France Attributes Supermarket Cyberattacks to Iranian Hackers

France has attributed cyberattacks in October that disrupted refrigeration systems at over 700 supermarkets and retail locations to Iranian state-backed hackers. The attacks reportedly caused food losses and ignited at least 15 fires.

In a statement released on November 9, France’s Ministry for Europe and Foreign Affairs identified the cyber-offensive unit Shahid Kaveh, associated with Iran’s Islamic Revolutionary Guard Corps (IRGC), as responsible for the attacks. The statement condemned the actions as “unacceptable cyberattacks carried out on its territory by the Islamic Republic of Iran against its interests.”

The incidents occurred overnight on October 11–12, when hackers compromised industrial refrigeration controllers, altering defrost settings to high temperatures and disrupting systems crucial for food preservation.

According to reports, the attacks affected an estimated 250 to 350 French supermarkets, leading to the disposal of fresh and frozen products. French authorities later revealed that approximately 700 retail locations were targeted, resulting in significant food losses and at least 15 fires.

A technical report from France’s cybersecurity agency, CERT-FR, indicated that several major supermarket chains, including Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché, along with smaller butcher shops and food-processing facilities, were impacted by the cyberattacks.

The financial repercussions are substantial, with French authorities estimating tens of millions of euros in food losses and considerable material damage. Additionally, investigators noted attacks against Schneider Electric industrial equipment at small hydroelectric installations during the same timeframe, linking these incidents to the same campaign.

Following the October attacks, a second wave of similar cyberattacks was reported in November, affecting over 115 stores across six European countries. France’s national blood service also experienced a related incident that disrupted temperature controls at facilities storing blood products.

Last week, the FBI and CISA issued warnings about ongoing cyberattacks targeting industrial refrigeration and cold-chain monitoring systems globally. In response, the French government plans to summon Iran’s ambassador to condemn the attacks and discuss potential new European Union sanctions against Iranian individuals and organizations involved in cyber operations.

France’s Cyber Crisis Coordination Center (C4) has linked the attacks to the Iranian Shahid Kaveh unit, which operates under various online identities, including CyberAveng3rs and Soldiers of Solomon. The C4 noted that the cyberattack targeting refrigeration controllers was publicized by the propaganda outlet CyberbanNews, associated with the Shahid Kaveh unit, shortly after the attacks occurred.

Investigators found evidence connecting the refrigeration attacks to Shahid Kaveh, including the use of infrastructure previously associated with the unit and traces of Farsi-language in the attacker’s infrastructure. CERT-FR reported that Shahid Kaveh had claimed responsibility for a large-scale sabotage campaign targeting Israeli and U.S. interests earlier in 2026.

Source: BleepingComputer