🔍 Read the full analysis: What France Presented After Accusing Iran Of Hacking Fridges on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an Islamic Revolutionary Guard Corps cyber unit, Shahid Kaveh, was responsible for an October attack that disrupted refrigeration controllers at about 700 retail sites. France cited several technical and language indicators, while Iran had not publicly responded by Monday evening. The attribution is a government claim, not a court finding.
France on November 9 attributed an October cyberattack on supermarket refrigeration controllers to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The French government said the overnight disruption affected about 700 retail sites, causing substantial food losses and at least 15 fires; the attribution is France’s assessment, not a court ruling.
The attack took place during the night of October 11–12, according to a report published by France’s Cyber Crisis Coordination Centre, or C4. The report says operators changed refrigeration equipment’s defrost settings to high temperatures. France’s foreign ministry put the number of affected sites at more than 700; the C4 report described about 700. The report said the incident caused significant losses of goods and fires in at least 15 cases.
The foreign ministry issued a formal declaration saying France was “in a position to attribute” the sabotage to Shahid Kaveh, which it described as part of the IRGC’s electronic and cyber centre. Foreign Minister Jean-Noël Barrot also said at a G7 meeting in Paris that the attack was carried out by the IRGC, according to AFP. Iran had not publicly responded by Monday evening, The Record reported.
France cited several indicators rather than one decisive piece of evidence: shared attack infrastructure, use of the scanning tool FOFA, the attack’s promotion by the outlet CyberbanNews, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the Associated Press. French authorities summoned Iran’s ambassador, said they would propose new European Union sanctions, and opened a judicial investigation. The prosecutor is seeking international arrest warrants for the alleged unit head and two deputies, the AP reported.
France’s claim after the fridge attack What the evidence shows
France blamed an IRGC cyber unit for disrupting supermarket refrigeration controls. The attribution is a government assessment, not a court finding.
What happened
France said attackers changed refrigeration equipment’s defrost settings to high temperatures.
Controllers were set to high-temperature defrost settings.
France reported food losses and fires at affected sites.
Why France pointed to Shahid Kaveh
Authorities cited several indicators together; they did not present one decisive piece of evidence.
Shared systems
France linked attack infrastructure to scanning of energy and water equipment.
FOFA and Modbus
The report cited FOFA and Modbus activity associated with the unit.
Farsi traces
French authorities cited Farsi traces and CyberbanNews coverage.
What France did next
The response now spans diplomacy, sanctions proposals and a criminal investigation.
Food Losses and Diplomatic Fallout
The incident shows how cyber operations against connected equipment outside traditional IT networks can cause direct physical and commercial harm. Refrigeration controls manage temperatures and defrost cycles; changing their settings can spoil inventory and, according to the French report, contribute to fires. The attack therefore affected retailers, workers and customers, not only computer systems.
France’s response also gives the accusation consequences beyond public naming. A proposed EU sanctions effort could widen the diplomatic response, while the criminal investigation seeks to identify individuals and build a case. Those steps remain separate from proof in court: an investigation is not a conviction, and the technical indicators published by France have not been tested in a judicial proceeding.
The financial scale is described in broad terms. France’s foreign ministry said food losses amounted to several tens of millions of euros. The AP reported that Intermarché alone described losses of tens of millions of euros in a single day. Those figures are attributed estimates, not a final audited total for all affected retailers.
Products Worth Considering
Dell XPS Tower 8960 Desktop, Intel Core i7-13700, NVIDIA GeForce RTX 4060, 16GB DDR5, 512GB SSD
Apple Mac mini (M6, 12-core CPU and GPU, 24GB RAM, 1TB SSD)
Samsung 34-inch ViewFinity S50GC Ultra-WQHD Monitor
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
France’s five-page technical report, published through CERT-FR as CERTFR-2026-CTI-009, was prepared by C4. The centre brings together the national cybersecurity agency ANSSI, the military cyber command, the defence procurement agency and France’s domestic and foreign intelligence services. Its report sets out why French authorities link the supermarket attack to Shahid Kaveh.
One clue was the use of shared infrastructure during the same period to scan Schneider Electric equipment used in smaller energy and water production facilities. The report says the operators used the industrial protocol Modbus on port 502, a technique it associates with Shahid Kaveh since at least April 2026. It also identifies FOFA, an internet-scanning tool the group reportedly uses, and says CyberbanNews relayed the attack from October 13. Farsi traces were another indicator.
The foreign ministry also described the supermarket incident as the first cyber-offensive campaign conducted purely for sabotage purposes on French national territory. Separately, the C4 report attributed earlier operations against France since 2020—including an attack on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics—to another IRGC unit, Shahid Shoostari. These are also French attributions.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Evidence and Legal Questions Remain
France has published a bundle of indicators supporting its attribution, but the source material does not describe a single definitive piece of evidence or disclose all underlying technical data. Cyber attribution can be difficult because attackers may route activity through other countries or plant misleading clues. The public report explains France’s reasoning; it does not show that a court has independently verified it.
The full scale of the damage also remains unsettled. Official descriptions vary between about 700 and more than 700 affected sites, and the stated financial losses are broad estimates. The source material does not specify a final count of damaged stores, a complete inventory of losses, or the precise cause of each reported fire. Iran’s response was not public by Monday evening, and it is not yet clear whether Tehran will address the accusation or the proposed sanctions.
The judicial investigation remains at an early stage. France is seeking international arrest warrants, but the source material does not say whether any warrants have been issued, whether the named suspects are in custody, or whether other people will be identified.
Sanctions and Investigation Ahead
France says it will propose new EU sanctions; the source material does not give a timetable, identify the proposed targets, or say whether other member states will support the measures. Any EU action would depend on the bloc’s process and decisions by its member governments.
The Paris prosecutor’s judicial investigation will continue, with authorities seeking international arrest warrants for the alleged head of Shahid Kaveh and two deputies. Investigators may also pursue other individuals, the prosecutor said. The next developments to watch are any public response from Iran, further details from French authorities about the evidence and damage, and whether the EU adopts sanctions.
For businesses, France’s cyber emergency team had warned in October that the affected controllers had management interfaces exposed to the internet, contrary to good practice. The French report makes that exposure relevant to the incident’s prevention and investigation, although the available source material does not establish every step by which the attackers accessed the equipment.
Key Questions
What happened to the supermarket refrigeration systems?
France’s C4 report says attackers changed defrost settings to high temperatures during the night of October 11–12. France said the incident affected about 700 retail sites and caused significant food losses and at least 15 fires.
Who does France blame for the attack?
France attributed the operation to Shahid Kaveh, which it describes as a cyber unit affiliated with Iran’s IRGC. This is the French government’s attribution; it has not been established by a court.
What evidence did France publish?
The report cited shared attack infrastructure, use of the FOFA scanning tool, promotion by CyberbanNews, and traces of Farsi. The Paris prosecutor’s office also pointed to IP addresses linked to devices in Iran, according to the AP.
What action has France taken?
France summoned Iran’s ambassador, said it would propose new EU sanctions, and opened a judicial investigation. Prosecutors are seeking international arrest warrants for the alleged unit head and two deputies, according to the source reports.
Has Iran responded, and are the suspects convicted?
Iran had not publicly responded by Monday evening, according to The Record. The investigation and warrant effort do not amount to convictions; the allegations have not been tested in court.
Source: ThorstenMeyerAI.com
