By Thorsten Meyer | November 10, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Key takeaways
- France names a culprit. On November 9, 2026, the French government said a cyber unit of Iran’s Islamic Revolutionary Guard Corps (IRGC) called Shahid Kaveh carried out the October 11 to 12 attack on supermarket refrigeration controllers. That is France’s attribution. Iran had not publicly responded by Monday evening, according to The Record.
- The scale, in official words: refrigeration controllers at about 700 retail sites (the foreign ministry says more than 700), defrost settings switched to high temperatures, major food losses and at least 15 fires, according to the joint report of France’s cyber crisis centre.
- The evidence France published is a “bundle of indicators”, not a single smoking gun: shared attack infrastructure, a familiar scanning tool, a propaganda channel that relayed the attack, and traces of Farsi. The Paris prosecutor adds IP addresses linked to devices in Iran.
- Consequences so far: the Iranian ambassador was summoned, France will propose new EU sanctions, and the Paris prosecutor opened a judicial investigation and is seeking international arrest warrants for the unit’s head and two deputies.
- The weak point was not exotic. France’s computer emergency team had warned in October that the affected controllers had management interfaces exposed to the internet, “contrary to good practice”. That is the lesson for every business with connected building equipment.
Products Worth Considering
DJI Mini 4 Pro Fly More Combo Drone with DJI RC 2
DJI Mini 4K Drone with 4K UHD Camera
Sony WH-1000XM5 Premium Noise Cancelling Wireless Headphones – Midnight Blue
As an affiliate, we earn on qualifying purchases.
A setting changed at night, and the shelves were empty by morning
Most people never think about the box on the wall that runs a supermarket’s cold rooms. It decides when the freezers defrost, how long, and how warm the coils may get. In the night of Sunday, October 11 to Monday, October 12, someone reached those boxes in hundreds of French stores over the internet and changed exactly that. “The defrost parameters of the equipment were changed to be set at high temperatures,” says the report published on November 9 by France’s Cyber Crisis Coordination Centre, known as C4.
The result, in the report’s words: “significant losses of goods and, in at least 15 cases, fires.” The Associated Press reported that temperatures reached 50 °C for about six hours and that the Intermarché chain alone reported losses of “tens of millions of euros” in a single day. The French foreign ministry puts the total food losses at “several tens of millions of euros”.
For four weeks, the question was who. Now France has given its answer.
What France says, and who is saying it
Three official voices spoke on the same day.
The foreign ministry published a formal “declaration of attribution”. It says France “is in a position to attribute to Iran” these destructive actions, carried out by “the cyber-offensive unit SHAHID KAVEH, affiliated with the electronic and cyber centre” of the IRGC. It calls the campaign “the first cyber-offensive campaign operated purely for sabotage purposes on national territory”. At a G7 meeting in Paris, Foreign Minister Jean-Noël Barrot said, as quoted by AFP: “I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
The technical services published the evidence. C4 brings together France’s cybersecurity agency ANSSI, the military cyber command, the defence procurement agency and the two intelligence services, DGSE and DGSI. Their five-page report, published by CERT-FR as CERTFR-2026-CTI-009, is the core document of this story. It also attributes earlier operations against France since 2020, including the Charlie Hebdo website attack in 2023 and an attempt to hijack video display screens during the Paris 2024 Olympics, to a second IRGC unit, Shahid Shoostari.
The justice system moved too. Paris prosecutor Laure Beccuau opened a judicial investigation “against the head of the Iranian group Shahid Kaveh”, “against his two deputies, and against any other individuals who may be identified”, as quoted by AFP. According to the AP, the offences include the aggravating circumstance of “having been committed to serve the interests of a foreign power — in this case, Iran”, and the prosecutor’s office is seeking international arrest warrants.
An investigation is not a conviction. France has made an accusation and laid out its reasons; nothing has been tested in a court.
The evidence: four clues, and what the prosecutor adds
Attribution in cyberspace is hard, because attackers can route their traffic through other countries and plant false clues. So the most useful part of the French report is that it says why. It lists four indicators that, together, point to the IRGC as the sponsor and Shahid Kaveh as the unit that carried out the attack:
- Shared infrastructure. The same attack infrastructure was used in the same period to scan Schneider Electric equipment used in small and medium energy and water production units. The technique (the industrial protocol Modbus on port 502) has been used by Shahid Kaveh since at least April 2026, the report says.
