France links 700-site refrigeration hack to Iranian unit

France says Iranian state-backed hackers compromised industrial refrigeration controllers at about 700 retail sites overnight on October 11–12, driving defrost settings to high temperatures and causing at least 15 fires and tens of millions of euros in food losses.

The failures disrupted systems used to preserve food, forcing stores to discard fresh and frozen products. That distinction matters: the attack did not merely expose data; it changed machine behavior and produced significant material damage.

An earlier BleepingComputer report estimated 250 to 350 French supermarkets had been affected. French authorities later disclosed approximately 700 targeted retail locations, about twice the earlier upper estimate.

A CERT-FR technical report listed Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché among the affected businesses. Smaller butcher shops, a slaughterhouse and cooperative food-processing facilities also fell within the operation’s scope.

Attribution and evidence

France’s Ministry for Europe and Foreign Affairs made its judgment in a Monday statement: “France condemns in the strongest possible terms the unacceptable cyberattacks carried out on its territory by the Islamic Republic of Iran against its interests.”

France’s Cyber Crisis Coordination Center, or C4, brought together the national cybersecurity agency ANSSI, military cyber command and intelligence agencies. C4 attributed the supermarket operation to Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps.

Investigators tied Shahid Kaveh to the operation through infrastructure, tooling, publication and language evidence:

• The same attacker infrastructure conducted reconnaissance against Schneider Electric industrial systems, using techniques previously associated with Shahid Kaveh.
• The attackers used FOFA, the internet-connected device search platform CERT-FR says the group commonly uses in its operations.
• The C4 said: “The cyberattack targeting refrigeration controllers was relayed on the propaganda outlet CyberbanNews, associated with the Shahid Kaveh unit, as early as October 13, 2026.”
• Investigators found traces of Farsi language in the attacker infrastructure.

Shahid Kaveh operates through online hacktivist identities including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, CERT-FR said.

The unit’s record predates the supermarket operation. CERT-FR says Shahid Kaveh claimed responsibility for a large-scale sabotage campaign targeting Israeli and U.S. interests in March and April 2026, including attacks on Israeli refrigeration equipment and other industrial control systems. In April 2026, investigators observed the unit conducting large-scale reconnaissance of Schneider Electric industrial controls, including systems in France.

A wider operational reach

French investigators also detected attacks against Schneider Electric industrial equipment at small hydroelectric installations during the same period and linked them to the same campaign. They described the effects on the targeted equipment as moderate.

A second wave of refrigeration-system attacks, reported in November, affected more than 115 stores across six European countries. France’s national blood service also reported a similar incident: attackers altered temperature and defrost settings at three facilities used to store blood products.

France has attributed only the October supermarket attacks to Iranian hackers, not the later attacks. Even so, last week, the FBI and CISA warned of ongoing cyberattacks targeting industrial refrigeration and cold-chain monitoring systems worldwide.

The French government said it will summon Iran’s ambassador to condemn the attacks and propose new European Union sanctions against Iranian individuals and organizations involved in malicious cyber operations.

What does this change for cold-chain operators?

For cold-chain operators, the practical change is straightforward: refrigeration controllers belong in the same risk model as other industrial control systems. The campaign turned remote access to a controller into food loss, material damage and fire across hundreds of locations.

The public account names retail chains and Schneider Electric, but it does not identify the affected refrigeration-controller make, model or software version. That leaves the disclosure broad rather than product-specific.

Last week’s FBI and CISA warning puts industrial refrigeration and cold-chain monitoring systems worldwide on notice, even though France ties only the October supermarket attacks to Iranian hackers.

Altered defrost settings turned a cyber intrusion into spoiled food, damaged equipment and fire.