🔍 Read the full analysis: Did Iranian Guards Hack Supermarket Fridges? France Shares Its Evidence on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an IRGC cyber unit called Shahid Kaveh carried out an October attack on refrigeration controllers at about 700 retail sites. Its case rests on several technical and language indicators; Iran had not publicly responded by Monday evening, and the attribution has not been tested in court.
France on November 9 attributed an October cyberattack on supermarket refrigeration controllers to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). A government technical report cites several indicators supporting the attribution; the attack affected about 700 retail sites, causing food losses and at least 15 fires, according to French officials.
France’s Cyber Crisis Coordination Centre, or C4, said attackers changed the refrigeration equipment’s defrost settings to high temperatures during the night of October 11–12. The report says the changes led to significant losses of goods and fires in at least 15 cases. The foreign ministry described the overall food losses as several tens of millions of euros. The Associated Press reported that temperatures reached 50°C for about six hours and that the Intermarché chain reported losses of tens of millions of euros in one day.
France’s attribution is based on a bundle of indicators, rather than one publicly identified piece of decisive evidence. The five-page CERT-FR report cites shared attack infrastructure, use of the FOFA internet-scanning tool, a propaganda channel that relayed the operation, and traces of Farsi. It says the infrastructure was also used around the same period to scan Schneider Electric equipment associated with smaller energy and water facilities. The Paris prosecutor’s office, as reported by the AP, also cited IP addresses linked to devices in Iran.
Three parts of the French government announced steps on November 9. The foreign ministry issued a formal attribution; technical agencies published their findings; and Paris prosecutor Laure Beccuau opened a judicial investigation into the unit’s head, two deputies and other possible participants. The prosecutor is seeking international arrest warrants, according to the AP. France also said it would propose new European Union sanctions. These are government actions and allegations; an investigation is not a court finding of guilt.
France attributes supermarket attack Evidence and response remain open
France says an IRGC cyber unit targeted supermarket refrigeration controls in October. Its attribution rests on combined technical indicators, and the case has not been tested in court.
How France built its case
The government report cites several indicators together; none is presented as a court-tested finding.
Shared systems
The report says attack infrastructure was also used to scan equipment at smaller energy and water facilities.
FOFA and Modbus
France cites use of the FOFA scanning tool and Modbus on port 502.
Farsi traces
The report describes Farsi traces in the attack infrastructure.
Operation relayed
A channel associated with Shahid Kaveh relayed the operation starting October 13.
What the attack meant for retailers
Changing overnight defrost settings exposed how connected operational equipment can disrupt ordinary business.
- Food losses across affected sites
- Several tens of millions of euros in reported losses
- Fires linked to the incident by French officials
- Management interfaces were exposed to the internet
- Access to each controller was not fully detailed
- Operators need to review access and monitor critical settings
France’s response
The public attribution brought technical, diplomatic and legal steps together.
Technical agencies released indicators supporting France’s assessment.
Paris prosecutors opened an investigation into the unit’s head, two deputies and other possible participants.
France plans to propose EU sanctions; prosecutors are seeking international arrest warrants.
Costs and Risks for Retailers
The attack shows how internet-connected equipment used to maintain ordinary business operations can become a route to physical disruption. Refrigeration controls are not consumer-facing computers, but changing their settings can spoil stock and, in this case, was linked by French authorities to fires. The reported losses—several tens of millions of euros across affected businesses—illustrate the potential financial impact of compromising building and industrial systems.
The French report also points to a basic exposure rather than an exotic flaw: France’s cybersecurity response team had warned in October that management interfaces on affected controllers were exposed to the internet, contrary to good practice. That finding does not establish how each site was compromised, but it highlights why operators need to review internet access to connected equipment, limit management interfaces and monitor changes to critical settings.
There is also a diplomatic and legal consequence. France’s public accusation against an Iranian military-linked unit, its plan to seek EU sanctions and the prosecutor’s pursuit of international warrants turn a technical incident into a matter of state relations and law enforcement. The evidence and its interpretation will matter to other governments considering whether to support those steps.
