🔍 Read the full analysis: A Guide To France’s Accusation Of Iranian Supermarket Fridge Hacking on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an IRGC cyber unit called Shahid Kaveh carried out an October attack on supermarket refrigeration controllers, causing food losses and at least 15 fires, according to French authorities. France published technical indicators, summoned Iran’s ambassador and announced plans to propose EU sanctions; the attribution remains France’s claim, not a court finding.
France on November 9 attributed an overnight cyberattack on refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit France says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). French authorities say the altered defrost settings caused major food losses and at least 15 fires; Iran had not publicly responded by Monday evening, according to The Record.
France’s Cyber Crisis Coordination Centre (C4) said the attackers changed refrigeration equipment’s defrost parameters to high temperatures during the night of October 11–12. Its report described “significant losses of goods and, in at least 15 cases, fires.” The foreign ministry put food losses at several tens of millions of euros. The Associated Press reported that temperatures reached 50°C for about six hours and that Intermarché alone reported losses of tens of millions of euros in one day.
France’s attribution came through several official channels. The foreign ministry issued a formal declaration naming Shahid Kaveh, which it described as part of the IRGC’s electronic and cyber centre. Foreign Minister Jean-Noël Barrot also publicly blamed the IRGC at a G7 meeting in Paris. The C4’s five-page report, published by France’s national cyber agency under reference CERTFR-2026-CTI-009, sets out the technical indicators cited by the government.
France has also taken diplomatic and legal steps. The Iranian ambassador was summoned, and the government said it would propose new EU sanctions. Paris prosecutor Laure Beccuau opened a judicial investigation involving the unit’s head, two deputies and other possible participants. The prosecutor’s office is seeking international arrest warrants, according to the AP. These steps reflect France’s accusation; they do not amount to a court finding of guilt.
France’s supermarket cyberattack claim and what comes next
France says an Iranian Revolutionary Guard cyber unit altered supermarket refrigeration settings, causing food losses and fires. The attribution is France’s claim, not a court finding.
What France says happened
Attackers allegedly raised refrigeration defrost temperatures overnight on October 11–12.
France says internet-exposed management interfaces created a security weakness.
Defrost parameters were reportedly set to high temperatures during the night.
French authorities link the changes to spoiled goods and at least 15 fires.
How France supports its attribution
The government cites a bundle of technical and language indicators.
Shared activity
France says attack infrastructure also scanned industrial equipment.
FOFA and Modbus
The report cites FOFA use and Modbus activity it associates with the unit.
Farsi traces
Authorities cite Farsi in the infrastructure and IP addresses linked to devices in Iran.
What the case means for businesses
Connected equipment can create physical and financial consequences when poorly secured.
- Refrigeration controls can affect food safety and store operations.
- France says losses reached tens of millions of euros.
- Review internet exposure of equipment management interfaces.
- Consider systems managed outside the main corporate network.
Diplomatic and legal steps
France has announced several actions; their outcomes remain open.
| Step | Status | What it means |
|---|---|---|
| Ambassador summoned | Announced | Diplomatic response by France |
| EU sanctions | Proposal planned | EU action would depend on member states |
| Judicial investigation | Ongoing | Prosecutors are examining alleged participants |
| International warrants | Sought | A request is not an arrest or conviction |
Food losses expose connected-equipment risks
The incident shows how a cyberattack on ordinary building and refrigeration equipment can cause physical damage and disrupt food retail. France’s report links changed settings to spoiled goods and fires, with losses running to tens of millions of euros. The targets were not just office computers: they were controllers responsible for maintaining safe temperatures in stores.
The technical weakness described by France was relatively basic. In October, France’s computer emergency response team warned that the affected controllers had management interfaces exposed to the internet, contrary to good practice. The case puts attention on how businesses secure internet-connected equipment, including systems that may be managed separately from their main corporate networks.
The accusation also carries diplomatic weight. France has publicly assigned responsibility to an Iranian military-linked unit and is seeking an EU response. The investigation may shape relations between France and Iran, but its conclusions remain subject to scrutiny, and any sanctions proposal would require action by the European Union.
Products Worth Considering
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
Apple AirPods Pro (1st Generation) with MagSafe Charging Case
As an affiliate, we earn on qualifying purchases.
How France built its attribution
The French report presents a bundle of indicators, rather than a single definitive piece of evidence. It says infrastructure used in the supermarket attack was also used during the same period to scan Schneider Electric equipment used in smaller energy and water production facilities. The report connects the use of the industrial protocol Modbus on port 502 to activity it says Shahid Kaveh has used since at least April 2026.
Other indicators cited include the use of FOFA, an internet-scanning tool the report says the group habitually uses; a propaganda outlet called CyberbanNews relaying the attack from October 13; and traces of Farsi in the attack infrastructure. The Paris prosecutor’s office added, according to the AP, that the investigation identified Farsi use and IP addresses linked to devices in Iran. These are the French authorities’ stated reasons for the attribution, not independently tested findings presented in court.
France’s November 9 report also attributed earlier operations against French targets since 2020 to a separate IRGC unit, Shahid Shoostari. Those cited incidents include a 2023 attack on the Charlie Hebdo website and an attempt to hijack video display screens during the Paris 2024 Olympics. They provide the government’s broader account of Iranian-linked cyber activity, but are distinct from the supermarket incident.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, as quoted by AFP
Attribution awaits judicial testing
France has made a formal accusation and published indicators supporting it, but the material described in the report has not been tested in a public court proceeding. Attribution remains France’s assessment; cyber operations can involve infrastructure in multiple countries, and the listed indicators do not themselves establish guilt through a judicial process.
Iran’s response was not publicly known by Monday evening, according to The Record. The full scale of damage across all affected retailers, the identities of the people who accessed the controllers and the precise route used to reach them have not been established in the source material. The investigation is ongoing, and an arrest warrant request is not the same as an arrest or conviction.
Sanctions proposal and investigation
France said it would put forward new EU sanctions in response to the attack. The source material does not specify when a proposal will be formally submitted or what measures it might seek; any EU action would depend on a decision by member states.
The Paris judicial investigation will examine the alleged roles of Shahid Kaveh’s head, two deputies and any other people identified. Prosecutors are seeking international arrest warrants, according to the AP. Further details may emerge as the investigation proceeds and as Iran responds to France’s accusation.
Key Questions
What does France say happened?
France says attackers changed the defrost settings on supermarket refrigeration controllers during the night of October 11–12, causing significant food losses and at least 15 fires, according to the C4 report.
Who does France blame?
The French government attributes the attack to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps.
What evidence has France cited?
France points to shared attack infrastructure, use of the FOFA scanning tool, a propaganda outlet that relayed the attack, and traces of Farsi. The prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP.
Has Iran responded, or has anyone been convicted?
Iran had not publicly responded by Monday evening, according to The Record. No conviction has been reported; France’s attribution and the prosecutor’s investigation are not a court ruling.
What happens next?
France says it plans to propose new EU sanctions, while the Paris prosecutor’s investigation and request for international arrest warrants proceed. The timing and outcome of those steps are not yet clear.
Source: ThorstenMeyerAI.com
