🔍 Read the full analysis: France’s Supermarket Fridge Hack Claim, Explained on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France says an IRGC cyber unit called Shahid Kaveh carried out an October attack that altered refrigeration settings at about 700 supermarket sites, causing major food losses and at least 15 fires, according to French officials. The attribution rests on a bundle of technical and language indicators; it is an official accusation, not a court finding. France has summoned Iran’s ambassador, plans to propose EU sanctions and opened a judicial investigation.
France on November 9 attributed an October cyberattack on supermarket refrigeration systems to Shahid Kaveh, a cyber unit the government says is affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). French authorities say altered defrost settings affected controllers at about 700 retail sites, causing major food losses and at least 15 fires; the attribution is France’s assessment and has not been tested in court.
A five-page report from France’s Cyber Crisis Coordination Centre, published through CERT-FR, says attackers changed refrigeration equipment’s defrost parameters to high temperatures during the night of October 11–12. The report says the incident caused “significant losses of goods” and fires in at least 15 cases. The foreign ministry described the number of affected sites as more than 700, while the technical report refers to about 700 retail sites.
The French foreign ministry said the attack caused food losses worth several tens of millions of euros. The Associated Press reported that temperatures reached 50 degrees Celsius for about six hours and that supermarket chain Intermarché reported losses of tens of millions of euros in one day. Those figures are attributed to the respective sources; the French report’s summary does not provide a detailed, independently verified accounting of total losses.
France’s technical report cites a bundle of indicators: infrastructure also used to scan industrial equipment, the use of the FOFA internet-scanning tool, a propaganda channel that relayed the attack, and traces of Farsi in the attack infrastructure. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP. France summoned Iran’s ambassador, said it would propose new EU sanctions and opened a judicial investigation. The prosecutor is seeking international arrest warrants for the alleged unit head and two deputies.
France’s Supermarket Fridge Hack Claim Explained
France says an IRGC-linked unit altered supermarket refrigeration settings, causing food losses and fires. The attribution is an official accusation, not a court finding.
What France says happened
The attack took place overnight on October 11–12, when refrigeration defrost settings were allegedly changed.
French technical services say controllers were set to high temperatures during defrost cycles.
Authorities reported significant spoiled goods and fires at at least 15 sites.
On November 9, France named Shahid Kaveh and announced diplomatic and legal steps.
How France built its attribution
The government cites several technical and language indicators together, rather than a single decisive clue.
Shared technical traces
Infrastructure was also used to scan industrial equipment, according to France’s report.
Scanning activity
French analysts cited use of the FOFA internet-scanning tool and Modbus-related activity.
Farsi traces
The report says traces of Farsi appeared in the attack infrastructure.
Propaganda channel
A propaganda channel relayed the attack, another indicator cited by France.
Claim versus legal finding
The public attribution and the ongoing investigation are distinct stages.
- Named Shahid Kaveh as responsible.
- Summoned Iran’s ambassador.
- Opened a judicial investigation and plans to propose EU sanctions.
- The attribution has not been tested in court.
- International arrest warrants are being sought; the source does not say they have been issued.
- Exact site counts, losses and access routes remain unclear publicly.
Food Losses and Diplomatic Fallout
The attack shows how internet-connected equipment used to manage refrigeration and building systems can create physical and financial consequences when its controls are accessed and altered. Supermarket refrigeration is part of the infrastructure that keeps perishable food safe; changing its operating settings can lead to spoiled stock and, in this case, fires, according to French authorities.
For France, the public attribution carries consequences beyond the technical investigation. The government has named an alleged foreign military unit and connected the incident to a broader diplomatic response, including a planned EU sanctions proposal. The case also puts pressure on businesses that operate connected equipment to review how those systems are exposed and managed.
France’s cybersecurity response team had warned in October that affected controllers had management interfaces accessible from the internet, which it described as contrary to good practice. That warning identifies a reported exposure issue; the available material does not establish that every affected site had the same configuration or that a single security weakness explains the full incident.
