France Blames Iran-Linked Unit for Supermarket Refrigeration Attacks
Summary
France attributes October attacks on roughly 700 retail sites to Iran’s Shahid Kaveh unit. Authorities say compromised refrigeration controllers caused food losses and at least 15 fires; France cited infrastructure, reconnaissance and language clues.
Key points
- France says the October 11–12 attacks targeted about 700 retail locations; at least 15 fires and tens of millions of euros in food losses were reported.
- Attackers compromised industrial refrigeration controllers and remotely changed defrost settings to high temperatures.
- France attributed the attacks to Shahid Kaveh, an IRGC-affiliated cyber unit, citing infrastructure links, reconnaissance activity, use of FOFA and Farsi-language traces.
- CERT-FR reported that affected sites included major supermarket chains, smaller butcher shops, a slaughterhouse and food-processing facilities.
- French investigators linked attacks on Schneider Electric equipment at small hydroelectric installations during the same period to the campaign, with reportedly moderate effects.
- France said its attribution applies to the October attacks on French supermarkets, not the later reported attacks affecting stores in six European countries.
Article Details
- Victim Organization
- Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché; smaller butcher shops, a slaughterhouse, and cooperative food-processing facilities
- Incident Type
- Cyberattacks on industrial refrigeration controllers: attackers remotely changed defrost settings to high temperatures. French authorities also linked attacks on Schneider Electric equipment at small hydroelectric installations to the same campaign.
- Incident Date
- 2026-10-11
- Disclosure Date
- 2026-11-09
- Operational Impact
- Approximately 700 retail locations were targeted. The attacks caused at least 15 fires, tens of millions of euros in food losses, and significant material damage. An earlier report estimated 250–350 supermarkets were affected. Separate attacks on equipment at small hydroelectric installations reportedly had moderate effects.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
Cyber Isnaad FrontCERT-FR says Shahid Kaveh operates through this online hacktivist identity.CyberAveng3rsCERT-FR says Shahid Kaveh operates through this online hacktivist identity.Mr. SoulCERT-FR says Shahid Kaveh operates through this online hacktivist identity.Shahid KavehFrench authorities attributed the October 2026 attacks on French supermarket refrigeration systems to this Iranian cyber-offensive unit, affiliated with the electronic and cyber center of Iran's Islamic Revolutionary Guard Corps. The source also says the unit claimed responsibility for a separate sabotage campaign targeting Israeli and U.S. interests in March and April 2026.Soldiers of SolomonCERT-FR says Shahid Kaveh operates through this online hacktivist identity.
Vendors
Tools
Countries
FranceFrance blames Iranian hackers for supermarket attacks that sparked firesIranthe attacks on Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of Iran's Islamic Revolutionary Guard Corps (IRGC).United StatesCERT-FR says Shahid Kaveh claimed responsibility for a large-scale sabotage campaign targeting Israeli and U.S.