🔍 Read the full analysis: France Says Iranian Hackers Targeted Supermarket Refrigeration Systems on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an Iranian Revolutionary Guard Corps cyber unit called Shahid Kaveh carried out an October attack on supermarket refrigeration controllers. France reports food losses worth several tens of millions of euros and at least 15 fires; Iran had not publicly responded by Monday evening, according to The Record.
France has attributed an October cyberattack that disrupted refrigeration controllers at more than 700 retail sites to Shahid Kaveh, a cyber unit France says is affiliated with Iran’s Islamic Revolutionary Guard Corps. The government said the attack changed defrost settings, causing major food losses and at least 15 fires; it has summoned Iran’s ambassador and plans to propose new European Union sanctions.
France’s Cyber Crisis Coordination Centre, known as C4, said in a report published November 9 that the attack took place overnight from October 11 to 12. The attackers changed refrigeration equipment’s defrost parameters to high temperatures, the report said. France’s foreign ministry put the affected number at more than 700 sites, while the C4 report described controllers at about 700 retail sites. The report said the incident caused significant goods losses and fires in at least 15 cases.
The foreign ministry estimated total food losses at several tens of millions of euros. The Associated Press reported that temperatures reached 50 degrees Celsius for about six hours and that the Intermarché chain reported losses of tens of millions of euros in a single day. Those figures were reported by the AP; the French government’s public estimate for total food losses uses a broader, approximate description.
France’s attribution rests on a group of indicators set out in the C4 report, rather than a single publicly described piece of evidence. They include shared attack infrastructure, use of the FOFA internet-scanning tool, a propaganda outlet that relayed the attack, and traces of Farsi. The Paris prosecutor’s office also cited internet addresses linked to devices in Iran, according to the AP. The prosecutor has opened a judicial investigation and is seeking international arrest warrants for Shahid Kaveh’s head and two deputies. An investigation is not a conviction.
France links supermarket fires to refrigeration cyberattack
France says an Iranian cyber unit altered refrigeration settings at retail sites, causing food losses and fires. The attribution has led to diplomatic and legal action, while the investigation continues.
How the attack disrupted stores
France’s C4 report says attackers changed refrigeration controllers’ defrost settings to high temperatures.
The attack took place overnight from October 11 to 12, 2026.
France reported disruption at more than 700 retail sites.
France reported significant food losses and fires in at least 15 cases.
What the incident means for retailers
Connected equipment can affect daily operations when its controls are exposed or poorly secured.
Stock and service at risk
Disrupted refrigeration can spoil goods and interrupt store operations.
Review exposed controls
French authorities had warned that affected controllers’ management interfaces were exposed to the internet.
Building systems matter
The incident highlights operational risks for connected equipment in commercial and industrial settings.
Attribution and evidence
France attributes the attack to Shahid Kaveh, which it says is affiliated with Iran’s Islamic Revolutionary Guard Corps.
- Shared attack infrastructure
- Use of the FOFA scanning tool
- Farsi traces and a propaganda outlet relaying the attack
- The evidence has not been tested in court
- Iran had not publicly responded by Monday evening, according to The Record
- Details on warrants and suspects’ custody were not given
France’s next steps
The announcement combines diplomatic pressure with a continuing criminal investigation.
Risks to Connected Store Equipment
The incident shows how a cyberattack on ordinary building and refrigeration equipment can affect physical operations, not just computer networks. Altered temperature settings can spoil stock and, in the cases reported by France, were associated with fires. For retailers, the consequences can include disrupted service, damaged goods and substantial losses.
France’s cybersecurity authorities had warned in October that the affected controllers had management interfaces exposed to the internet, which they described as contrary to good practice. That detail makes the incident relevant beyond supermarkets: connected equipment used in commercial buildings and industrial settings can create operational risks when exposed or poorly secured. The source material does not establish that every exposed controller is vulnerable or that the same attack method would work elsewhere.
The diplomatic response also turns a technical incident into a matter of state relations. France’s planned EU sanctions proposal and its request for international arrest warrants signal that the government is pursuing both political and legal consequences. Those steps do not, by themselves, settle the attribution or establish criminal responsibility in court.
Products Worth Considering
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
From October Attack to Attribution
The attack occurred on October 11–12, but France named its alleged perpetrator nearly four weeks later, on November 9. Three strands of official action followed that day: the foreign ministry issued a formal declaration of attribution, C4 published a technical report through CERT-FR, and the Paris prosecutor announced a judicial investigation. Foreign Minister Jean-Noël Barrot made the attribution publicly at a G7 meeting in Paris.
C4 brings together France’s cybersecurity agency ANSSI, military cyber command, defence procurement agency and intelligence services DGSE and DGSI. Its report says the same infrastructure was also used during the period to scan Schneider Electric equipment used in small and medium energy and water production units. It describes use of the Modbus industrial protocol on port 502 and says Shahid Kaveh had used that technique since at least April 2026.
The report also attributes other operations against France since 2020 to a separate IRGC unit, Shahid Shoostari, including the 2023 attack on the Charlie Hebdo website and an attempt to hijack video display screens during the Paris 2024 Olympics. These are attributions made by French authorities; they are separate from the supermarket incident.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Limits of the Public Evidence
France has published several indicators supporting its attribution, but the material described publicly is a bundle of technical and contextual clues, not a court-tested finding. Cyber operations can involve infrastructure routed through other countries, and public reporting does not establish how investigators ruled out possible false leads or alternative explanations. The French government has stated its conclusion; the evidence has not been tested in a trial.
Iran had not publicly responded by Monday evening, according to The Record. The source material does not give a detailed account of how many stores suffered direct equipment damage, the full breakdown of losses by retailer, or whether all reported fires were independently linked to the altered settings. It also does not state whether the international arrest warrants have been issued or whether any suspects are in custody.
French Legal and EU Steps
France says it will propose new EU sanctions in response to the incident. The source material does not specify the timing, proposed measures or whether other member states support the proposal. Any EU action would require further political decisions beyond France’s announcement.
The Paris prosecutor’s judicial investigation is continuing, with the office seeking international arrest warrants for the alleged unit head and two deputies. Investigators may pursue additional evidence and identify other people, but no court outcome or timetable is given. Iran’s response, any further French technical disclosures and the progress of the legal and diplomatic measures remain developments to watch.
Key Questions
What happened to the supermarket refrigeration systems?
France’s C4 report says attackers changed refrigeration controllers’ defrost settings to high temperatures overnight on October 11–12, 2026. France said the incident affected more than 700 retail sites and caused major food losses and at least 15 fires.
Who does France say was responsible?
France attributes the attack to Shahid Kaveh, which it describes as a cyber unit affiliated with the Islamic Revolutionary Guard Corps. This is the French government’s attribution, not a court judgment.
What evidence has France made public?
The C4 report cites shared attack infrastructure, use of the FOFA scanning tool, a propaganda outlet that relayed the attack and traces of Farsi. The Paris prosecutor also cited IP addresses linked to devices in Iran, according to the AP.
How much damage did the attack cause?
France’s foreign ministry estimated food losses at several tens of millions of euros, and the C4 report said there were significant goods losses and at least 15 fires. The AP reported an estimate of tens of millions of euros in losses for Intermarché alone in a single day.
What happens next?
France says it will propose new EU sanctions, while the Paris prosecutor’s investigation continues and the office seeks international arrest warrants for the alleged unit head and two deputies. The timing and outcome of those steps are not yet clear.
Source: ThorstenMeyerAI.com
