🔍 Read the full analysis: The Fridge Hack Allegation: France’s Evidence Against Iran on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
France said on November 9 that an IRGC cyber unit called Shahid Kaveh carried out an October attack on refrigeration controllers at about 700 retail sites. French authorities cite a bundle of technical indicators; Iran had not publicly responded by Monday evening, and the attribution has not been tested in court.
France on November 9 attributed an October cyberattack on refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). French officials say the attack changed defrost settings, causing food losses and at least 15 fires; the attribution is a government assessment, not a court finding, and Iran had not publicly responded by Monday evening.
A report from France’s Cyber Crisis Coordination Centre, published through the national cybersecurity agency’s CERT-FR service, says the attack took place overnight from October 11 to 12. The controllers’ defrost parameters were changed to high temperatures, according to the report, leading to what it described as significant losses of goods and fires in at least 15 cases. France’s foreign ministry put the number of affected retail sites at more than 700.
The foreign ministry issued a formal declaration attributing the operation to Shahid Kaveh, which it described as part of the IRGC’s electronic and cyber centre. The Paris prosecutor’s office has opened a judicial investigation into the unit’s head, two deputies and other people who may be identified. According to the Associated Press, prosecutors are seeking international arrest warrants. Opening an investigation does not establish guilt, and the allegations have not been tested in court.
France also announced diplomatic and policy measures: it summoned Iran’s ambassador and said it would propose new European Union sanctions. The technical report points to several indicators rather than a single conclusive piece of evidence: shared attack infrastructure, use of a scanning tool the report associates with the unit, a propaganda channel that relayed the attack, and traces of Farsi. The prosecutor’s office additionally cited IP addresses linked to devices in Iran, according to the AP.
The Fridge Hack Allegation France’s case against Iran
France attributes an October attack on retail refrigeration systems to an IRGC cyber unit. Its evidence supports a government assessment, not a court finding.
What France says happened
French officials say attackers altered refrigeration controllers, with consequences for food storage and safety.
Defrost parameters were reportedly set to high temperatures.
Authorities describe significant food losses and fires at affected sites.
The government attributed the operation to Shahid Kaveh, affiliated with the IRGC.
The evidence bundle
France cites several indicators together; the material does not describe one definitive technical artifact.
Shared attack infrastructure
The report links infrastructure to other scanning activity around the same period.
FOFA and Modbus
France points to FOFA use and Modbus activity it associates with the unit.
Attack relayed online
CyberbanNews, described as linked to the unit, relayed the attack.
Additional traces
The report cites traces of Farsi; prosecutors also cited IP addresses linked to devices in Iran.
What follows—and what remains open
- Summoned Iran’s ambassador.
- Said it would propose new EU sanctions.
- Opened a judicial investigation into the unit’s head, two deputies and others who may be identified.
- Prosecutors are seeking international arrest warrants, according to the AP.
- The attribution has not been tested in court.
- Iran had not publicly responded by Monday evening.
- EU sanctions are proposed, not adopted.
- Total losses and further remediation details remain unclear.
A security lesson for operators
Connected equipment can turn weak access controls into physical disruption and business losses.
- France’s response team had warned that management interfaces for affected controllers were accessible from the internet.
- Businesses operating refrigeration and other industrial systems should treat exposed management interfaces as a direct security concern.
France’s Case and Its Consequences
The incident affected food storage systems at hundreds of retail locations, connecting a cyber operation to physical disruption, spoiled goods and reported fires. French authorities say losses amounted to several tens of millions of euros. The AP reported that the Intermarché chain alone described losses of tens of millions of euros in a single day; those figures are attributed reports, not an independently audited total in the material provided.
France’s public attribution also turns the incident into a diplomatic and legal dispute. Summoning Iran’s ambassador and proposing EU sanctions signal that Paris intends to pursue consequences beyond cybersecurity measures. Any sanctions proposal would require EU action, while arrest warrants and a judicial investigation do not amount to a conviction.
