🔍 Read the full analysis: The Supermarket Fridge Hack: France’s Allegations Against Iran Explained on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an IRGC cyber unit called Shahid Kaveh carried out an October cyberattack on supermarket refrigeration controllers, causing food losses and at least 15 fires. The attribution rests on several technical and linguistic indicators; it remains France’s allegation, not a court finding. France has summoned Iran’s ambassador, plans to propose EU sanctions and opened a judicial investigation.
France on November 9 blamed an Iranian Revolutionary Guard cyber unit, Shahid Kaveh, for an October attack that altered refrigeration settings at about 700 retail sites, causing major food losses and at least 15 fires, according to French authorities. The government has summoned Iran’s ambassador and says it will propose new EU sanctions, while prosecutors have opened an investigation and are seeking international arrest warrants.
France’s Cyber Crisis Coordination Centre said the attackers changed refrigeration equipment’s defrost parameters to high temperatures during the night of October 11 to 12. The centre’s report describes “significant losses of goods and, in at least 15 cases, fires.” The foreign ministry said more than 700 sites were affected and estimated food losses at several tens of millions of euros.
The attribution was issued by the foreign ministry alongside a technical report published through France’s cybersecurity response service, CERT-FR. The report identifies Shahid Kaveh as an offensive cyber unit affiliated with the Islamic Revolutionary Guard Corps’ electronic and cyber centre. Foreign Minister Jean-Noël Barrot also said at a G7 meeting in Paris that the attack was carried out by the IRGC, according to AFP.
Paris prosecutor Laure Beccuau has opened a judicial investigation targeting the alleged unit head, two deputies and other people who may be identified. The prosecutor’s office is seeking international arrest warrants, the Associated Press reported. The investigation is not a conviction; the allegation has not been tested in court.
The supermarket fridge hack France’s allegations against Iran
France says an Iranian Revolutionary Guard cyber unit altered supermarket refrigeration settings, causing food losses and fires. The attribution has diplomatic and legal consequences, but remains an allegation under investigation—not a court finding.
What France says happened
During the night of October 11–12, attackers allegedly changed refrigeration controllers’ defrost settings to high temperatures.
France’s cybersecurity response team had warned that management interfaces were exposed to the internet, contrary to good practice.
French authorities say the attackers changed equipment parameters, disrupting cold storage.
Authorities report spoiled goods and at least 15 fires—damage beyond data theft.
The attribution evidence
France describes a bundle of indicators, not one conclusive piece of evidence.
Shared attack resources
The report cites infrastructure also used to scan equipment associated with small and medium energy and water facilities.
FOFA scanning
France cites use of the FOFA internet-scanning tool and Modbus on port 502.
Farsi traces
The technical report says it found traces of Farsi and a propaganda channel that relayed the attack.
Iran-linked IP addresses
Prosecutors point to IP addresses linked to devices in Iran, according to the Associated Press.
France’s response
Paris has paired its public attribution with diplomatic, EU and judicial steps.
| Action | Status | What it means |
|---|---|---|
| Iran’s ambassador summoned | Announced | France has raised the allegation diplomatically. |
| EU sanctions | France plans to propose them | Any measures would require EU action; no timetable is given. |
| Judicial investigation | Opened | Prosecutors are investigating the alleged unit head, two deputies and others who may be identified. |
| International arrest warrants | Being pursued | Warrants do not establish guilt; no arrests are reported. |
What remains unproven
The reported evidence and damage have not been independently established in the material provided.
- More than 700 sites were reportedly affected.
- French authorities report food losses and at least 15 fires.
- France attributes the operation to Shahid Kaveh, an IRGC-affiliated cyber unit.
- The attribution has not been tested in court; no conviction is reported.
- Iran had not publicly responded by Monday evening, according to The Record.
- Individual store damage, the precise site count and the operators’ identities remain unestablished.