Products Worth Considering
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How France Built Its Attribution
The attack took place on the night of October 11–12. For roughly four weeks, the question of responsibility remained unresolved publicly. On November 9, three parts of the French state set out their response: the foreign ministry issued a formal declaration attributing the actions to Iran and Shahid Kaveh; technical services published their indicators; and the Paris prosecutor announced a judicial investigation.
The technical assessment was issued by the Cyber Crisis Coordination Centre, which brings together France’s cybersecurity agency ANSSI, military cyber command, defence procurement agency and intelligence services DGSE and DGSI. Its report says infrastructure used in the supermarket incident was also used in the same period to scan Schneider Electric equipment associated with smaller energy and water production units. It says the use of the industrial protocol Modbus on port 502 has been associated with Shahid Kaveh since at least April 2026.
The French report also attributes earlier operations against France since 2020 to a separate IRGC unit, Shahid Shoostari, including an attack on the Charlie Hebdo website in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics. These are attributions made by French authorities, not findings established in the supermarket case by a court.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Attribution Still Faces Legal Tests
France has published indicators supporting its conclusion, but the available evidence is a government attribution, not a court ruling. Cyber operations can involve routing through other countries or misleading clues; the French report’s indicators are presented as a combined basis for attribution. The public material does not disclose all underlying intelligence or establish how each piece of evidence was independently verified.
The prosecutor’s investigation is ongoing, and seeking international arrest warrants is not the same as obtaining arrests or proving guilt. The source material does not say whether the warrants have been issued, which countries might act on them, or whether the named people are in custody. Iran had not publicly responded by Monday evening, according to The Record.
Some operational details also remain unsettled in the public account, including the exact number of affected sites, the full breakdown of losses and the specific route by which attackers accessed each controller. The foreign ministry’s figure of more than 700 sites and the technical report’s wording of about 700 are close but not identical.
Sanctions and Investigation Ahead
France says it will propose new sanctions at the European Union level. The source material does not specify when the proposal will be formally submitted or whether other EU governments will support it. The diplomatic response may develop as France seeks backing from its partners and as Iran’s public position becomes clearer.
The Paris judicial investigation will continue to examine the alleged roles of Shahid Kaveh’s head, two deputies and any other people identified by investigators. Authorities are seeking international arrest warrants, but the next public milestones—whether warrants are issued, whether suspects are located and whether charges proceed—remain unknown.
French technical services may also release further findings as the investigation develops. For supermarkets and other operators, the immediate practical issue highlighted by France’s October warning is the exposure of internet-accessible management interfaces on connected equipment. The government’s attribution answers who it says was responsible; it does not yet provide a complete public account of how every affected system was compromised or what remediation has been completed.
Key Questions
What happened to the supermarket refrigeration systems?
France says attackers changed defrost settings to high temperatures during the night of October 11–12. The government reported effects at about 700 retail sites, major food losses and at least 15 fires.
Who does France blame for the attack?
France attributes it to Shahid Kaveh, a cyber unit it says is affiliated with Iran’s Islamic Revolutionary Guard Corps. This is the French government’s attribution, not a court finding.
What evidence did France cite?
The published report points to shared attack infrastructure, use of the FOFA scanning tool, a propaganda channel that relayed the attack and traces of Farsi. The prosecutor’s office also cited IP addresses linked to devices in Iran.
Has Iran responded or have suspects been arrested?
Iran had not publicly responded by Monday evening, according to The Record. France’s prosecutor is seeking international arrest warrants for the alleged unit head and two deputies, but the supplied reporting does not say that warrants have been issued or that anyone has been arrested.
What is France planning to do next?
France says it will propose new EU sanctions and continue the judicial investigation. The timing and outcome of the sanctions proposal, as well as the investigation’s next steps, have not been announced in the source material.
Source: ThorstenMeyerAI.com