Products Worth Considering
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
LG UltraGear 34GX90SA-W 34-inch WQHD Curved OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
The attack happened on October 11–12, but the attribution was not made public until November 9. In the intervening period, France’s cybersecurity team warned about internet-exposed management interfaces on the affected equipment. The later government report brought together technical indicators that officials said connect the operation to Shahid Kaveh and the IRGC.
The report says the group had used the relevant industrial protocol, Modbus on port 502, since at least April 2026. It also describes FOFA as a tool the group habitually uses and says the CyberbanNews outlet, which the report associates with Shahid Kaveh, relayed the supermarket attack starting October 13. French officials further reported traces of Farsi in the attack infrastructure. Taken together, these details form France’s stated basis for attribution; they are not, on their own, a public judicial determination.
France’s foreign ministry called the supermarket operation the first cyber-offensive campaign operated purely for sabotage purposes on French territory. That characterization is the ministry’s claim. The same technical report attributes other operations against France since 2020—including an attack on the Charlie Hebdo website in 2023 and an attempted hijacking of video display screens during the Paris 2024 Olympics—to a separate IRGC unit, Shahid Shoostari. Those claims are distinct from the attribution of the refrigeration attack.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Evidence and Response Still Open
France has published technical indicators behind its conclusion, but the available material does not amount to a court-tested finding. Cyberattack attribution can be difficult, and the published account does not establish that every indicator independently identifies the operator or sponsor. The French report presents the clues as a combined basis for its assessment.
Iran had not publicly responded by Monday evening, according to The Record. The source material does not say whether Iran disputes the specific technical findings, whether other governments have assessed them independently or whether the proposed EU sanctions have support from member states. It also does not provide a complete breakdown of affected retailers or the final total of damage and losses.
The prosecutor’s investigation remains ongoing. Seeking international arrest warrants does not mean suspects have been arrested or convicted, and the material does not specify when a court might consider the case. The precise route used to gain access to each controller is also not fully detailed in the published summary.
Sanctions and Investigation Ahead
France says it will propose new EU sanctions in response. The source material does not identify the proposed measures or give a timetable for an EU decision, so the proposal’s scope and prospects remain unresolved.
Paris prosecutors are pursuing the judicial investigation and seeking international arrest warrants for Shahid Kaveh’s head and two deputies, according to the AP. Further filings, cooperation with foreign authorities or additional technical findings could clarify the case, but no outcome or arrest is confirmed in the material provided.
French cybersecurity officials and affected businesses may also continue reviewing the exposed refrigeration-management systems and the damage. The next public developments are likely to come from the investigation, any response from Iran, and France’s discussions with EU partners. Until then, the attribution remains France’s official assessment, not a judgment established in court.
Key Questions
What happened to the supermarket refrigeration systems?
French officials say attackers changed defrost settings on controllers during the night of October 11–12, setting them to high temperatures. The government report links the changes to food losses and at least 15 fires.
Who does France say was responsible?
France attributes the attack to Shahid Kaveh, a cyber unit that it says is affiliated with Iran’s Islamic Revolutionary Guard Corps. This is France’s official assessment, not a court ruling.
What evidence has France made public?
The report cites shared attack infrastructure, use of the FOFA scanning tool, a propaganda channel that relayed the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP.
How many sites were affected, and what was the damage?
The source material describes controllers at about 700 retail sites; France’s foreign ministry said more than 700. Officials reported several tens of millions of euros in food losses and at least 15 fires. A final site count and full damage accounting are not provided.
What happens after France’s announcement?
France plans to propose new EU sanctions, while the Paris prosecutor’s investigation continues and international arrest warrants are being sought. The source material confirms no arrests or court findings, and Iran had not publicly responded by Monday evening, according to The Record.
Source: ThorstenMeyerAI.com
