanctions. Paris prosecutor Laure Beccuau opened a judicial investigation into the alleged unit head, two deputies and other potentially identified people. The prosecutor’s office is seeking international arrest warrants, the AP reported. An investigation and warrant request do not establish guilt.
Why France Blames Iran’s Guards for Supermarket Fridge Hacking
France says an IRGC-linked cyber unit disrupted refrigeration at hundreds of retail sites. The accusation has serious business and diplomatic consequences, but has not been tested in court.
What the attack did
France says controllers were altered overnight on October 11–12, disrupting cooling and damaging stock.
Controllers were set to high temperatures during the night.
France reported significant goods losses and fires at some sites.
How France built its case
The public attribution draws on several technical and online indicators.
Shared attack infrastructure
France says infrastructure was also used to scan industrial equipment.
FOFA and Modbus
The report cites FOFA use and links the unit to Modbus scanning.
Farsi traces
French authorities cite language traces and an online outlet relaying the attack.
Business exposure
Connected operational equipment can turn a cyber incident into physical and financial harm.
- Management interfaces on affected controllers were reachable from the internet.
- Cooling settings affected food safety and stock across retail sites.
- Review access to operational equipment.
- Check whether other connected systems remain exposed.
France’s response
The November 9 announcement set diplomatic and legal steps in motion.
Costs for Retailers and Connected Systems
The incident shows how internet-accessible equipment that controls ordinary business operations can become a source of physical and financial harm. A change to refrigeration settings affected food safety and stock across many retail locations, with reported losses reaching tens of millions of euros. The attack did not require a widely publicized failure in a consumer device; it targeted management systems used to operate commercial cooling equipment.
France’s response also turns a cyber incident into a diplomatic and legal dispute. The government’s attribution could shape EU sanctions discussions and cooperation on investigations, while the prosecutor’s request for international warrants signals an effort to pursue named suspects. Those steps are consequential, but they remain separate from a judicial determination that the accused individuals or unit were responsible.
For businesses, the technical report points to exposure as a practical risk. France’s computer emergency response team had warned in October that management interfaces on affected controllers were accessible from the internet, which it described as contrary to good practice. The report does not establish that every exposed controller was compromised, but it highlights the security implications of leaving operational equipment reachable online.
Popular right now
eufy E15 Gen 2 Wire-Free Robotic Lawn Mower
Ninja Crispi Microwave and Air Fryer with FusionCrisp, Silver, MW101
Dyson Ball Animal 3 Upright Vacuum
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
The attack took place on October 11–12; France announced its attribution about four weeks later. Three strands of official action followed on November 9: the foreign ministry issued a formal declaration, technical agencies published their account of the indicators, and the Paris prosecutor opened an investigation. Foreign Minister Jean-Noël Barrot made the government’s accusation at a G7 meeting in Paris.
The C4 report brings together France’s cybersecurity agency ANSSI, military cyber command, defence procurement agency and intelligence services. It says the same infrastructure was used during the relevant period to scan Schneider Electric equipment used in smaller energy and water production units. The report says the industrial protocol Modbus on port 502 had been used by Shahid Kaveh since at least April 2026. It also links the group to the outlet CyberbanNews, which relayed the supermarket attack from October 13.
France’s report separately attributes earlier operations against French targets since 2020, including a 2023 attack on the Charlie Hebdo website and an attempt to hijack video display screens during the Paris 2024 Olympics, to another IRGC unit, Shahid Shoostari. Those allegations are broader context; they are distinct from the specific claim that Shahid Kaveh carried out the supermarket incident.
““I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.””
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Evidence, Response and Court Tests
The public case rests on a bundle of indicators, including infrastructure, tool use, language traces and online claims of responsibility. Such indicators can support an attribution, but the French report is not a court judgment, and the available source material does not show that the underlying evidence has been independently tested in court. The prosecutor’s investigation may develop or challenge parts of the public account.
Iran had not publicly responded by Monday evening, according to The Record. It is also not clear from the cited material how many individual controllers were compromised, how all affected stores were counted, or whether the reported losses and fires have been independently tallied. The precise relationship between the alleged operators and any Iranian state decision-makers has not been established publicly.
The prosecutor’s office is seeking international arrest warrants, but the source material does not specify when a decision on those requests is expected or how they would be carried out. France has also said it will propose EU sanctions; the measures, timetable and support from other EU governments are not yet clear.
French Proposals and the Investigation
France has said it will put forward new EU sanctions, leaving the content and timing of any measures to be determined through discussions with other member states. The Paris judicial investigation will examine the alleged roles of Shahid Kaveh’s head, two deputies and any other people identified by investigators. The requested international warrants remain a legal step to be resolved, not proof of responsibility.
Further public information may come from the prosecutor’s office, French authorities or a response from Iran. Retailers and equipment operators will also face questions about whether exposed management interfaces have been secured and whether other connected systems remain at risk. The available reporting does not describe a government deadline or a confirmed timetable for those follow-up steps.
Key Questions
What happened to the supermarket refrigeration systems?
France’s C4 report says attackers changed the defrost settings on refrigeration controllers to high temperatures during the night of October 11–12. It reports major food losses and at least 15 fires.
Who does France say was responsible?
France attributes the attack to Shahid Kaveh, which it describes as a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. This is France’s official attribution, not a court finding.
What evidence has France cited?
The French report cites shared attack infrastructure, use of the FOFA scanning tool, a propaganda outlet’s relay of the attack and traces of Farsi. The Paris prosecutor also cited IP addresses linked to devices in Iran, according to the AP.
How much damage was reported?
France’s foreign ministry described food losses as several tens of millions of euros and said more than 700 sites were affected. The AP reported that Intermarché alone described losses of tens of millions of euros in a single day.
What happens next?
France plans to propose new EU sanctions, while a Paris judicial investigation proceeds and prosecutors seek international arrest warrants. The timing and outcome of those steps have not been confirmed.
Source: ThorstenMeyerAI.com
