France formally blamed Iran's Revolutionary Guards on Monday, Nov. 9, for an October cyberattack that switched refrigeration controllers at about 700 French supermarket sites into high-temperature defrost cycles. Stock spoiled, and fires started in at least 15 cases. The unit France named is Shahid Kaveh. In 2024 the U.S. Treasury sanctioned one of its two commanders, and the head of the cyber command above it, over hacks of industrial controllers used in U.S. water and other critical systems.
In a declaration published by the French Foreign Ministry, the government put food losses alone at several tens of millions of euros, on top of heavy damage to equipment. It called the attack the first cyber campaign on French soil carried out purely for sabotage. Paris will summon Iran's ambassador and propose new European Union sanctions on the people and entities involved, and it reserves the right to take further measures, public or not.
What happened in French stores
The attack ran overnight from Sunday, Oct. 11, into Monday, Oct. 12. According to a joint technical report from France's cyber crisis coordination center, the intruders changed defrost settings on the cooling equipment and fixed them at high temperatures. Most victims were large grocery chains, among them Carrefour, Leclerc, Intermarché, Casino, Coopérative U and Metro. Food producers were hit too. The center's list includes a slaughterhouse, cooperative food plants and several small butcher shops.
The same night, the attackers also went after Schneider Electric equipment at small hydroelectric plants in France, with what the report calls moderate effects.
How France tied it to Iran
Behind the report are France's two intelligence services, two defense bodies and ANSSI, the national cyber agency. It lists four pieces of evidence. The attack infrastructure was also used to scan Schneider Electric controllers with a technique the unit has used since at least April 2026. For the refrigeration attack itself, the operators used FOFA, an internet scanning tool the group habitually relies on. A propaganda channel tied to the unit, CyberbanNews, promoted the attack from Oct. 13. Investigators also found traces of Farsi on the attack servers.
The report names Reza Salarvand and Mahdi Lashgarian as Shahid Kaveh's commanders. The unit sits inside the Guards' Cyber-Electronic Command, headed by Hamid Reza Lashgarian.
The U.S. connection
The unit claims its attacks through online personas, one of them CyberAveng3rs, as the French report spells it. That persona claimed a November 2023 campaign against controllers made by the Israeli company Unitronics, which are used in the United States and Europe.
In response, the Treasury Department sanctioned six officials of the Cyber-Electronic Command on Feb. 2, 2024, including Hamid Reza Lashgarian and Mahdi Lashgarian. Treasury said the hackers had defaced the display screens on Unitronics controllers, which run parts of water systems and other critical infrastructure. In that case, no critical service went down, the department said. The French report adds that the unit claimed a large sabotage campaign against Israeli and American interests in March and April 2026, including Israeli refrigeration equipment.
On Nov. 5, U.S. agencies warned businesses about attacks on refrigeration controllers worldwide, without naming who was behind them, as Edit USA reported then. France's report does not say whether any American sites were hit in the October campaign.
The U.S. advice for operators stands. Get controllers off the open internet. Replace default passwords and install current firmware, and set alarms that fire when temperatures drift. Suspicious activity can be reported to CISA at 844-729-2472 or to the FBI's IC3.
