France blames Iran for cyberattacks on supermarket refrigeration systems

France has accused Iran of carrying out destructive cyberattacks on refrigeration controllers at more than 700 grocery stores in October, spoiling food and sparking fires. The country vowed to take action using all available means of response. The attacks affected several major supermarket groups and caused food losses in the tens of millions of euros, according to a report by France's Cyber Crisis Coordination Centre. The formal attribution follows the warning we reported last week, when US federal agencies urged grocers not to chill on cyber defenses.

Attribution to Iranian unit

Both the report and a statement from France's Ministry for Europe and Foreign Affairs attributed the hacks to the Iranian Islamic Revolutionary Guard Corps' Shahid Kaveh cyber unit. French national security officials say the unit is led by Reza Salarvand and Mahdi Lashgarian, and it is better known by hacktivist personas including CyberAv3ngers. The ministry said the campaign was unprecedented in scale and aggressiveness, constituting the first cyber offensive campaign carried out purely for the purpose of sabotage on national territory.

The same crew is suspected of involvement in July attacks that targeted more than 100 internet-exposed water systems in America. The US government has not attributed those intrusions, while private-sector analysts blamed Iran and specifically CyberAv3ngers. The IRGC-affiliated crew has been breaking into industrial controllers for years, and in 2023 American agencies attributed attacks on multiple US water facilities to CyberAv3ngers.

Evidence and related incidents

Since at least June 2024, the Shahid Kaveh unit has had the ability to scan, access, and control industrial control equipment from Schneider Electric, Siemens, and Rockwell. France said the infrastructure used in the October supermarket attacks was also used during that timeframe to conduct reconnaissance on Schneider Electric equipment, focusing on small- and medium-sized energy and water production units. The report says the techniques used are known to have been used by the unit since at least April 2026.

Investigators found traces of Farsi use in the attack infrastructure. Iranian media outlet CyberbanNews, reportedly linked to the Shahid Kaveh unit, publicized the incidents that occurred late on October 11 and into October 12 as early as October 13. In early November, similar cyberattacks on commercial refrigerators and freezers were reported across Europe, with grocery stores in Belgium, Ireland, Luxembourg, and Sweden reporting widespread food losses after temperatures were spiked to as high as 122 degrees Fahrenheit (50 degrees Celsius). Last week, the US federal government urged owners and operators to take security measures to prevent these types of attacks from spreading to America.

France fights back

The French government said it would use all available means of response, including within the European Union and alongside European and international partners, to anticipate, prevent, deter, and respond to destabilizing and destructive actions targeting it in cyberspace. This includes proposing additional EU sanctions against Iranian entities and individuals involved, and expressing its strongest condemnation of the cyberattacks to the Iranian ambassador. France also said it reserves the right to take any additional measures, public and non-public, deemed necessary and proportionate to respond.

Sources: The Register