🔍 Read the full analysis: France Says Iran’s Guards Breached Supermarket Fridge Systems on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an Iranian Revolutionary Guard cyber unit called Shahid Kaveh carried out an October attack on refrigeration controllers at about 700 retail sites. French officials cite several technical indicators; Iran had not publicly responded by Monday evening, and the attribution has not been tested in court.
France said on November 9 that a cyber unit of Iran’s Islamic Revolutionary Guard Corps, known as Shahid Kaveh, carried out an October attack that altered refrigeration settings at about 700 retail sites. The French government cited technical indicators in its attribution, summoned Iran’s ambassador and said it would propose new European Union sanctions; the accusation has not been tested in court.
The attack took place overnight from October 11 to 12, according to a report published by France’s Cyber Crisis Coordination Centre, or C4. It said the attackers changed the defrost parameters on refrigeration equipment to high temperatures. The report recorded significant losses of goods and fires in at least 15 cases. France’s Foreign Ministry described the affected footprint as more than 700 sites.
France’s cybersecurity services said their attribution rests on a bundle of indicators, rather than a single piece of evidence. The C4 report cited shared attack infrastructure, use of the internet-scanning tool FOFA, a propaganda channel that relayed the operation and traces of Farsi. The Paris prosecutor’s office also pointed to IP addresses linked to devices in Iran, according to the Associated Press.
French authorities announced diplomatic, political and judicial measures alongside the attribution. The Iranian ambassador was summoned, and France said it would propose new EU sanctions. Paris prosecutor Laure Beccuau opened a judicial investigation into the alleged role of the unit’s head, two deputies and other potential suspects. The prosecutor’s office is seeking international arrest warrants, the AP reported. An investigation and warrant request are not convictions.
France blames Iran-linked unit for supermarket fridge attack
France says an IRGC cyber unit altered refrigeration settings across about 700 retail sites. The attribution is under investigation and has not been tested in court.
What happened
France says the attack took place overnight from October 11 to 12, changing refrigeration controllers’ defrost settings to high temperatures.
Attackers changed refrigeration settings at retail sites, according to France’s C4 report.
The report recorded significant goods losses and fires in at least 15 cases.
France summoned Iran’s ambassador, proposed new EU sanctions and opened a judicial investigation.
Why France points to Shahid Kaveh
French officials cite a bundle of technical and contextual indicators, not a single piece of evidence.
Shared attack systems
The C4 report says infrastructure used in the operation was also used to scan industrial equipment.
FOFA and Modbus
The report cites habitual use of the FOFA scanning tool and Modbus activity dating back to April 2026.
Farsi traces
French analysts also reported traces of Farsi in the attack infrastructure.
Business exposure
The incident shows how connected equipment can disrupt physical operations, not just digital systems.
- Internet-exposed management interfaces can create entry points.
- Changing equipment settings can damage goods and interrupt retail operations.
- Review remote access to refrigeration and other connected controls.
- France’s cyber emergency team had warned that exposed interfaces went against good practice.
What remains unresolved
The government’s attribution and the legal process are distinct from a court finding.
| Question | What is known | What remains open |
|---|---|---|
| Attribution | France names Shahid Kaveh | No court ruling has tested the claim |
| Damage | Losses and fires were reported | Full site-by-site scope is not established |
| Next steps | Investigation opened; warrants sought | Sanctions, arrests and proceedings remain uncertain |
Food Losses and Cybersecurity Risks
The incident shows how internet-connected equipment used to control ordinary commercial operations can create risks beyond data theft. In this case, French officials say changes to refrigeration settings led to food losses and fires, making the attack a disruption to physical infrastructure and retail supply, not simply a compromise of computer systems.
The French cyber emergency team had warned in October that management interfaces on the affected controllers were exposed to the internet, contrary to good practice, according to the source report. That points to a practical security concern for businesses using connected building or industrial equipment: remotely accessible controls can become a point of entry. The French account does not establish whether the same weakness was present at every affected site.
The accusation also raises diplomatic stakes. France has publicly blamed a named Iranian military-linked unit and is pursuing sanctions and legal measures. Those steps could add to tensions between the two governments, while the evidence and any individual responsibility remain matters for investigation and, potentially, legal proceedings.
