🔍 Read the full analysis: France Accuses Iran’s Guards Of Hacking Fridges—Here’s The Evidence on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
France says an IRGC cyber unit called Shahid Kaveh carried out an October attack that changed refrigeration settings at about 700 retail sites, causing food losses and at least 15 fires. Its attribution rests on a bundle of technical and contextual indicators; Iran had not publicly responded by Monday evening, and the allegation has not been tested in court.
France on November 9 attributed an October cyberattack on refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit France says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The government says altered defrost settings caused major food losses and at least 15 fires; the attribution is based on several indicators, not a court finding, and Iran had not publicly responded by Monday evening, according to The Record.
The attack took place overnight on October 11–12, according to a five-page technical report published by France’s Cyber Crisis Coordination Centre, or C4, through CERT-FR. It says the equipment’s defrost parameters were changed to high temperatures. The report records significant losses of goods and fires in at least 15 cases. France’s foreign ministry says more than 700 retail sites were affected and estimates food losses at several tens of millions of euros.
France’s evidence is a bundle of indicators. The report says the attack infrastructure was also used around the same period to scan Schneider Electric equipment used in small energy and water production facilities. It says the group had used the industrial protocol Modbus on port 502 since at least April 2026, and identifies FOFA, an internet-scanning tool, as one the operators habitually use. The report also points to an outlet called CyberbanNews, which relayed the attack from October 13 and which French officials associate with Shahid Kaveh, as well as traces of Farsi in the infrastructure.
The Paris prosecutor’s office added that investigators identified IP addresses linked to devices in Iran, according to the Associated Press. Foreign Minister Jean-Noël Barrot confirmed France’s attribution at a G7 meeting in Paris. The government summoned Iran’s ambassador and says it will propose new EU sanctions. Paris prosecutors have opened a judicial investigation and are seeking international arrest warrants for the unit’s head and two deputies. An investigation and warrant request do not amount to a conviction.
France’s fridge hacking claim and the evidence
France attributes an October attack on retail refrigeration systems to an Iranian cyber unit. The published clues support its assessment, but the allegation has not been tested in court.
What the attack did
France says refrigeration settings were changed overnight on October 11–12.
Defrost parameters were set to high temperatures.
The report records significant food losses at retail sites.
Fires were reported in at least 15 cases.
Clues behind France’s attribution
Officials describe a combined case linking the activity to Shahid Kaveh.
Shared systems
The attack infrastructure also scanned Schneider Electric equipment.
Tools and protocol
The report cites Modbus use since April 2026 and the FOFA scanning tool.
Farsi traces
French officials say they found Farsi traces in the infrastructure.
Linked outlet
CyberbanNews relayed the attack; France associates the outlet with the unit.
Public evidence has limits
Technical indicators can support an assessment, but they do not establish guilt by themselves.
- Paris prosecutors identified IP addresses linked to devices in Iran.
- The government attributes the operation to Shahid Kaveh.
- No evidence has been tested in court.
- The source does not identify every retailer or explain access at each site.
- Iran had not publicly responded by Monday evening.
France’s next steps
The attribution has prompted diplomatic, legal and proposed EU action.
Food Losses and Diplomatic Costs
The incident shows how a cyberattack on ordinary commercial equipment can cause physical damage and disruption without targeting a high-profile computer network. Refrigeration controllers regulate cold-room and freezer operations; changing their settings can spoil stock and, according to the French report, was followed by fires at some sites. The foreign ministry’s estimate of several tens of millions of euros in losses gives the attack a direct economic cost, though a final independently verified total is not provided in the source material.
France’s public attribution also raises the diplomatic stakes. The government has tied the incident to an Iranian military-linked unit and is pursuing EU sanctions and international warrants. Those steps could affect France’s relations with Iran and prompt scrutiny of how governments establish responsibility for cyber operations. The published indicators offer a rationale for France’s assessment, but they do not by themselves establish guilt in court.
