🔍 Read the full analysis: Could Iran’s Revolutionary Guards Have Hacked French Supermarket Fridges? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France has attributed an October attack on supermarket refrigeration controls to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Revolutionary Guard. Officials say the incident affected about 700 retail sites, caused major food losses and led to at least 15 fires; Iran had not publicly responded by Monday evening, November 9.
France on November 9 blamed an Iranian Revolutionary Guard cyber unit for an overnight attack that changed refrigeration settings at about 700 supermarket sites, causing major food losses and at least 15 fires, according to French officials. The government named the unit as Shahid Kaveh and said it would seek new European Union sanctions; Iran had not publicly responded by Monday evening, according to The Record.
The French Cyber Crisis Coordination Centre, or C4, said the attackers changed refrigeration equipment’s defrost settings to high temperatures during the night of October 11–12. Its report says the incident caused “significant losses of goods” and fires in at least 15 cases. France’s foreign ministry put the number of affected locations at more than 700; the technical report described about 700 retail sites.
French officials say their attribution rests on several indicators rather than one conclusive piece of evidence. A five-page report published through CERT-FR cites shared attack infrastructure, use of the internet-scanning tool FOFA, a propaganda channel that relayed the attack, and traces of Farsi. The Paris prosecutor’s office also pointed to Farsi use and IP addresses linked to devices in Iran, according to the Associated Press.
The government summoned Iran’s ambassador and said it would propose new EU sanctions. Paris prosecutor Laure Beccuau opened a judicial investigation into the alleged unit head, two deputies and any other people who may be identified. The prosecutor is seeking international arrest warrants, the AP reported. The investigation is not a conviction, and the attribution remains France’s official allegation.
Could Iran’s Revolutionary Guards Have Hacked French Supermarket Fridges?
France says a cyber unit linked to Iran’s Revolutionary Guard attacked supermarket refrigeration controls. The allegation has prompted diplomatic and legal action, while the public evidence remains untested in court.
How the attack affected stores
French officials say attackers changed refrigeration controllers’ defrost settings to high temperatures.
France said management interfaces on affected equipment were accessible from the internet.
The reported changes raised defrost temperatures at supermarket sites.
Officials reported significant goods losses and fires in at least 15 cases.
What France cites
The attribution rests on several indicators, rather than one conclusive piece of evidence.
Shared systems
France’s technical report cites shared attack infrastructure.
FOFA scanning
The report says attackers used the internet-scanning tool FOFA.
Farsi traces
Technical services and prosecutors cited traces of Farsi.
Propaganda channel
A channel that relayed the attack was among the stated indicators.
Official allegation and open questions
France named Shahid Kaveh and announced diplomatic and criminal steps.
- Summoned Iran’s ambassador.
- Said it would propose new EU sanctions.
- Opened a judicial investigation and is seeking international arrest warrants.
- No court has ruled on the allegations.
- The public evidence has not been independently confirmed in the supplied reporting.
- Iran had not publicly responded by Monday evening, November 9.
Risks to Connected Store Equipment
The incident shows how internet-connected equipment used for ordinary building operations can become a cybersecurity and physical-safety risk. Refrigeration controls do not handle customer data or payments, but changing their settings can spoil large quantities of food and, according to French authorities, contribute to fires. That can disrupt stores, create costs for retailers and affect local food supplies.
France’s October warning had identified a basic exposure: management interfaces on affected controllers were accessible from the internet, contrary to good practice. The reported method was not described as an attack on an advanced refrigeration system itself; it exploited equipment that could be reached online. Businesses that operate connected industrial or building systems may need to review whether management access is exposed and how it is protected.
The political consequences also extend beyond the retail sector. France’s attribution names a state-linked unit and has prompted diplomatic action, a planned EU sanctions proposal and a criminal investigation. Those steps signal how governments may respond when they judge that cyber operations caused physical damage on their territory. The public evidence, however, has not been tested in court or independently confirmed in the material available.
Products Worth Considering
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
From October Attack to Attribution
The attack took place overnight on October 11–12, but France did not publicly identify a suspected actor until November 9. According to C4’s report, attackers accessed refrigeration controllers and changed their defrost parameters. The report describes the effects as substantial goods losses and at least 15 fires. The foreign ministry said losses amounted to several tens of millions of euros. The Associated Press reported that temperatures reached 50°C for about six hours and that Intermarché alone reported losses of tens of millions of euros in a single day.
On November 9, three parts of the French government set out their positions: the foreign ministry issued a formal attribution, technical services published the indicators, and the Paris prosecutor opened a judicial investigation. C4 brings together France’s cybersecurity agency ANSSI, military cyber command, defence procurement agency and intelligence services. Its report also attributes other operations against France since 2020 to a separate IRGC unit, Shahid Shoostari, including an attack on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the 2024 Paris Olympics.
“France “is in a position to attribute to Iran” the actions, which it says were carried out by “the cyber-offensive unit SHAHID KAVEH.””
— French foreign ministry
Evidence and Attribution Limits
France has published a bundle of indicators, not a single piece of evidence that independently proves who directed the attack. Shared infrastructure, FOFA use, the propaganda channel and Farsi traces are the technical services’ stated basis for linking the operation to Shahid Kaveh. The prosecutor’s office cited IP addresses linked to devices in Iran, but the supplied reporting does not explain how those links were established or rule out possible misdirection.
It is also not clear from the available material how many retailers suffered losses, how the total losses were calculated or which affected stores experienced fires. The foreign ministry’s figure of more than 700 locations and C4’s account of about 700 are close but not identical. Iran had not publicly responded by Monday evening, according to The Record. No court has ruled on the allegations, and the investigation may produce further evidence or identify additional people.
Sanctions Proposal and Investigation
France says it will propose new EU sanctions in response to the attack. The timing, proposed measures and level of support from other member states were not specified in the source material. The diplomatic response may develop separately from the criminal case.
The Paris judicial investigation will examine the alleged roles of the unit’s head and two deputies, as well as any other people identified by investigators. The prosecutor’s office is seeking international arrest warrants, but the available reporting does not say when those requests may be issued or what action other countries might take. Further official statements, investigative findings and any response from Iran will help clarify what happens next.
Key Questions
What happened to the supermarket refrigeration systems?
France says attackers accessed controllers at about 700 retail sites overnight on October 11–12 and changed defrost settings to high temperatures. Officials reported major food losses and at least 15 fires.
Who does France say was responsible?
France attributes the attack to Shahid Kaveh, which it describes as a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. This is France’s official attribution, not a court ruling.
What evidence has France made public?
The technical report cites shared attack infrastructure, use of the FOFA scanning tool, a propaganda channel that relayed the attack and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP.
Has Iran responded, and have anyone been convicted?
Iran had not publicly responded by Monday evening, November 9, according to The Record. France has opened a judicial investigation, but there has been no conviction reported in the source material.
Source: ThorstenMeyerAI.com