- A familiar tool. The operators used the internet scanning tool FOFA, which the report says this group habitually uses.
- The bragging. The attack was relayed by the propaganda outlet CyberbanNews, which the report associates with Shahid Kaveh, from October 13.
- Language. “Traces of the use of Farsi were found in the attack infrastructure.”
The prosecutor’s office, as reported by the AP, points to the same language and adds a second clue: the attackers used Farsi, and IP addresses linked to devices located in Iran.
The report also says the attackers went after more than fridges. In parallel, it says, they targeted Schneider Electric equipment at several small hydroelectric installations in France, “with moderate effects”.
Who Shahid Kaveh is, according to the governments that track it
The French report describes Shahid Kaveh as a unit known mainly through “hacktivist” personas, among them CyberAveng3rs, which claim its attacks in public. That name is familiar to anyone who runs water systems in the United States. In a joint advisory, the FBI, CISA, the NSA and partner agencies in Israel, Canada and the UK describe CyberAv3ngers as “an Iranian IRGC-affiliated cyber persona”. Between November 2023 and January 2024, they write, the group compromised at least 75 industrial controllers made by the Israeli firm Unitronics, at least 34 of them in the US water sector. How? “Internet accessible devices with default or no passwords.”
According to the French report, the unit also claimed a large sabotage campaign against Israeli and American interests in March and April 2026 that hit industrial control equipment, including Israeli refrigeration equipment.
The French report names three IRGC officers in an annex: the head of the IRGC’s electronic and cyber centre and two commanders of Shahid Kaveh. The Record reports that the US State Department had already offered rewards for information on two of them.
What Iran says
Little, so far. Iran “had not publicly responded to France’s allegations by Monday evening”, The Record reported, and noted that Iran routinely denies conducting malicious cyber operations. The BBC reported that Iran “has yet to respond officially, but some Iranian media outlets have dismissed the allegations as baseless.” Reuters, as published by NBC News, said Iran’s mission to the United Nations did not return messages seeking comment.
What France will do next
The foreign ministry lists three steps: summon the Iranian ambassador, propose “new sanctions against Iranian entities and individuals” to its European partners, and reserve “the right to take any additional measure, public and non-public”. It points out that the EU already sanctioned the Iranian entity Emennet Pasargad, the group the French report equates with Shahid Shoostari, in March 2026. EU foreign policy chief Kaja Kallas said “our response should be strong,” as quoted by AFP.
How the attack worked: the door was already open
The French report explains who. The CERT-FR alert from October, CERTFR-2026-ALE-012, explains how the door was open. It lists the targeted systems: Danfoss AK-SM and AK-SC series controllers, and Copeland and Dixell xweb supervisors. And it states the core problem plainly: “In general, exposing a management interface on the internet is contrary to good practice.”
Reuters, as published by NBC News, reported that the company behind many of the affected units said several were obsolete or running outdated firmware. CERT-FR’s alert adds a hard warning about such end-of-life devices: keeping one exposed means “a very high probability of compromise”, and a factory reset alone “is insufficient” because the device “will certainly be compromised again”.
Where AI fits, and where it does not
You might expect an AI angle here. The official documents do not give one. Neither the C4 report nor the foreign ministry statement nor the prosecutor’s statement, as reported, says artificial intelligence was used in this attack. What the report does describe is an internet scanning tool and controllers that could be reached online. Reuters, as published by NBC News, noted that the rise of AI-powered cyberattacks was one of the things people speculated about before the attribution. On the evidence published so far, this attack did not need AI. It needed exposed equipment.
That is the uncomfortable part. A state unit did not have to break anything clever. It had to find the devices that were left reachable.
What this means for businesses
This is not only a retail story. Every company runs equipment that someone else installed and that talks to the outside world: refrigeration, heating and air conditioning, access control, energy meters, pumps. Those devices are often managed by a contractor, not by the IT team, and they are rarely patched. The French case shows what happens when a state actor goes looking for them.
The CERT-FR alert gives a concrete to-do list. In plain terms:
- Find your exposed devices. Remove internet exposure for refrigeration controllers and any unit on a public IP address. Before you cut the contractor’s data link, check your insurance terms, as CERT-FR advises.
- Remote access only through a secure VPN or a protected network. Filtering by the contractor’s IP addresses is an emergency stopgap, CERT-FR says, not a lasting fix.
