France Blames Iran's IRGC for the Supermarket Fridge Sabotage: About 700 Sites Hit, At Least 15 Fires, and Hydroelectric Plants Targeted Too
France has formally attributed the October sabotage of refrigeration controllers at about 700 food sites to the IRGC's Shahid Kaveh unit, opened a judicial investigation, summoned Iran's ambassador and will push for EU sanctions.
France has formally blamed Iran's Islamic Revolutionary Guard Corps (IRGC) for the October sabotage of industrial refrigeration systems in French supermarkets and food businesses. Authorities now put the number of targeted sites at about 700 and say the attacks caused at least 15 fires. It is one of the first times a European government has publicly attributed a physically destructive cyberattack on its retail sector to a state.
What Is New
Reef Sentinel has covered the freezer attacks across Europe since they began. This is the first official attribution, and it adds several new facts:
- Who: France's Cyber Crisis Coordination Centre (C4), which brings together ANSSI, military cyber command, the DGA and the DGSE and DGSI intelligence services, attributes the activity to the Shahid Kaveh and Shahid Shoostari cyber-offensive units of the IRGC Electronic and Cyber Center. CERT-FR published a summary as report CERTFR-2026-CTI-009.
- Scale: about 700 retail locations were targeted overnight on 11–12 October 2026, far more than earlier estimates of a few hundred. Food losses and damage are estimated at tens of millions of euros.
- A second target: investigators say the same attackers went after Schneider Electric industrial equipment at several small hydroelectric installations at the same time, with what ANSSI called "moderate" effects.
- Legal action: the Paris prosecutor's office has opened a judicial investigation into the head of Shahid Kaveh, two deputies and unidentified others, and has requested international arrest warrants. Reports say an annex to the French report names IRGC officers, including Hamid Reza Lashgarian, described as head of the IRGC Electronic and Cyber Center.
What Happened
Overnight on 11–12 October, attackers took control of industrial refrigeration controllers and remotely changed defrost settings to high temperatures, heating cold rooms and display cases instead of cooling them. Victims included major chains and smaller butchers, a slaughterhouse and cooperative food-processing plants.
Speaking at a G7 ministerial meeting in Paris on 9 November, Foreign Minister Jean-Noël Barrot said he "could confirm the IRGC was responsible for the fridge attacks", calling the sabotage unprecedented in scale and aggressiveness. The foreign ministry said France "condemns in the strongest possible terms" the attacks.
Technical Details: Why France Points at Iran
According to the French findings as reported:
- The attacker infrastructure was also used to scan Schneider Electric industrial systems, using techniques already tied to the unit.
- The attackers used the FOFA internet-device search engine, a tool the group commonly relies on to find exposed controllers.
- A propaganda outlet linked to the unit publicised the refrigeration attacks on 13 October.
- Investigators found Farsi-language traces in the attacker infrastructure.
Shahid Kaveh operates through hacktivist personas, including CyberAv3ngers, which U.S. agencies have tied to attacks on water utilities. It claimed sabotage of Israeli and U.S. refrigeration and industrial control systems in March and April 2026 and scanned Schneider Electric systems on a large scale, including in France, in April. ANSSI also linked the second unit, Shahid Shoostari (also known as Emennet Pasargad), to earlier attacks on France, including the defacement of Charlie Hebdo's website in 2023 and an attempt to hijack digital advertising screens around the Paris 2024 Olympics.
The public summary does not name the refrigeration controller vendor or explain exactly how the devices were reached.
What Is Still Not Attributed
France's attribution covers the October wave only. A second wave in early November hit food businesses in several other European countries, including British meat suppliers, and three sites of France's national blood service, where temperature and defrost settings were altered. Reports differ on the size of that wave, and France has not attributed it to Iran.
Diplomatic Response
France summoned Iran's ambassador and says it will push for new EU sanctions against Iranian individuals and organisations involved in malicious cyber operations. Iran had not publicly responded at the time of writing and routinely denies such operations.
What To Do Now
Operators of refrigeration, cold-chain and small industrial sites, and the contractors who maintain them, should act on the long-standing advice from CERT-FR, CISA and the FBI:
- Take controllers off the public internet. Search engines like FOFA and Shodan exist precisely to find them.
- Put remote maintenance behind a VPN with MFA, and audit which contractors have standing remote access.
- Change default passwords on controllers, HMIs and web interfaces.
- Alert on setpoint changes. A defrost or setpoint change outside maintenance windows should page someone, and temperature sensors should alarm independently of the controller.
- Keep offline copies of controller configurations so you can restore quickly.
- Check Schneider Electric and other OT assets at small energy sites for exposure, and apply vendor hardening guidance.
Why It Matters
Until now the freezer attacks looked like an embarrassing but contained problem with maintenance contracts. France's attribution reframes them as state sabotage against civilian food supply and small energy infrastructure, backed by arrest warrants and a sanctions push. It also confirms that groups like CyberAv3ngers are no longer just defacing screens. They are causing fires. Any business with an internet-connected controller is now part of the attack surface for geopolitical retaliation.
