🔍 Read the full analysis: France Shows Evidence In Claim Of Iranian Supermarket Fridge Hacking on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an IRGC cyber unit called Shahid Kaveh was responsible for an October attack that altered refrigeration settings at about 700 French retail sites. The government published technical indicators and announced diplomatic and legal steps, but the attribution remains France’s assessment, not a court finding; Iran had not publicly responded by Monday evening, according to The Record.
France has attributed an October cyberattack on supermarket refrigeration controllers to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC), and has published technical indicators behind the accusation. The attack affected equipment at about 700 retail sites, according to a French cyber crisis centre report, causing food losses and at least 15 fires; France is also pursuing diplomatic and judicial measures.
France’s foreign ministry issued a formal declaration of attribution on November 9, saying it was in a position to link the destructive operation to Shahid Kaveh, which it described as part of the IRGC’s electronic and cyber centre. At a G7 meeting in Paris, Foreign Minister Jean-Noël Barrot said the attack was carried out by the IRGC, according to AFP. These are French government claims; the published material does not amount to a court determination of responsibility.
A five-page report from France’s Cyber Crisis Coordination Centre, published through CERT-FR, says operators changed refrigeration equipment’s defrost settings to high temperatures during the night of October 11 to 12. It reports significant losses of goods and fires in at least 15 cases. The foreign ministry put total food losses at several tens of millions of euros. The Associated Press reported temperatures reached 50°C for about six hours and that Intermarché alone reported losses of tens of millions of euros in one day.
The French report presents several indicators rather than a single conclusive piece of evidence: shared attack infrastructure, use of the FOFA internet-scanning tool, a propaganda channel that relayed the incident, and traces of Farsi. The Paris prosecutor’s office added, according to the AP, that IP addresses associated with devices in Iran were involved. France summoned Iran’s ambassador, said it would propose new EU sanctions, and opened a judicial investigation. Prosecutors are seeking international arrest warrants for the unit’s head and two deputies, according to the source material.
France links supermarket damage to an alleged cyberattack
France says an IRGC cyber unit altered refrigeration settings at around 700 retail sites. Its attribution is an official assessment; responsibility has not been established by a court.
What the attack disrupted
Refrigeration controls were changed overnight from October 11 to 12.
Spoiled stock
France estimates food losses at several tens of millions of euros.
Fires reported
The French report links the incident to fires in at least 15 cases.
Indicators behind France’s claim
The published report cites several technical and contextual clues.
Government response
France summoned Iran’s ambassador and said it would propose new EU sanctions.
Prosecutors are seeking international arrest warrants for the unit’s head and two deputies.
What remains unresolved
- Technical indicators support its attribution to Shahid Kaveh.
- The report puts the affected scale at about 700 sites.
- No court has tested the evidence or determined responsibility.
- The exact site count and final loss breakdown are unsettled.
Retail Damage Drives Diplomatic Action
The incident shows how internet-connected equipment used to control ordinary commercial systems can create physical and financial damage when its settings are accessed or altered. Refrigeration failures can spoil stock quickly; the report also links the attack to fires, extending the consequences beyond lost inventory. The reported losses—several tens of millions of euros across affected retailers—give the incident a direct business impact.
France’s attribution also carries diplomatic consequences. The government has summoned Iran’s ambassador and plans to propose new European Union sanctions, while prosecutors seek to pursue named suspects through international warrants. Those actions reflect France’s assessment of the case, but they do not establish that the accused individuals have been convicted or that another country will execute any warrants.
The technical warning matters beyond this particular dispute. France’s computer emergency response team had warned in October that management interfaces on affected controllers were exposed to the internet, contrary to good practice. That points to a security risk for organisations using connected building and industrial equipment, even as the precise responsibility for this attack remains disputed unless independently tested or established in court.
Products Worth Considering
Samsung 32 Odyssey QD-OLED G8 Gaming Monitor – 4K, 240Hz
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
Dell UltraSharp U2724DE 27-Inch WQHD IPS Black Monitor
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
The attack took place overnight from October 11 to 12, when defrost parameters on refrigeration controllers at French retail sites were changed. France’s Cyber Crisis Coordination Centre, known as C4, brought together technical and government bodies including the national cybersecurity agency ANSSI, military cyber command, the defence procurement agency, and the intelligence services DGSE and DGSI. Its report, CERTFR-2026-CTI-009, is the central technical document cited in the attribution.
The report says the same infrastructure was used around the same period to scan Schneider Electric equipment used in smaller energy and water production facilities. It also cites the use of the Modbus protocol on port 502, which it says Shahid Kaveh had used since at least April 2026, and FOFA, described as a tool the group habitually uses. CyberbanNews relayed the supermarket attack from October 13; the French report associates that outlet with Shahid Kaveh. Investigators also found traces of Farsi, while prosecutors cited IP addresses connected to devices in Iran.
France’s report separately attributes operations against the country since 2020 to another IRGC unit, Shahid Shoostari. Those alleged operations include a 2023 attack on the Charlie Hebdo website and an attempt to hijack video display screens during the Paris 2024 Olympics. They provide background to France’s wider allegations, but do not by themselves prove responsibility for the supermarket incident.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Attribution Still Faces Legal Tests
The published indicators explain why France believes Shahid Kaveh was responsible, but they remain France’s attribution. The available material does not show that a court has tested the evidence, and the investigation remains open. An accusation and an arrest-warrant request are not findings of guilt.
Iran had not publicly responded by Monday evening, according to The Record. The source material does not specify whether the alleged operators directly accessed the controllers, whether additional intermediaries were involved, or how many individual stores suffered losses. The report gives an overall scale of about 700 sites, while the foreign ministry says more than 700, so the exact total is not settled in the supplied accounts.
The financial figures are also not a full audited accounting. France’s foreign ministry gives an overall estimate of several tens of millions of euros, while the AP’s account of Intermarché losses is attributed to the retailer. The source material does not provide a final breakdown by chain, location, or type of damage.
Sanctions and Investigation Ahead
France says it will propose new EU sanctions; the source material does not identify the proposed targets or give a timetable for member states to consider them. The diplomatic effect will depend on the response from other EU governments and on any further exchanges between Paris and Tehran.
The Paris judicial investigation is also continuing. Prosecutors are seeking international arrest warrants for Shahid Kaveh’s head and two deputies, according to the AP. The source material does not say whether warrants have been issued, whether any suspects are in a country likely to act on them, or when further procedural steps may occur.
Further public reporting may add technical detail, clarify the number of affected sites and losses, or record a response from Iran. For now, the confirmed development is that France has made a formal attribution, published its supporting indicators, and announced legal and diplomatic steps; the allegations have not been resolved in court.
Key Questions
What happened to the supermarket refrigeration systems?
France’s cyber crisis centre says defrost settings on refrigeration controllers were changed to high temperatures overnight from October 11 to 12, causing food losses and fires at affected sites.
Who does France say was responsible?
France attributes the operation to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps. This is the French government’s assessment, not a court finding.
What evidence has France published?
The report cites shared attack infrastructure, use of the FOFA scanning tool, a propaganda channel that relayed the attack, and traces of Farsi. Prosecutors also cited IP addresses linked to devices in Iran, according to the AP.
How much damage was reported?
France’s foreign ministry estimated food losses at several tens of millions of euros. The cyber crisis centre reported fires in at least 15 cases. The source material does not provide a final audited total.
Has Iran responded, and has anyone been convicted?
Iran had not publicly responded by Monday evening, according to The Record. The Paris prosecutor has opened an investigation and is seeking international arrest warrants, but the source material reports no convictions.
Source: ThorstenMeyerAI.com