The attack also highlights exposure in ordinary connected equipment. France’s computer emergency response team had warned in October that management interfaces for the affected controllers were accessible from the internet, contrary to good practice. The reported access weakness is a direct security concern for businesses operating refrigeration, building-management and other industrial systems.
Products Worth Considering
Dell 32 Plus 4K Monitor S3225QS, 31.5-Inch VA, 120Hz, FreeSync Premium
Samsung 32-inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
Dell UltraSharp U3225QE 31.5-Inch 4K UHD 120Hz IPS Black Thunderbolt Hub Monitor
As an affiliate, we earn on qualifying purchases.
From October Attack to Attribution
For roughly four weeks after the October incident, responsibility remained unresolved publicly. On November 9, three parts of the French state addressed the matter: the foreign ministry announced the attribution, the technical services published their supporting report, and the Paris prosecutor’s office announced a judicial investigation. The technical report was produced by C4, France’s cyber crisis coordination centre, which brings together cybersecurity, military, defence and intelligence bodies.
The report describes four main strands of evidence. It says infrastructure used in the supermarket operation was also used around the same period to scan Schneider Electric equipment associated with smaller energy and water production sites. The report links the use of the industrial protocol Modbus on port 502 to Shahid Kaveh activity dating to at least April 2026. It also points to FOFA, an internet-scanning tool the report says the group habitually uses, and to CyberbanNews, a propaganda outlet associated with the unit that relayed the attack from October 13.
France’s foreign ministry called the supermarket operation the first cyber-offensive campaign operated purely for sabotage purposes on national territory. That is the government’s characterization. The same technical report attributes other operations against France since 2020, including an attack on the Charlie Hebdo website in 2023 and an attempted hijacking of video display screens during the Paris 2024 Olympics, to a separate IRGC unit, Shahid Shoostari.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
Evidence and Response Still Pending
France has published a bundle of indicators, but the source material does not describe a single definitive technical artifact proving who directed the attack. Cyber attribution can be complicated by traffic routed through other countries and by attempts to leave misleading traces. The report’s indicators support France’s assessment, but their weight has not been evaluated in court.
Iran had not publicly responded by Monday evening, according to The Record. The available material also does not establish whether the proposed EU sanctions will be adopted, when any international arrest warrants might be issued, or whether suspects could be located and brought before a court. The full extent of losses across all affected retailers remains unclear; the official descriptions provided are estimates or reported figures.
Investigation and EU Response
The Paris prosecutor’s investigation is the next formal step in France’s effort to identify and pursue those it alleges were involved. Prosecutors are seeking international arrest warrants for the unit’s head and two deputies, according to the AP. The investigation may develop as authorities gather evidence and attempt to identify additional people; its opening is not a ruling on responsibility.
France has said it will propose new EU sanctions. The proposal’s timing, scope and prospects for approval have not been specified in the source material. France may also face questions from retailers and operators about the exposed management interfaces cited in the October warning, and whether access controls have since been changed. No further remediation details are provided in the report summary.
Key Questions
What happened in the French supermarket cyberattack?
France says attackers changed refrigeration controllers’ defrost settings to high temperatures overnight on October 11–12, 2026. The official report says about 700 retail sites were affected, with food losses and at least 15 fires.
Who does France blame?
The French government attributes the operation to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. That is France’s attribution; it has not been established by a court.
What evidence has France presented?
France cites shared attack infrastructure, use of the FOFA scanning tool, the attack being relayed by a propaganda channel associated with the unit, and traces of Farsi. The Paris prosecutor’s office also cited IP addresses linked to devices in Iran, according to the AP.
Has Iran responded, and have anyone been convicted?
Iran had not publicly responded by Monday evening, according to The Record. The Paris prosecutor has opened an investigation and is seeking international arrest warrants, but the source material reports no convictions.
What action is France taking?
France summoned Iran’s ambassador and said it would propose new EU sanctions. The Paris prosecutor’s office is investigating the unit’s head, two deputies and other potential participants.
Source: ThorstenMeyerAI.com
