🔍 Read the full analysis: France Says Iran Targeted Supermarket Fridges—Here’s What It Showed on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France has attributed an October cyberattack on supermarket refrigeration controllers to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps. French technical officials cite shared infrastructure, a scanning tool, a propaganda channel and traces of Farsi; the attribution has not been tested in court, and Iran had not publicly responded by Monday evening.
France on November 9 attributed a cyberattack that disrupted refrigeration at about 700 supermarket and retail sites to Shahid Kaveh, a unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). French officials say altered defrost settings caused major food losses and at least 15 fires; the government has summoned Iran’s ambassador and plans to seek new EU sanctions, while the Paris prosecutor has opened an investigation.
The attack took place overnight from October 11 to 12, according to a report from France’s Cyber Crisis Coordination Centre, or C4, published through the national cybersecurity agency’s CERT-FR service. The report says attackers changed refrigeration equipment’s defrost parameters to high temperatures. It records significant goods losses and fires in at least 15 cases. France’s foreign ministry put the number of affected sites at more than 700.
France’s attribution rests on several technical and operational indicators rather than one conclusive piece of evidence, the government report says. These include shared attack infrastructure, use of the FOFA internet-scanning tool, a propaganda outlet that relayed the operation, and traces of Farsi. The report also links some infrastructure to scanning of Schneider Electric equipment used in smaller energy and water facilities. The Paris prosecutor, according to the Associated Press, cited IP addresses linked to devices in Iran as well as the use of Farsi.
Foreign Minister Jean-Noël Barrot confirmed the attribution at a G7 meeting in Paris, according to AFP. The foreign ministry said the operation was carried out by Shahid Kaveh, which it described as part of the IRGC’s electronic and cyber centre. Prosecutor Laure Beccuau opened a judicial investigation into the unit’s head, two deputies and other people who may be identified. The prosecutor’s office is seeking international arrest warrants, AP reported. Those steps are part of an investigation, not a court finding of guilt.
France Says Iran Targeted Supermarket Fridges—Here’s What It Showed
France says an October cyberattack disrupted refrigeration at more than 700 retail sites. Its attribution to an Iran-linked unit is based on several indicators and remains subject to legal review.
How the attack caused damage
France says attackers changed refrigeration controllers’ defrost settings to high temperatures.
Internet-facing management interfaces exposed connected refrigeration equipment to remote interference.
France’s report says attackers changed defrost parameters to high temperatures.
The disruption led to significant food losses and fires in at least 15 cases.
What France says points to Shahid Kaveh
The government cites a combination of technical and operational indicators, not one conclusive piece of evidence.
Shared systems
France says attack infrastructure was also used to scan Schneider Electric equipment.
FOFA scanning
The report identifies FOFA as a tool the operators habitually used.
Farsi traces
French officials cite traces of Farsi among the indicators linking the activity to Iran.
Propaganda outlet
The report says CyberbanNews relayed the attack beginning October 13.
The response—and what remains open
France has taken diplomatic and judicial steps, but the allegations have not been tested in court.
- Summoned Iran’s ambassador.
- Plans to propose new EU sanctions.
- Paris prosecutors opened an investigation and are seeking international arrest warrants.
- No court finding of guilt; the investigation is ongoing.
- Iran had not publicly responded by Monday evening.
- EU support for sanctions and the issuance of warrants are not established.
Food Losses and Diplomatic Fallout
The attack targeted equipment that keeps food cold, turning access to connected refrigeration controllers into a potential route to physical damage and costly disruption. France’s report says the altered settings led to major product losses and at least 15 fires. The foreign ministry described the total food losses as several tens of millions of euros. The Associated Press reported that temperatures reached 50°C for about six hours and that Intermarché alone reported losses of tens of millions of euros in one day; those figures are attributed to the reporting and company account cited there.
The response now extends beyond cybersecurity. France has summoned Iran’s ambassador, says it will propose new EU sanctions, and has asked prosecutors to pursue suspects internationally. The government’s public attribution may shape relations with Tehran and discussions among European partners, but the available material does not establish whether other EU governments will support the proposed measures or whether any arrests will follow.