Products Worth Considering
LEVOIT Vital 200S-P Smart Air Purifier for Large Rooms up to 1875 ft², Quiet 27 dB Operation, AHAM VERIFIDE Certified, Air Quality Monitor,
Oral-B iO Series 3 Rechargeable Electric Toothbrush for Adults, Black, 3 Modes, 2 Brush Heads and Travel Case
Therabody JetBoots Prime Wireless Compression Boots – Regular 30-34 Inseam
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
France’s Foreign Ministry issued a formal declaration attributing the operation to Shahid Kaveh, which it described as part of the IRGC’s electronic and cyber centre. Foreign Minister Jean-Noël Barrot confirmed the accusation at a G7 meeting in Paris, according to AFP. The technical basis was set out in a five-page C4 report published through CERT-FR.
The report says the same infrastructure was used during the relevant period to scan Schneider Electric equipment used in smaller energy and water production units. It also says the group had used the industrial protocol Modbus on port 502 since at least April 2026, and that FOFA was a tool the operators habitually used. CyberbanNews, which the report associates with Shahid Kaveh, relayed the supermarket attack from October 13. French analysts also found traces of Farsi in the attack infrastructure.
The report separately attributes some earlier operations against France since 2020 to another IRGC unit, Shahid Shoostari. These include the 2023 attack on the Charlie Hebdo website and an attempt to hijack video display screens during the Paris 2024 Olympics, according to the French report. Those claims provide background to France’s assessment but are separate from the supermarket incident.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, as quoted by AFP
Evidence and Questions Still Open
France has released several indicators supporting its assessment, but the public material described here is not a court ruling and does not resolve every question about the operation. Iran had not publicly responded by Monday evening, according to The Record. The available account does not include an independent examination of the evidence by a court or a response from the named unit.
The precise total of affected locations also varies by official description: the source material says the technical report referred to about 700 retail sites, while the Foreign Ministry said more than 700. The full scope of damage at individual stores, the number of systems directly accessed and how each site was affected are not established in the cited material. The AP reported that temperatures reached 50 degrees Celsius for about six hours and that Intermarché reported losses of tens of millions of euros in a day; France’s Foreign Ministry put overall food losses at several tens of millions of euros. These figures are attributed reports, not a complete audited accounting.
France’s attribution remains a government conclusion based on technical and contextual indicators. The investigation may identify additional people or evidence, but responsibility has not been established through a trial.
Sanctions and Investigation Ahead
France says it will put forward new EU sanctions, but the source material does not specify which measures it will seek or when other EU governments will consider them. The ambassador’s summons has already taken place; any further diplomatic response from Iran was not reported by Monday evening.
The Paris judicial investigation is expected to pursue the alleged roles of the unit’s head and two deputies, as well as any other people identified. Prosecutors are seeking international arrest warrants, according to the AP. Whether those requests are issued, and whether suspects could be arrested or brought before a French court, remains unknown.
For businesses, the immediate practical issue is the exposure of management interfaces on connected refrigeration equipment. France’s cyber emergency team had flagged that exposure in October. Further technical guidance, additional findings from the investigation or a public response from Iran could clarify the attack’s reach and the steps authorities expect operators to take.
Key Questions
What happened to the supermarket refrigeration systems?
France’s C4 report says attackers changed refrigeration controllers’ defrost settings to high temperatures overnight on October 11-12. It recorded significant goods losses and fires in at least 15 cases.
Who does France blame for the attack?
The French government attributes the attack to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps. That is France’s assessment; it has not been tested in court.
What evidence has France cited?
France cited shared attack infrastructure, use of the FOFA scanning tool, a propaganda channel that relayed the attack and traces of Farsi. The Paris prosecutor’s office also referred to IP addresses linked to devices in Iran, according to the AP.
What consequences have French authorities announced?
France summoned Iran’s ambassador and said it would propose new EU sanctions. The Paris prosecutor opened a judicial investigation and is seeking international arrest warrants for the unit’s head and two deputies, according to the AP.
Has Iran responded, and has anyone been convicted?
Iran had not publicly responded by Monday evening, according to The Record. No conviction has been reported; the judicial investigation is ongoing, and the French attribution remains an official allegation.
Source: ThorstenMeyerAI.com
