🔍 Read the full analysis: France’s Claim Against Iran Over Fridge Hacks: A Closer Look on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an Iranian Revolutionary Guard Corps cyber unit, Shahid Kaveh, carried out October attacks on refrigeration controllers at about 700 retail sites. French authorities cite several technical indicators, but the attribution is a government claim, not a court finding; Iran had not publicly responded by Monday evening, according to The Record.
France on November 9 attributed October attacks on supermarket refrigeration controllers to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The attacks affected equipment at about 700 retail sites, causing food losses and at least 15 fires, according to French authorities; the attribution remains an official claim under investigation, not a court determination.
The French government said the attacks took place overnight from October 11 to 12. A report from the Cyber Crisis Coordination Centre (C4), published through France’s cybersecurity response team CERT-FR, says operators changed refrigeration equipment’s defrost settings to high temperatures. The report describes significant losses of goods and fires at at least 15 sites. France’s foreign ministry put total food losses at several tens of millions of euros. The Associated Press reported that temperatures reached 50°C for about six hours and that Intermarché reported losses of tens of millions of euros in one day.
Three French bodies set out the government’s response. The foreign ministry issued a formal declaration attributing the operation to Shahid Kaveh; the technical report described indicators behind that assessment; and Paris prosecutor Laure Beccuau opened a judicial investigation into the unit’s alleged head, two deputies and other possible participants. The prosecutor’s office is seeking international arrest warrants, according to the AP. France also summoned Iran’s ambassador and said it would propose new EU sanctions.
France’s published case relies on several indicators rather than a single piece of proof. The C4 report cites shared attack infrastructure, use of the FOFA internet-scanning tool, a propaganda channel that relayed the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices located in Iran, as reported by the AP. These details are the French authorities’ stated basis for attribution; they have not been tested in court.
France’s Claim Over
Supermarket Fridge Hacks
France attributes October attacks on supermarket refrigeration controllers to an Iranian cyber unit. The attribution is a government claim under investigation, not a court finding.
What France says happened
Attackers allegedly changed refrigeration defrost settings overnight from October 11 to 12.
Refrigeration equipment was set to high defrost temperatures.
French authorities report spoiled goods and fires at at least 15 sites.
France announced an investigation, sought international arrest warrants and plans to propose EU sanctions.
The stated basis for attribution
French technical authorities cite several indicators behind their assessment.
Shared systems
The report describes attack infrastructure also used around the same period to scan industrial equipment.
FOFA scanning
France says the unit habitually uses the internet-scanning tool FOFA.
Farsi indicators
The report cites Farsi traces and a propaganda channel that relayed the attack.
What remains unresolved
The public evidence has not been tested in court, and some details of the incident remain unclear.
- France names Shahid Kaveh, which it says is affiliated with Iran’s IRGC.
- Management interfaces on affected controllers were reportedly exposed to the internet.
- France’s prosecutor opened a judicial investigation.
- Who operated the attack and the chain of command.
- How many stores lost goods or how many controllers were compromised.
- Whether every site was accessed through the same exposure.
Food Losses and Cybersecurity Risks
The attack shows how internet-connected equipment used for routine building operations can affect food storage and retail supply, even without a reported intrusion into payment systems or customer databases. A change to refrigeration controls can spoil stock and, in some cases, create fire risks. The reported losses also give the incident a direct financial impact for retailers.
For France, the attribution has moved the matter beyond incident response into diplomatic and legal action. A proposed EU sanctions response could broaden the consequences if other member states support it. The investigation and requested warrants signal that prosecutors are pursuing individuals, although an investigation does not establish guilt and international enforcement can be difficult.
The technical warning is relevant beyond supermarkets. France’s emergency response team had warned in October that affected controllers had management interfaces exposed to the internet, contrary to good practice. That points to a practical exposure in connected operational equipment; it does not, by itself, establish how every affected site was accessed or whether the same weakness was present at all locations.
Products Worth Considering
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
LG UltraGear 27G640A-B 27-Inch QHD IPS Gaming Monitor, 300Hz, 1ms, G-SYNC Compatible, FreeSync Premium, DisplayHDR 400
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the October Attack Was Traced
The attacks occurred roughly four weeks before France named a suspected sponsor. In its November 9 report, C4 said the attackers altered the refrigeration systems’ defrost parameters. The report describes the resulting goods losses and fires, while French officials have put the affected footprint at about 700 sites; the foreign ministry said more than 700.
France’s technical services say infrastructure used in the operation was also used around the same period to scan Schneider Electric equipment associated with smaller energy and water production units. The report says the industrial protocol Modbus, on port 502, had been used by Shahid Kaveh since at least April 2026. It also identifies FOFA as a tool the group habitually uses, links CyberbanNews to the unit, and reports Farsi traces in the attack infrastructure.
The same French report attributes other operations against France since 2020—including an attack on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics—to a separate IRGC unit, Shahid Shoostari. Those allegations are part of France’s broader assessment of Iranian cyber activity and are distinct from the attribution of the supermarket incident to Shahid Kaveh.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Attribution Still Faces Legal Tests
France has not released a court-tested finding establishing who carried out the operation. Its case rests on a bundle of technical indicators that officials say point to the IRGC and Shahid Kaveh. Cyber attribution can be complicated by the use of intermediaries or misleading traces, and the public report does not resolve every question about the operators’ identities or chain of command.
Iran had not publicly responded by Monday evening, according to The Record. It is also not clear from the available material how many individual stores suffered losses, how many controllers were compromised, or whether every site was accessed through the same exposure. The prosecutor’s investigation and request for arrest warrants are not convictions, and the evidence has not yet been tested in court.
French Inquiry and EU Response
The Paris judicial investigation will examine the alleged roles of Shahid Kaveh’s head and two deputies, as well as any other people identified during the inquiry. France is seeking international arrest warrants; whether they are issued and acted upon will depend on the legal process and cooperation from other jurisdictions.
France also plans to propose new EU sanctions. The timing and terms of any proposal, and whether other governments will support it, were not specified in the cited material. The French technical and intelligence authorities may also publish further findings as the investigation develops. For retailers and operators of connected equipment, the immediate known issue is the reported exposure of management interfaces; the sources do not detail a nationwide remediation timetable.
Key Questions
What did France say happened?
France said attackers changed the defrost settings on supermarket refrigeration controllers overnight on October 11–12, 2026. The government says the operation affected about 700 retail sites and caused major goods losses and at least 15 fires.
Who does France blame?
France attributes the operation to Shahid Kaveh, which it describes as a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. Iran had not publicly responded by Monday evening, according to The Record.
What evidence has France made public?
The C4 report cites shared infrastructure, use of the FOFA scanning tool, a propaganda channel that relayed the attack, and Farsi traces. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran. These are the French authorities’ stated indicators, not a court ruling.
Has anyone been convicted?
No conviction is reported. The Paris prosecutor has opened a judicial investigation and is seeking international arrest warrants, according to the AP. An investigation and warrant request do not establish guilt.
What happens next?
French prosecutors will continue their inquiry, while France says it will propose new EU sanctions. The sources do not specify when the investigation will conclude or whether the EU will adopt the proposed measures.
Source: ThorstenMeyerAI.com