Food Losses and French Countermeasures
The incident shows how internet-connected equipment used for ordinary building operations can create risks beyond data theft. Supermarket refrigeration controllers regulate cold storage; changing their settings can spoil inventory and, French authorities say, contribute to fires. The reported damage—at least 15 fires and losses measured in tens of millions of euros—made this a physical and commercial disruption, not merely a network incident.
France’s response also gives the attribution diplomatic and legal consequences. Summoning Iran’s ambassador, proposing EU sanctions and pursuing arrest warrants signal that Paris is treating the event as a state-linked act of sabotage. Any sanctions would require action through the EU process, and the warrants do not establish guilt. France’s findings may shape how European governments respond, but Iran’s position and any independent assessment remain unknown.
Products Worth Considering
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
As an affiliate, we earn on qualifying purchases.
How the Refrigeration Systems Were Reached
France’s computer emergency response team had warned in October that the affected controllers had management interfaces exposed to the internet, which it described as “contrary to good practice.” That warning points to a reported weakness in how the equipment was reachable, rather than an especially novel method. The source material does not identify the supermarkets or equipment owners responsible for each exposed interface.
The French technical report does not rely on one piece of evidence. It cites shared attack infrastructure also used to scan equipment associated with small and medium energy and water facilities, use of the FOFA internet-scanning tool, a propaganda channel that relayed the attack, and traces of Farsi. The report says the group had used the cited industrial protocol, Modbus on port 502, since at least April 2026. The Paris prosecutor’s office also points to IP addresses linked to devices in Iran, according to the AP.
France’s report makes additional allegations about earlier cyber operations. It attributes operations against France since 2020, including an attack on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics, to a separate IRGC unit, Shahid Shoostari. Those claims are distinct from the supermarket case and are not court findings.
““I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.””
— French Foreign Minister Jean-Noël Barrot, as quoted by AFP
Evidence and Iranian Response
France describes its case as a bundle of indicators, rather than presenting a single conclusive piece of evidence. Shared infrastructure, tool use, a propaganda channel, language traces and IP addresses form the basis of the attribution described in the source material. Cyber activity can be routed through other countries or use misleading clues, and the publicly described indicators have not been tested in court.
Iran had not publicly responded by Monday evening, according to The Record. The full extent of damage at individual stores, the precise number of affected sites and the identities of those who carried out the operation have not been independently established in the material provided. The prosecutor’s investigation is ongoing; the allegations remain allegations.
Sanctions and the French Investigation
France says it will propose new EU sanctions; the source material does not give a timetable or say which people or entities could be named. The Paris judicial investigation will seek to establish who was responsible and whether evidence supports the allegations against the named unit leaders. Authorities have said they are pursuing international arrest warrants, but no arrests are reported in the material provided.
Further developments may include an Iranian response, additional detail from French investigators or a decision by EU members on any proposed measures. Until then, the attribution is the French government’s official position, supported by the indicators in its report, rather than a judicial determination.
Key Questions
What happened in the supermarket cyberattack?
French authorities say attackers changed defrost settings on refrigeration controllers at about 700 retail sites during the night of October 11–12, 2026. The report says the incident caused significant food losses and at least 15 fires.
Who does France blame?
France attributes the attack to Shahid Kaveh, a cyber unit affiliated with the electronic and cyber centre of Iran’s Islamic Revolutionary Guard Corps. This is France’s attribution, not a court ruling.
What evidence did France cite?
The French report cites shared attack infrastructure, use of the FOFA scanning tool, a propaganda channel that relayed the attack and traces of Farsi. Prosecutors also point to IP addresses linked to devices in Iran, according to the Associated Press.
What action has France taken?
France summoned Iran’s ambassador, said it would propose new EU sanctions and opened a judicial investigation. Prosecutors are seeking international arrest warrants for the alleged unit head and two deputies.
Has Iran responded, and has anyone been convicted?
Iran had not publicly responded by Monday evening, according to The Record. No conviction is reported; the investigation is ongoing, and the allegations have not been tested in court.
Source: ThorstenMeyerAI.com
