- France has officially attributed a series of destructive cyberattacks targeting industrial refrigeration units in supermarkets and blood banks to Iran.
- The attacks, which began on October 11, impacted over 700 French stores, causing tens of millions of euros in food losses and at least 15 fires.
- The French government identifies the Islamic Revolutionary Guard Corps’ (IRGC) Shahid Kaveh cyber unit, known as CyberAv3ngers, as responsible.
France has officially accused Iran of orchestrating widespread and destructive cyberattacks targeting industrial refrigerated and freezer units across France and wider Europe. These intrusions affected not only grocery stores but also blood bank facilities, highlighting the severe implications of such sabotage.
Details of the Cyberattacks and Damages
The cyberattacks commenced on the night of October 11, impacting refrigeration controllers at approximately 700 retail sites throughout France. Major supermarket chains, including Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché, were affected. Attackers manipulated defrost settings to high temperatures, resulting in tens of millions of euros in food losses and sparking at least 15 fires.
France’s Cyber Crisis Coordination Centre (C4), comprising the National Cybersecurity Agency of France, the Directorate General for External Security, and other key agencies, described the campaign as “unprecedented in terms of its scale and level of aggressiveness.” The Ministry for Europe and Foreign Affairs stated this constituted the “first cyber offensive campaign carried out purely for the purpose of sabotage on national territory.”
Similar cyberattacks on commercial refrigerators and freezers were reported across Europe in early November, with grocery stores in Belgium, Ireland, Luxembourg, and Sweden experiencing widespread food losses after temperatures were spiked to as high as 122°F (50°C).
Attribution to Iran and CyberAv3ngers
Both the C4 report and the Ministry for Europe and Foreign Affairs statement attributed the refrigeration controller hacks to the Iranian Islamic Revolutionary Guard Corps’ (IRGC) Shahid Kaveh cyber unit. This unit, which French national security officials state is led by Reza Salarvand and Mahdi Lashgarian, is widely recognized by its hacktivist persona, CyberAv3ngers.
This group is also suspected of involvement in July 2023 attacks that targeted over 100 internet-exposed water systems in America. While the US government has not officially attributed those intrusions to any country, private-sector security analysts have pointed to Iran and CyberAv3ngers.
The French government presented several pieces of evidence supporting its attribution:
| Criterion | Details |
|---|---|
| Attack Infrastructure | Used for supermarket attacks and for reconnaissance on Schneider Electric equipment (small and medium energy/water production units). |
| Techniques Used | Known to have been employed by the Shahid Kaveh unit since at least April 2026 (note: source indicates 2026, likely a typo for an earlier date). |
| Linguistic Traces | “Traces of Farsi use” were discovered within the attack infrastructure. |
| Incident Publicization | Iranian media outlet CyberbanNews, reportedly linked to Shahid Kaveh, publicized the October 11-12 incidents as early as October 13. |
The Ministry for Europe and Foreign Affairs noted that “the Iranian cyber threat against French interests is not new.” Iran has previously carried out destabilizing acts against France, including targeting the weekly magazine Charlie Hebdo in 2023 and the organization of the Paris Olympic Games in 2024.
France’s Response and International Implications
The French government has vowed to “use all available means of response, including within the European Union and alongside its European and international partners, to anticipate, prevent, deter and respond to destabilizing and destructive actions targeting it in cyberspace.”
This includes proposing additional EU sanctions against involved Iranian entities and individuals. France also pledged to express “its strongest condemnation of these cyberattacks” to the Iranian ambassador. The country did not rule out more than verbal responses, stating, “France reserves the right to take any additional measures, public and non-public, deemed necessary and proportionate to respond to these cyberattacks.”
This incident underscores the escalating threat of state-sponsored cyberattacks targeting critical infrastructure, including food supply chains and medical facilities. For businesses and governmental bodies, this necessitates a heightened focus on securing industrial control systems (ICS) and operational technology (OT), particularly those connected to the internet. The international community, in turn, faces the imperative of developing a unified strategy to counter state-backed cyber warfare, which can have profound economic and social consequences. This situation highlights the evolving landscape of global cybersecurity threats, similar to discussions around Germany’s push for AI and cloud investments to bolster digital defenses.
