🔍 Read the full analysis: How A Supermarket Fridge Hack Led France To Accuse Iran on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an Iranian Revolutionary Guard Corps cyber unit carried out an October attack on refrigeration controllers at more than 700 retail sites. The government cited several technical and operational indicators, while Iran had not publicly responded by Monday evening; the attribution has not been tested in court.
France on November 9 attributed an October cyberattack on refrigeration systems at more than 700 retail sites to Shahid Kaveh, a cyber unit the government says is affiliated with Iran’s Islamic Revolutionary Guard Corps. The attack changed equipment defrost settings, causing substantial food losses and at least 15 fires, according to a French cyber-crisis report; Iran had not publicly responded by Monday evening.
The attack took place overnight from October 11 to 12, according to the joint report published by France’s Cyber Crisis Coordination Centre, or C4. The report says the attackers changed refrigeration equipment’s defrost parameters to high temperatures. France’s foreign ministry put the number of affected retail sites at more than 700; the cyber-crisis report described equipment at about 700 sites. It said the incident caused significant goods losses and fires in at least 15 cases.
The financial cost remains an estimate. France’s foreign ministry described food losses as several tens of millions of euros. The Associated Press reported that temperatures reached 50°C for about six hours and that supermarket chain Intermarché reported losses of tens of millions of euros in one day. Those figures are attributed to the cited sources, not independently established here.
France published a set of indicators behind its attribution, rather than a single conclusive piece of evidence. The C4 report cited shared attack infrastructure, use of the FOFA internet-scanning tool, a propaganda outlet that relayed the operation, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP. France summoned Iran’s ambassador, said it would propose new EU sanctions, and opened a judicial investigation.
A supermarket fridge hack becomes a diplomatic case
France attributes an October attack on refrigeration controllers to an Iranian Revolutionary Guard Corps cyber unit. Its public case rests on several indicators, while the attribution remains untested in court.
How the hack caused physical damage
The French report says attackers changed refrigeration defrost settings to high temperatures.
France’s computer emergency response team warned that management interfaces were reachable from the internet.
Refrigeration equipment was set to defrost at high temperatures.
The incident caused significant food losses and was linked to fires at at least 15 sites.
What France cited
The government described a bundle of technical and operational indicators, not one conclusive proof.
Shared attack systems
The report cited infrastructure also used to scan industrial equipment.
FOFA scanning
France said the unit habitually used the internet-scanning tool.
Farsi traces
Investigators said they found Farsi traces in the attack infrastructure.
Operation relayed
A propaganda outlet France associates with Shahid Kaveh relayed the attack.
Attribution and response
France named Shahid Kaveh and moved on diplomatic, sanctions and judicial fronts.
What remains unresolved
The official accusation is not a judicial finding, and key outcomes are still open.
- France published technical indicators behind its attribution.
- A judicial investigation is open.
- France says it will propose new EU sanctions.
- The attribution has not been tested in court.
- Iran had not publicly responded by Monday evening.
- Other governments’ support and the final scale of losses remain unclear.
Food Losses and Diplomatic Costs
The incident shows how internet-connected equipment used to manage building and refrigeration systems can become a route to physical and financial damage. The report describes altered settings that spoiled goods and were linked to fires, extending the consequences beyond a disruption to computer systems. The reported losses, estimated by France in the tens of millions of euros, affected retailers and their supply chains.
France’s public attribution also makes the case a diplomatic issue. The government has moved from investigating an attack to formally naming a foreign state and an alleged military-linked unit, while pursuing EU sanctions and legal action. Those measures could raise the political cost of the operation if other EU members support them. The attribution itself remains a government finding, not a judicial determination of responsibility.
For businesses, the French computer emergency response team had warned that affected controllers exposed management interfaces to the internet, which it described as contrary to good practice. That points to a concrete security concern: connected equipment that controls physical processes needs protection against unauthorized access, even when it is not part of a company’s ordinary office IT network.
Popular right now
DREAME A3 AWD 1000 LiDAR Robot Lawn Mower
Bose QuietComfort Earbuds (2nd Gen) – True Wireless Bluetooth Earbuds with Active Noise Cancellation
Samsung 43-Inch M70H Series 4K Mini LED Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
Three strands of French government activity converged on November 9. The foreign ministry issued a formal declaration attributing the sabotage to Shahid Kaveh, which it described as part of the IRGC’s electronic and cyber centre. At a G7 meeting in Paris, Foreign Minister Jean-Noël Barrot said, as quoted by AFP, that the attack was carried out by the IRGC. Separately, C4 published its technical report through France’s cybersecurity agency, ANSSI.
The report’s indicators point to an assessment based on several connections. It says the same infrastructure was used during the relevant period to scan Schneider Electric equipment used in smaller energy and water production units. It also says the Modbus industrial protocol on port 502 had been used by Shahid Kaveh since at least April 2026, and that the group habitually used FOFA. The report says CyberbanNews, which it associates with Shahid Kaveh, relayed the supermarket attack from October 13. It also found traces of Farsi in the attack infrastructure.
France’s announcement included allegations about other operations as well. The C4 report attributed several operations against France since 2020—including an attack on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics—to a different IRGC unit, Shahid Shoostari. Those claims are separate from the supermarket incident and are also French government assessments.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Evidence and Legal Questions
France has stated its conclusion and published indicators, but the evidence has not been tested in court. Cyber attribution can be difficult, and the material described publicly is a bundle of clues connecting infrastructure, tools, language and a propaganda channel. The full underlying evidence and how investigators assessed alternative explanations are not detailed in the source material.
Iran’s position was also unknown at the time reported: according to The Record, it had made no public response by Monday evening. It is not clear whether the alleged perpetrators can be arrested, whether international arrest warrants will be issued, or whether other governments will endorse France’s attribution. The final scale of losses and the total number of affected sites may also vary between the different official descriptions.
Sanctions and Investigation Ahead
France said it would propose new sanctions at the European Union level; the source material does not give a timetable or say whether other member states have agreed. Iran’s ambassador has been summoned, but no further diplomatic response is reported in the material available here.
The Paris prosecutor’s judicial investigation will seek to identify those responsible, and the prosecutor’s office is seeking international arrest warrants for the alleged unit head and two deputies, according to the AP. The investigation may produce further evidence or charges. Until then, France’s attribution remains an official accusation, and the allegations against named or identifiable individuals have not been decided by a court.
Key Questions
What happened in the supermarket attack?
France says attackers accessed refrigeration controllers at more than 700 retail sites overnight on October 11–12, 2026, and changed defrost settings to high temperatures. The French report links the incident to major food losses and at least 15 fires.
Who does France blame?
France attributes the attack to Shahid Kaveh, a cyber unit it says is affiliated with the Islamic Revolutionary Guard Corps. This is France’s official attribution, not a court finding.
What evidence did France cite?
The C4 report cited shared attack infrastructure, use of the FOFA scanning tool, a propaganda channel associated with the unit that relayed the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP.
How much damage was reported?
France’s foreign ministry estimated food losses at several tens of millions of euros. The report also described fires at at least 15 sites. The AP reported a separate estimate for Intermarché losses; the precise total across all retailers is not established in the supplied material.
What happens next?
France plans to propose new EU sanctions, while the Paris prosecutor’s office pursues a judicial investigation and seeks international arrest warrants for the alleged unit head and two deputies. Iran had not publicly responded by Monday evening, according to The Record.
Source: ThorstenMeyerAI.com
