France has formally blamed Iran for the cyberattack that hit refrigeration controllers at supermarkets overnight on October 11 to 12. In a statement dated November 9, the French foreign ministry says the campaign targeted controllers at more than 700 retail sites, caused considerable material damage, started fires and cost food worth an estimated several tens of millions of euros. It calls it the first cyber-offensive campaign carried out purely for sabotage on French territory, and attributes it to SHAHID KAVEH, a cyber-offensive unit affiliated with the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps (IRGC). France says it will summon Iran’s ambassador and propose new sanctions to its European partners.
The attribution comes from France’s Cyber Crisis Coordination Centre (C4), which brings together the national cybersecurity agency ANSSI, military cyber command and the intelligence services. Its report, published through CERT-FR, says the C4 can attribute destabilization attacks against French interests to the IRGC units Shahid Shoostari and Shahid Kaveh, and describes the October attack as unprecedented in scale and aggressiveness. BleepingComputer and The Record both report at least 15 fires and attacks on Schneider Electric equipment at small hydroelectric sites, with moderate effects. BleepingComputer, citing the CERT-FR report, names Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché among the affected retailers, along with butchers, a slaughterhouse and food-processing cooperatives. It also lists the evidence: attacker infrastructure that was also used to scan Schneider Electric systems, use of the FOFA internet-device search engine, Farsi-language artifacts, and a post on the propaganda outlet CyberbanNews on October 13. The Record adds that, according to the Paris prosecutor’s office, a judicial investigation has been opened and international arrest warrants requested.
The attribution covers only the October attack. It does not address the second wave of refrigeration attacks in early November, which we covered in Second Wave of Attacks Hits Supermarket Freezers Across Europe; BleepingComputer counts more than 115 stores across six European countries for that wave, while The Record says at least 11 countries. For the original incident see Cyberattack Defrosts Refrigerators at French Supermarkets, and for the joint US warning to operators see US Agencies Warn of Attacks on Industrial Refrigeration Controllers.
Sources
- France Diplomatie: Declaration of attribution to Iran of cyberattacks targeting France (French)
- CERT-FR: Offensive cyber activities targeting France carried out by Iranian actors linked to the IRGC (CERTFR-2026-CTI-009)
- BleepingComputer: France blames Iranian hackers for supermarket attacks that sparked fires
- The Record: France blames Iran for fridge cyberattacks, says some caused fires
- The full C4 report is a PDF linked from the CERT-FR page and was not read directly; retailer names, fire count, evidence and prosecutor details above are as reported by BleepingComputer and The Record, as attributed in the text.