🔍 Read the full analysis: What France Says Iran Did To Supermarket Fridges—and Why on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an Iranian Revolutionary Guard Corps cyber unit, Shahid Kaveh, carried out an October attack that disrupted refrigeration at about 700 French retail sites. The attribution rests on several technical and operational indicators; Iran had not publicly responded by Monday evening, and no court has tested the allegation.
France on November 9 attributed an October cyberattack on supermarket refrigeration controllers to Shahid Kaveh, a cyber unit of Iran’s Islamic Revolutionary Guard Corps (IRGC), saying the incident affected about 700 retail sites and caused major food losses and at least 15 fires. The public attribution is France’s assessment, supported by a set of technical indicators; it is not a court finding. Iran had not publicly responded by Monday evening, according to The Record.
France’s Cyber Crisis Coordination Centre (C4) said the attack took place overnight from October 11 to 12. Its report says the attackers changed refrigeration equipment’s defrost settings to high temperatures, disrupting cold storage. The report records “significant losses of goods” and fires in at least 15 cases. France’s foreign ministry put food losses at several tens of millions of euros. The Associated Press reported that temperatures reached 50°C for about six hours and that Intermarché alone reported losses worth tens of millions of euros in one day.
The French foreign ministry issued a formal declaration saying France was “in a position to attribute” the operation to Shahid Kaveh, which it described as affiliated with the IRGC’s electronic and cyber centre. Foreign Minister Jean-Noël Barrot also confirmed the attribution at a G7 meeting in Paris, according to AFP. The technical account appears in a five-page report published by CERT-FR, France’s computer emergency response team.
France has announced diplomatic and judicial steps. The Iranian ambassador was summoned, and the government said it would propose new European Union sanctions. Paris prosecutor Laure Beccuau opened a judicial investigation into the unit’s head, two deputies and any other people identified during the inquiry. The prosecutor’s office is seeking international arrest warrants, the AP reported. Opening an investigation and seeking warrants do not establish guilt.
France attributes supermarket attack to an Iranian cyber unit
France says an October cyberattack disrupted refrigeration at about 700 retail sites. The attribution is a government assessment, and the allegations remain under investigation.
What France says happened
The attack took place overnight from October 11 to 12, according to France’s cyber crisis centre.
Attackers raised refrigeration equipment’s defrost settings to high temperatures.
Authorities report significant food losses and fires in at least 15 cases.
France attributed the operation to Shahid Kaveh, which it says is affiliated with the IRGC.
How France built its case
The attribution draws on a bundle of technical and operational indicators.
Shared systems
France says attack infrastructure also scanned Schneider Electric equipment used in energy and water units.
FOFA and Modbus
The report cites FOFA scanning and Modbus activity linked to techniques attributed to Shahid Kaveh.
Farsi traces
France and prosecutors also cited Farsi traces and IP addresses linked to devices in Iran.
Government response
- France summoned Iran’s ambassador.
- France says it will propose new EU sanctions.
- Paris opened an investigation into the unit’s head, two deputies and others who may be identified.
- Prosecutors are seeking international arrest warrants.
What remains unsettled
The inquiry is ongoing, and the reported figures and allegations may be clarified as it proceeds.
| Question | What the material says |
|---|---|
| Is guilt established? | No. The attribution is France’s assessment, not a court finding. |
| How many sites? | About 700 in the C4 account; the foreign ministry says more than 700. |
| Has Iran responded? | No public response was available by Monday evening. |
The Cost of Connected Refrigeration
The incident shows how a cyberattack on ordinary business equipment can create physical damage and direct commercial losses. Refrigeration controllers are part of the systems that keep food within safe storage conditions; changing their settings can spoil inventory and, in the cases described by French authorities, contribute to fires. The reported losses place the consequences beyond a temporary information-technology outage.
France also framed the attribution as a security and diplomatic matter, not only a criminal inquiry. Its proposed EU sanctions would extend the response beyond France if other member states agree. The allegations may also prompt businesses to review how they secure connected equipment in stores and other facilities. France’s own October warning about internet-exposed management interfaces points to a practical weakness in this case: systems used to run buildings and industrial processes can be reachable from outside their intended networks.
Products Worth Considering
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
Jackery Explorer 300 Portable Power Station with SolarSaga 100W Solar Panel
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
France’s case rests on what its technical report describes as a bundle of indicators, rather than one conclusive piece of evidence. The report says attack infrastructure was also used during the same period to scan Schneider Electric equipment used in small and medium energy and water production units. It links the use of the Modbus industrial protocol on port 502 to techniques Shahid Kaveh had used since at least April 2026.
The report also points to use of the FOFA internet-scanning tool, which it says the group habitually uses; a propaganda outlet called CyberbanNews relaying the attack from October 13; and traces of Farsi in the attack infrastructure. The Paris prosecutor’s office, as reported by the AP, cited Farsi use and IP addresses linked to devices located in Iran. France says these clues support its attribution to the unit and its Iranian state affiliation; they remain the government’s assessment, not a judicially established conclusion.
The C4 brings together France’s cybersecurity agency ANSSI, military cyber command, defence procurement agency and intelligence services DGSE and DGSI. Its report also attributes earlier operations against France since 2020 to a separate IRGC unit, Shahid Shoostari, including attacks on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics. Those earlier claims provide the French government’s broader account of Iranian-linked activity, but they are distinct from the evidence cited for the supermarket incident.
““I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.””
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Evidence and Legal Questions Remain
The French government has published its reasons for blaming Shahid Kaveh, but the material described is a collection of indicators, not a court ruling. The available source material does not establish whether investigators have publicly disclosed every technical detail or how each indicator was independently verified. Iran’s public response was also not available by Monday evening, according to The Record.
Some reported figures are not identical in wording: the French foreign ministry says the attack affected more than 700 retail sites, while the C4 report is summarized as covering about 700. The exact number of affected locations and the final financial and physical damage totals have not been established in the material provided. The prosecutor’s inquiry is ongoing, and the allegations remain subject to investigation and any later court proceedings.
Sanctions and Investigation Ahead
France says it will propose new EU sanctions, but the material available does not specify the proposed targets or when member states might consider the measures. The Paris judicial investigation will seek to identify and establish evidence concerning those responsible; prosecutors are also pursuing international arrest warrants for the unit’s head and two deputies. The warrants’ status and prospects for enforcement are not yet clear.
Businesses may also face renewed scrutiny of internet-accessible controls. France’s computer emergency team warned in October that the affected controllers had management interfaces exposed to the internet, which it described as “contrary to good practice.” The government’s next public updates, any EU decision and developments in the French investigation should clarify the response and the evidence further.
Key Questions
What does France say happened to the supermarket equipment?
France says attackers changed refrigeration controllers’ defrost settings to high temperatures overnight on October 11–12, disrupting cold storage at about 700 retail sites. Authorities report major food losses and at least 15 fires.
Who does France blame for the attack?
The French government attributes it to Shahid Kaveh, a cyber unit it says is affiliated with the IRGC. This is France’s official attribution, not a court-established finding.
What evidence has France cited?
France points to shared attack infrastructure, use of the FOFA scanning tool, a propaganda outlet that relayed the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran.
What consequences has France announced?
France summoned Iran’s ambassador, said it would propose new EU sanctions, and opened a judicial investigation. Prosecutors are seeking international arrest warrants for the unit’s head and two deputies.
Has Iran responded, and has anyone been convicted?
According to The Record, Iran had not publicly responded by Monday evening. No conviction is reported: the French attribution and the open investigation are allegations and legal steps, not a court judgment.
Source: ThorstenMeyerAI.com
