🔍 Read the full analysis: Iran’s Revolutionary Guards And Hacked Fridges: France Presents Its Case on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France says an Islamic Revolutionary Guard Corps cyber unit, Shahid Kaveh, carried out an October 11–12 attack that disrupted refrigeration controls at about 700 retail sites, causing major food losses and at least 15 fires. The government published technical indicators, summoned Iran’s ambassador and plans to propose EU sanctions; Iran had not publicly responded by Monday evening, and no court has tested the allegation.
France on November 9 attributed an October cyberattack on refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit the government says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). French officials say the attack caused major food losses and at least 15 fires; they have summoned Iran’s ambassador and plan to propose new EU sanctions, while Iran had not publicly responded by Monday evening.
The attack took place overnight from October 11 to 12, according to a report from France’s Cyber Crisis Coordination Centre, or C4, published through CERT-FR. The report says the intruders changed refrigeration equipment’s defrost settings to high temperatures. France’s foreign ministry put the number of affected retail sites at more than 700; the technical report describes about 700. It records significant goods losses and fires in at least 15 cases.
The French government’s attribution rests on a bundle of technical indicators, not a single piece of evidence presented as conclusive proof. The C4 report cites shared attack infrastructure, use of the FOFA internet-scanning tool, a propaganda channel associated by the report with Shahid Kaveh relaying the attack, and traces of Farsi in the infrastructure. The Paris prosecutor’s office also pointed to IP addresses linked to devices in Iran, according to reporting by the Associated Press.
France has taken diplomatic, legal and policy steps. The foreign ministry issued a formal declaration of attribution, and Foreign Minister Jean-Noël Barrot confirmed the government’s position at a G7 meeting in Paris. The Paris prosecutor opened a judicial investigation targeting the unit’s head, two deputies and other people who may be identified, and is seeking international arrest warrants, according to the AP. France says it will propose new EU sanctions. These actions do not amount to a court finding of guilt.
France’s case on hacked fridges
France attributes an October attack on retail refrigeration controls to Shahid Kaveh, a unit it says is affiliated with Iran’s Revolutionary Guards. The claim has prompted diplomatic and legal action, but has not been tested in court.
What the attack changed
French technical reporting says intruders altered refrigeration equipment settings.
An October advisory warned that management interfaces on affected controllers were exposed to the internet.
The C4 report says attackers set defrost parameters to high temperatures.
French officials report major food losses and fires at retail sites.
How France builds its case
The government cites a bundle of technical indicators, rather than one conclusive piece of evidence.
Shared systems
The C4 report cites shared attack infrastructure and traces of Farsi.
Scanning activity
The report points to FOFA use and scanning of industrial equipment.
Attack relayed
A channel the report associates with Shahid Kaveh relayed the attack.
France’s response
Diplomatic, legal and policy steps are underway.
What it means for operators
Connected equipment can affect physical operations and the goods businesses store.
- Review internet exposure of equipment management interfaces.
- Protect refrigeration and other industrial controls whose settings affect operations.
- The incident involved refrigeration controls, not a reported compromise of payment systems.
- France’s attribution remains an allegation; no court has tested it.
Food Losses and EU Response
The incident shows how a cyberattack on connected equipment used in ordinary retail operations can cause physical damage and disrupt food storage. France’s report describes altered settings in refrigeration controllers, with major losses of goods and at least 15 fires. The consequences reach beyond data theft or temporary network outages: equipment settings affected the conditions in which stores kept food.
The French attribution also raises the stakes diplomatically. Paris is publicly naming a state-linked unit, has summoned Iran’s ambassador and plans to seek new EU sanctions. The allegation may shape France’s relations with Iran and discussions among European governments, but the published indicators remain the French government’s case, not an independently established legal finding. Any warrants or sanctions proposals face processes beyond the initial announcement.
For businesses, the case draws attention to the security of internet-connected building and industrial controls. France’s cyber emergency team had warned in October that management interfaces on affected controllers were exposed to the internet, contrary to good practice. That warning makes the incident relevant to organizations operating refrigeration, energy, water and other equipment whose settings can affect physical operations.
Products Worth Considering
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The October Attack and French Evidence
France’s attribution came about four weeks after the overnight attack. In an October advisory, the country’s computer emergency response team warned that the affected controllers had management interfaces exposed to the internet. The C4 report says the attackers changed defrost parameters; it does not describe the incident as a compromise of customer payment systems.
The technical report connects the operation to Shahid Kaveh through several indicators. It says infrastructure used during the incident was also used in the same period to scan Schneider Electric equipment used in smaller energy and water production units. The report says the group had used the industrial protocol Modbus on port 502 since at least April 2026, and that FOFA was a tool the operators habitually used. It also cites a channel called CyberbanNews, which it associates with the unit, relaying the attack from October 13, along with traces of Farsi.
France’s announcement also referred to other alleged Iranian cyber operations. The C4 report attributes operations against France since 2020, including a 2023 attack on the Charlie Hebdo website and an attempt to hijack video display screens during the Paris 2024 Olympics, to a different IRGC unit, Shahid Shoostari. Those allegations are separate from the supermarket incident and should not be treated as findings by a court.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— Jean-Noël Barrot, France’s foreign minister, as quoted by AFP
Evidence, Response and Legal Status
The attribution is France’s assessment, based on indicators published by its technical services. The report does not establish that the evidence has been tested in court, and an investigation or request for international arrest warrants is not a conviction. The source material does not report an independent technical assessment confirming the French attribution.
Iran had not publicly responded by Monday evening, according to The Record. It remains unclear whether Tehran will issue a response, whether other governments will endorse France’s assessment, and whether the proposed EU sanctions will proceed. The sources also give different levels of precision on the number of affected sites: the technical report says about 700, while the foreign ministry says more than 700.
The source material includes media reports of temperatures reaching 50°C for about six hours and of losses at the Intermarché chain running into tens of millions of euros in one day. Those figures are attributed to the Associated Press’s reporting and company information; they are distinct from the French government’s broader estimate of several tens of millions of euros in food losses. The full breakdown of damage across retailers is not provided.
Sanctions and Investigation Steps
France says it will propose new EU sanctions; the announcement does not specify when the proposal will be formally submitted or which individuals or entities it would target. EU member states would need to consider any measures through the relevant process, so the French announcement alone does not mean sanctions have been adopted.
The Paris prosecutor’s judicial investigation is continuing. The office is seeking international arrest warrants for the unit’s head and two deputies, according to the source material, but it is not clear when or whether those requests will be issued or acted on. Further investigative findings, any response from Iran, and decisions by European partners may clarify how the case develops.
Key Questions
What happened to the supermarket refrigeration systems?
France says attackers changed defrost settings to high temperatures on refrigeration controllers overnight on October 11–12, 2026. The C4 report says the incident caused major goods losses and fires in at least 15 cases.
Who does France blame for the attack?
The French government attributes the attack to Shahid Kaveh, which it describes as a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. That is France’s official attribution, not a court judgment.
What evidence has France published?
The C4 report cites shared attack infrastructure, use of the FOFA scanning tool, a propaganda channel associated with the unit relaying the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP.
Has Iran responded or been found legally responsible?
According to The Record, Iran had not publicly responded by Monday evening. The Paris prosecutor has opened an investigation and is seeking international arrest warrants, but no conviction or court finding of responsibility is reported.
What will France do next?
France says it will propose new EU sanctions. The Paris judicial investigation is also continuing; the timing and outcome of both processes remain unknown.
Source: ThorstenMeyerAI.com
