France Blames Iran’s IRGC Unit for Refrigeration Sabotage at 700 Retail Sites
Summary
France says the IRGC’s Shahid Kaveh unit carried out an October attack on refrigeration controllers at about 700 retail sites. Attackers allegedly altered defrost settings and disabled safety alerts, causing food losses and fires; a French investigation is underway.
Key points
- The French government attributed the October 11 attack to Shahid Kaveh, a unit it says is part of Iran’s Islamic Revolutionary Guard Corps (IRGC).
- Prosecutors said attackers accessed Danfoss and Dixell controllers through web interfaces, triggered abnormal defrost cycles and disabled temperature-probe safety alerts.
- French sources reported food losses estimated at several tens of millions of euros and about 20 fires.
- Affected organizations included major retailers Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché, as well as smaller food businesses.
- France opened a judicial investigation into the unit’s head, two deputies and others; the government plans to seek sanctions and prosecutors requested international arrest warrants.
- The C4 linked the attack to simultaneous targeting and reconnaissance of Schneider Electric equipment at small hydroelectric installations; reported effects there were moderate.
- CERT-FR warned that internet-exposed refrigeration management interfaces are poor practice and that an end-of-life device without security fixes may be compromised again even after a factory reset.
Article Details
- Victim Organization
- Approximately 700 French retail sites and other food-sector organizations, including Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché
- Incident Type
- Cyber sabotage of internet-accessible refrigeration controllers: attackers remotely changed defrost settings and disabled temperature-probe safety alerts.
- Incident Date
- 2026-10-11
- Operational Impact
- The attack caused food losses estimated by the French Foreign Ministry at several tens of millions of euros. Prosecutors said it caused about 20 fires; an earlier account reported fires in at least 15 cases. Effects on Schneider Electric equipment at several small hydroelectric installations were described as moderate.
- Claim Status
- confirmed
Threat Actors
Cyber Isnaad FrontDescribed as a hacktivist persona through which Shahid Kaveh publicly claims some attacks; the article does not attribute the October French attack directly to this persona.CyberAveng3rsDescribed as a hacktivist persona through which Shahid Kaveh publicly claims some attacks. It claimed a November 2023 campaign against Unitronics and a later campaign targeting Israeli and U.S. interests; the article does not attribute the October French attack directly to this persona.Islamic Revolutionary Guard Corps (IRGC)The French government said an IRGC cyber unit sponsored and carried out the sabotage through Shahid Kaveh.Shahid KavehFrance attributed the refrigeration-controller sabotage to this IRGC cyber unit. French authorities said indicators linked the unit to the attack; this is the French government's attribution.
Vendors
Copelandrefrigeration controllers across four product families. They are the Danfoss AK-SM and AK-SC series, the Copeland xweb, and the Dixell xweb.DanfossIn the October attack, the attackers took remote control of Danfoss and Dixell refrigeration controllers through web interfaces, the prosecutor's office said in a press release. They started abnormal defrost cycles withDixellIn the October attack, the attackers took remote control of Danfoss and Dixell refrigeration controllers through web interfaces, the prosecutor's office said in a press release. They started abnormal defrost cycles withSchneider ElectricThe center also tied the attack to the simultaneous targeting of Schneider Electric equipment at several small hydroelectric installations in France. The effects on that equipment were moderate.Unitronicson industrial equipment, according to C4. Through CyberAveng3rs, it claimed an earlier campaign against Unitronics, an Israeli company that makes industrial control systems, in November 2023. In March and April, it
Products
Copeland XWEBcontrollers across four product families. They are the Danfoss AK-SM and AK-SC series, the Copeland xweb, and the Dixell xweb.Danfoss AK-SMcompromises affecting remote refrigeration controllers across four product families. They are the Danfoss AK-SM and AK-SC series, the Copeland xweb, and the Dixell xweb.Dixell XWEBacross four product families. They are the Danfoss AK-SM and AK-SC series, the Copeland xweb, and the Dixell xweb.
Tools
Countries
FranceThe unit is called Shahid Kaveh. It is known mainly through hacktivist personas, such as CyberAveng3rs and Cyber Isnaad Front, that publicly claim some of its attacks, France says.IranAn October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday.United Statessystems, in November 2023. In March and April, it claimed a large sabotage campaign against Israeli and U.S. interests that hit industrial control equipment, including Israeli refrigeration equipment.
Industries
Energyof Schneider Electric equipment. That equipment is installed at sites such as small- and medium-sized energy and water production sites. The reconnaissance relied on techniques that Shahid Kaveh has used since atRetailAn October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday.waterElectric equipment. That equipment is installed at sites such as small- and medium-sized energy and water production sites. The reconnaissance relied on techniques that Shahid Kaveh has used since at least April.