For retailers and other businesses, the report points to a practical exposure: connected building and industrial equipment can be reachable from the internet. France’s cyber emergency team had warned in October that management interfaces on affected controllers were exposed online, which it described as contrary to good practice. The source material does not identify the affected retailers or provide a full account of how the attackers accessed each controller.
Popular right now
Bose QuietComfort Earbuds (2nd Gen) – True Wireless Bluetooth Earbuds with Active Noise Cancellation
KitchenAid Artisan Mini Tilt-Head Stand Mixer, 3.5 Qt, Contour Silver
Roborock RockMow X130H Wire-Free 4WD Robot Lawn Mower
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
France released three types of official response on November 9. The foreign ministry issued a formal declaration saying it was in a position to attribute the destructive actions to Shahid Kaveh, described as part of the IRGC’s electronic and cyber centre. C4 published the technical report, CERTFR-2026-CTI-009, while the Paris prosecutor announced a judicial investigation. These are government statements and investigative steps, not a court’s assessment of the evidence.
French officials describe the supermarket attack as a sabotage operation. The foreign ministry called it the first cyber-offensive campaign operated purely for sabotage purposes on French territory; that is the government’s characterization, not an independently established historical finding in the material provided. The same C4 report also attributes earlier operations against France since 2020 to a separate IRGC unit, Shahid Shoostari, including an attack on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics.
The October attack was publicly attributed about four weeks after it occurred. The technical case described by France combines infrastructure overlap, a scanning tool, reporting by a channel it links to the group, and language traces. Such indicators can support an intelligence assessment, but cyber attribution can be complicated by routed traffic or planted clues. The available account does not say that each indicator independently identifies the operators.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
What the Public Evidence Cannot Establish
France has published indicators supporting its attribution, but the material available does not include evidence tested in court or establish the identities of individual operators. The report’s technical clues are presented as a combined case; the source does not quantify how much weight officials assign to each one or provide an independent assessment of the findings. The attribution remains France’s official conclusion, not a judicial determination.
Other details are also unresolved. Iran had not publicly responded by Monday evening, according to The Record. The source material does not identify all affected retailers, specify the complete number of compromised controllers, or explain how access was gained at each site. The foreign ministry gives a loss estimate of several tens of millions of euros, while the account does not provide a consolidated final tally or an independent valuation. The investigation may add evidence or revise details as it proceeds.
Sanctions and the Judicial Investigation
France says it will propose new sanctions at the European Union level. The source material does not give a timetable, name proposed targets, or say whether other member states have agreed to the measures. The proposal’s progress and any official response from Tehran remain to be seen.
In France, prosecutors are pursuing the judicial investigation and seeking international arrest warrants for Shahid Kaveh’s head and two deputies. The investigation may identify additional people and gather evidence beyond the indicators in the public technical report. Arrest warrants are requests for legal action; the source does not report that the suspects have been arrested or that proceedings have reached trial. Further public detail may emerge from prosecutors, French cyber authorities, the retailers involved, or Iranian officials.
Key Questions
What happened to the supermarket refrigeration systems?
France says attackers changed defrost settings to high temperatures on refrigeration controllers overnight on October 11–12, 2026. The French technical report says the incident caused major goods losses and at least 15 fires.
Who does France blame for the attack?
France attributes the attack to Shahid Kaveh, which it describes as a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. That is France’s official attribution, not a court verdict.
What evidence has France made public?
The report cites shared attack infrastructure, use of the FOFA scanning tool, a propaganda channel associated with the unit relaying the attack, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the Associated Press.
How much damage did the attack cause?
France’s foreign ministry estimates food losses at several tens of millions of euros and says more than 700 retail sites were affected. The technical report records fires in at least 15 cases; the source material does not provide a final independently verified loss total.
What happens next?
France says it will propose new EU sanctions, while Paris prosecutors continue their investigation and seek international arrest warrants for the unit’s head and two deputies. Iran had not publicly responded by Monday evening, according to The Record.
Source: ThorstenMeyerAI.com
