🔍 Read the full analysis: How France Built Its Case On The Supermarket Fridge Hack on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France has attributed the October 11–12 attack on supermarket refrigeration controllers to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. The government cites several technical and operational indicators; the Paris prosecutor has opened an investigation and is seeking international arrest warrants, but the attribution has not been tested in court.
France has attributed an October attack on refrigeration controllers at more than 700 retail sites to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The government’s November 9 announcement follows an attack that caused major food losses and at least 15 fires, and it has prompted diplomatic action and a judicial investigation; the evidence is France’s attribution, not a court finding.
A joint report from France’s Cyber Crisis Coordination Centre, published through CERT-FR, says the attackers changed refrigeration equipment’s defrost settings to high temperatures during the night of October 11 to 12. It records “significant losses of goods and, in at least 15 cases, fires.” The French foreign ministry described the total food losses as several tens of millions of euros. The Associated Press reported that temperatures reached 50°C for about six hours and that Intermarché reported losses of tens of millions of euros in one day.
France presented several indicators for its attribution rather than a single conclusive piece of evidence. The report points to shared attack infrastructure, use of the scanning tool FOFA, a propaganda channel that relayed the attack, and traces of Farsi in the infrastructure. It says the same infrastructure was also used to scan Schneider Electric equipment associated with smaller energy and water production units, using the industrial protocol Modbus on port 502. According to the report, Shahid Kaveh had used that technique since at least April 2026.
The Paris prosecutor’s office has opened a judicial investigation involving the head of Shahid Kaveh, two deputies and other people who may be identified. The Associated Press reported that prosecutors are seeking international arrest warrants and cite alleged offenses committed to serve the interests of a foreign power. France has also summoned Iran’s ambassador and said it will propose new EU sanctions. An investigation and a request for warrants do not amount to convictions.
How France Built Its Case On The Supermarket Fridge Hack
France attributes the attack on supermarket refrigeration controllers to Shahid Kaveh, an IRGC-affiliated cyber unit. Its evidence is a government attribution under investigation, not a court finding.
What France cites
The published report links several technical and operational indicators to Shahid Kaveh.
Shared attack infrastructure
France says infrastructure used in the attack was also used for scanning activity.
FOFA scanning
The report cites use of the FOFA scanning tool.
Farsi traces
The report says it found traces of Farsi in the infrastructure.
Propaganda channel
A channel relayed the attack, according to the report.
How the attack caused damage
The incident targeted equipment that controls supermarket cold rooms.
Attackers changed refrigeration controllers’ defrost settings to high temperatures overnight.
The altered settings reportedly spoiled food and caused fires at some sites.
France had warned that controller management interfaces were exposed to the internet.
Evidence and legal status
The published indicators form France’s case; further scrutiny remains ahead.
- Published a technical report and attribution.
- Opened a judicial investigation.
- Summoned Iran’s ambassador and said it will propose new EU sanctions.
- No court has tested the allegations.
- Prosecutors are seeking international arrest warrants.
- Whether warrants or proposed sanctions will proceed remains unclear.
The Cost of Exposed Store Systems
The attack shows how internet-connected building equipment can become a route to physical and financial damage. The affected controllers managed the defrost cycles of supermarket cold rooms; changing those settings reportedly led to spoiled stock and fires. The incident was not described as an attack on payment systems or customer data, but it disrupted a basic part of food retail operations and imposed substantial reported losses.
France’s technical services had warned in October that the affected controllers had management interfaces exposed to the internet, which the report called contrary to good practice. That finding makes the case relevant beyond supermarkets: connected equipment used to run buildings and industrial processes can create risks if management access is publicly reachable or inadequately protected. The reported scale—more than 700 sites, according to the foreign ministry—also points to the potential consequences of a weakness repeated across multiple locations.
The diplomatic response adds a second dimension. France’s attribution puts a state-linked actor at the centre of a public accusation and could lead to proposed EU sanctions. The claim may shape relations between France and Iran, but its evidentiary basis and any legal consequences remain subject to further scrutiny.
Products Worth Considering
EcoFlow Delta 3 Max Portable Power Station with 220W Solar Panel, 2048Wh
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From October Attack to Attribution
The attack took place overnight on October 11–12. France’s October warning said the controllers’ management interfaces were exposed to the internet. On November 9, the government published its attribution and the technical report supporting it, ending roughly four weeks in which the responsible party had not been publicly identified by France.
Three parts of the French response appeared on November 9. The foreign ministry issued a formal declaration attributing the actions to Shahid Kaveh, which it described as affiliated with the IRGC’s electronic and cyber centre. Foreign Minister Jean-Noël Barrot confirmed the government’s accusation at a G7 meeting in Paris. France’s cyber crisis coordination centre published the technical account, while the Paris prosecutor announced the investigation.
The report also attributes earlier operations against France since 2020—including an attack on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics—to a separate IRGC unit, Shahid Shoostari. Those claims are part of the report’s wider account and are distinct from the supermarket attack attribution.
“France is in a position to attribute to Iran these destructive actions.”
— France’s foreign ministry
Evidence and Legal Questions
France has set out a bundle of indicators, but the published material does not establish the attribution through a court process. Cyber operations can use infrastructure in multiple countries or include misleading traces; the report’s indicators are the French government’s stated basis for linking the attack to Shahid Kaveh. The prosecutor’s office also points to IP addresses linked to devices in Iran, according to the Associated Press, but the public material does not resolve every question about who operated those devices or how the attack was directed.
Iran had not publicly responded by Monday evening, according to The Record. It is also unclear from the available reporting whether international arrest warrants have been issued, how other governments will assess France’s evidence, or whether the proposed EU sanctions will be adopted. The investigation may produce further evidence, but no court has tested the allegations and no convictions have been reported.
Sanctions and Investigation Ahead
France says it will propose new sanctions at the EU level; whether member states will approve them and what measures they might include has not been specified in the source material. The French diplomatic response has already included summoning Iran’s ambassador.
The Paris prosecutor’s investigation is expected to examine the named suspects and any other people identified, while prosecutors seek international arrest warrants. The technical services’ published report provides France’s current explanation of the attack, but further public information could emerge as the inquiry proceeds. Iran’s response and any independent assessment of the evidence also remain outstanding.
Key Questions
What happened in the supermarket refrigeration attack?
France says attackers changed defrost settings on refrigeration controllers during the night of October 11–12, 2026. The government says the incident affected more than 700 retail sites and caused major food losses and at least 15 fires.
Who does France blame?
France attributes the attack to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. This is the French government’s attribution, not a finding by a court.
What evidence did France publish?
The report cites shared attack infrastructure, use of the FOFA scanning tool, an associated propaganda channel relaying the attack, and traces of Farsi. Prosecutors also cited IP addresses linked to devices in Iran, according to the Associated Press.
Has Iran responded, and has anyone been convicted?
Iran had not publicly responded by Monday evening, according to The Record. The Paris prosecutor has opened an investigation and is seeking international arrest warrants, but no court ruling or conviction is reported.
What happens next?
France plans to propose new EU sanctions, while the Paris prosecutor’s investigation continues. The status of any warrants, the EU’s decision and any response from Iran remain unclear.
Source: ThorstenMeyerAI.com