For businesses, the incident also shows how a weakly protected management interface can expose essential building systems to remote interference. The affected controllers were not described as sophisticated weapons; France’s emergency response team had warned that their internet-facing management interfaces were exposed contrary to good practice. That warning makes the case relevant to operators of retail, industrial and other connected facilities, even as the precise scope of any wider risk remains unclear.
Products Worth Considering
Samsung 34-inch ViewFinity S50GC Ultra-WQHD Monitor
Dell UltraSharp U2724DE 27-Inch WQHD IPS Black Monitor
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
France’s technical case is set out in a five-page C4 report published by CERT-FR as CERTFR-2026-CTI-009. C4 coordinates work involving France’s cybersecurity agency ANSSI, military cyber command, defence procurement agency and domestic and foreign intelligence services. The report describes a group of indicators supporting the attribution; it does not amount to a judicial determination.
The report says infrastructure used around the time of the supermarket attack was also used to scan Schneider Electric equipment and that the group had used the industrial protocol Modbus on port 502 since at least April 2026. It also identifies FOFA as a tool the operators habitually used and says the outlet CyberbanNews relayed the attack from October 13. French officials say these clues, alongside traces of Farsi, point to Shahid Kaveh.
The same report attributes other operations against France since 2020 to a separate IRGC unit, Shahid Shoostari, including an attack on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics. These are separate allegations in the French report, not additional findings in the supermarket case. The supermarket incident itself occurred on October 11–12, with France announcing its attribution about four weeks later.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, as quoted by AFP
Attribution Still Faces Legal Review
France has published its reasoning, but the evidence has not been tested in court, and an investigation is not a conviction. Cyberattack attribution can be difficult because operators may route activity through third-party systems or leave misleading traces. The French report presents multiple indicators that it says point to Iran and Shahid Kaveh; the source material does not include an independent technical assessment or a response from the accused parties.
Iran had not publicly responded by Monday evening, according to The Record. It is also not clear from the available reporting whether the country will contest France’s account, whether other governments have reached the same assessment, or whether the requested international arrest warrants will be issued. The total number of affected sites is described as about 700 in some accounts and more than 700 by the foreign ministry.
Some reported impact figures have different sources and scopes. France’s foreign ministry describes food losses as several tens of millions of euros, while AP cited Intermarché’s reported losses and temperatures of about 50°C for six hours. The source material does not provide a complete store-by-store accounting, the full financial impact across retailers, or details on how many systems were affected at each site.
Sanctions and Investigation Ahead
France says it will propose new sanctions at EU level; the timing and details of that proposal, and whether EU members will adopt it, have not been specified in the supplied reporting. The diplomatic dispute may develop further if Iran responds to the attribution or if France shares additional evidence with partners.
The Paris judicial investigation will examine the allegations against Shahid Kaveh’s head, two deputies and any other people identified by investigators. Prosecutors are seeking international arrest warrants, but the material does not say whether a court has issued them or whether any suspect is in custody. The investigation may provide further details about the attackers, their methods and the evidence linking them to the operation.
For affected businesses and other operators of connected equipment, France’s earlier warning about exposed management interfaces points to a practical security issue: whether such systems can be reached from the public internet and how access is controlled. The supplied sources do not say what remedial steps individual retailers have taken, whether the incident has prompted new national requirements, or whether further attacks have occurred.
Key Questions
What did France say happened to supermarket refrigeration systems?
France’s C4 report says attackers changed refrigeration controllers’ defrost settings to high temperatures overnight on October 11–12. It records significant food losses and fires at at least 15 sites.
Who does France accuse of carrying out the attack?
France attributes the operation to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps. Iran had not publicly responded by Monday evening, according to The Record.
What evidence has France cited?
The French report cites shared infrastructure, the FOFA scanning tool, a propaganda outlet that relayed the attack, and traces of Farsi. The Paris prosecutor also cited IP addresses linked to devices in Iran, according to AP. The material describes a set of indicators, not a court ruling.
What action is France taking?
France has summoned Iran’s ambassador and says it will propose new EU sanctions. The Paris prosecutor has opened a judicial investigation and is seeking international arrest warrants for the unit’s head and two deputies, according to the supplied reporting.
Has a court established who was responsible?
No. France has made a public attribution and prosecutors have opened an investigation, but the allegations have not been tested in court. The supplied sources do not report any arrests or a conviction.
Source: ThorstenMeyerAI.com