- Update and harden. Firmware updates, strict security mode where the maker offers one, and no default passwords.
- Check the settings that can hurt you. CERT-FR specifically says to review the whole configuration, “in particular the defrost ranges”.
- Plan to replace end-of-life equipment. A device that gets no security updates should not be online at all.
- Talk to your contractor. Ask who can reach your equipment, from where, with which account, and how you would know if settings change in the middle of the night.
The C4 report adds another reason to care: victims were not only big chains. It lists “several small butcher shops, a slaughterhouse and cooperative food factories”. Small operators with one contractor and no security team are exactly the ones whose devices stay online.
For supply chains, the risk is a cold-chain break you cannot see. A changed defrost setting looks like a technical fault until someone checks the logs. Alarms that go to a person, independent temperature sensors and a clear rule for when to discard goods matter as much as firewalls.
What this means for shoppers
For most people, the direct effect was empty fridges and lost food in the days after the attack. Stores had to throw goods away. If you shop at a store that was affected, the safeguard is the store’s own temperature checks, not anything you can see on the shelf. As always, check use-by dates and the condition of chilled and frozen goods.
The bigger point for citizens is political. France calls this the first large-scale cyber sabotage on its territory. When a government says a foreign military unit switched off the cold chain in hundreds of shops, cybersecurity stops being an IT topic. It becomes part of how states pressure each other.
What we don’t know
- The second wave. On November 2, stores in several other European countries reported similar attacks on their refrigeration. The French report does not address that wave, The Record notes, and the BBC says “it is not known if the instances are linked.” France has not attributed it.
- How the evidence was tested. The report lists indicators but no technical indicators of compromise and no detail on the IP addresses. Independent verification is not possible from the public material.
- The exact way in. Whether the attackers used default passwords, known software flaws or other access is not stated in the official documents.
- Iran’s official position. As of publication, we found no official Iranian government statement.
- Which sanctions. France says it will propose them. Nothing has been adopted at EU level yet.
The bottom line
France has done something rare: it named a foreign military unit, published its reasons, and opened a criminal case on the same day. Whether the attribution holds is a question for investigators and, maybe one day, a court. The practical lesson does not depend on who did it. The fridges were reachable from the internet. Any equipment that is reachable can be found, and if it can be found, it can be switched.
For the background, read our reports on the second wave of attacks on Europe’s supermarket refrigeration and on the night hackers reached a blood bank’s plasma freezers.
I’m Thorsten Meyer. The full sources are below, and more reality checks are at thorstenmeyerai.com.
Sources
- Centre de Coordination des Crises Cyber (C4), published by CERT-FR: “Activités cyber offensives menées par des acteurs iraniens liés au CGRI”, report CERTFR-2026-CTI-009, November 9, 2026, cert.cyber.gouv.fr
- French Ministry for Europe and Foreign Affairs: “Déclaration d’attribution à l’Iran de cyberattaques visant la France”, November 9, 2026, diplomatie.gouv.fr
- CERT-FR: alert CERTFR-2026-ALE-012, “Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération”, versions of October 12, 13 and 16, 2026, cert.cyber.gouv.fr
- FBI, CISA, NSA and partners: “IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities”, advisory AA23-335A, updated December 2024, cisa.gov
- Paris prosecutor Laure Beccuau, statement of November 9, 2026, as reported by AFP (via Arab News), the Associated Press (via OPB and SecurityWeek) and Clubic
- AFP via Arab News: “France says Iran’s Guards behind cyberattacks on fridges”, November 9, 2026 (Barrot and Kallas quotes)
- Associated Press via OPB and SecurityWeek: “France blames Iran for a cyberattack that heated supermarket refrigerators”, November 9, 2026
- The Record by Recorded Future News, Alexander Martin: “France blames Iran for fridge cyberattacks, says some caused fires”, November 9, 2026
- BBC News: “France accuses Iran of supermarket fridge hacking”, November 9, 2026
- Reuters via NBC News: “France accuses Iran’s Revolutionary Guards of hacking supermarket refrigerators”, November 9, 2026
Researched and drafted with AI assistance, including Anthropic’s Claude. No government, company or agency named here reviewed or sponsored this article. This article is for information only. It is not legal, security-consulting or insurance advice. Translations from French are my own. Images: AI-generated illustration (Runware) and graphics by Thorsten Meyer AI; no real stores, people or logos are shown.
