France says an Iranian unit sabotaged fridges at about 700 supermarkets, causing fires

On November 9, 2026, France publicly blamed Iran for a cyberattack that hit the refrigeration controllers of about 700 supermarkets and other food retail sites on the night of October 11 to 12. In a statement from the foreign ministry (in French), France says the attack caused considerable material damage, fires and food losses estimated at several tens of millions of euros. It calls it the first cyber campaign on French soil carried out purely for sabotage.

France attributes the attack to Shahid Kaveh, an offensive cyber unit within the electronic and cyber centre of Iran’s Islamic Revolutionary Guard Corps (IRGC). The same day, France’s cyber crisis coordination centre, which brings together the national cybersecurity agency ANSSI, the intelligence services, the armed forces’ cyber command and the defence procurement agency, published a joint technical report (in French, PDF).

What happened

According to the report, the centre was alerted on October 12 to an attack on the cold controllers at about 700 large retail sites. During the night, the controllers’ defrost settings were changed to high temperatures, which led to significant loss of goods and, in at least 15 cases, fires. The victims were mainly large grocery chains; the report names the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups. It also lists smaller victims in the food sector, including several small butcher shops, a slaughterhouse and cooperative food factories.

The report links the same attack to targeting of Schneider Electric equipment at several small hydroelectric plants in France, with what it calls moderate effects.

This doesn’t look like ransomware or data theft. The goal was physical damage: equipment set to heat what it should be keeping cold.

Why France blames Iran

The report sets out a “cluster of indications” pointing to the IRGC as sponsor and Shahid Kaveh as operator:

• the infrastructure used in the attack was also used, in the same period, to scan Schneider Electric equipment in small energy and water plants, using techniques (the Modbus protocol on port 502) that Shahid Kaveh has used since at least April 2026
• the operators used the FOFA scanning tool, which this group habitually uses
• CyberbanNews, a propaganda outlet associated with the unit, publicized the attack from October 13
• traces of Farsi were found in the attack infrastructure

The report says Shahid Kaveh is best known through hacktivist personas such as CyberAveng3rs, Soldiers of Solomon and Mr. Soul, which claim its attacks publicly. Under the CyberAveng3rs name, it claimed attacks in November 2023 on industrial controllers made by the Israeli company Unitronics, used in the United States and Europe. The report says the unit has had scripts since at least June 2024 to scan, access and control industrial equipment from Schneider Electric, Siemens and Rockwell.

The report also attributes earlier operations against France to a second IRGC unit, Shahid Shoostari (also known as Emennet Pasargad): a 2023 attack on the magazine Charlie Hebdo’s online shop, and a 2024 attempt to hijack video display screens around the Paris Olympics.

What France is doing

France says it will summon Iran’s ambassador, propose new European Union sanctions against the Iranian entities and individuals involved, and reserves the right to take further public and non-public measures. The BBC reports that the Paris prosecutor has opened an investigation targeting the head of an IRGC offensive cyber unit and his two deputies, and that Iran had not responded officially, though some Iranian media dismissed the allegations as baseless.

The BBC also reports that the attack targeted remote management software for refrigeration made by the Danish firm Danfoss, and that a second wave this month hit more than 100 stores elsewhere in Europe, including in Belgium and Luxembourg. It isn’t known whether that wave is linked, and France’s report doesn’t cover it.

What this means for you

For shoppers, the direct effects were empty shelves and losses at the affected stores in October. France hasn’t said anyone was harmed by eating food from affected fridges. Stores typically discard chilled goods when temperatures go out of range.

The bigger lesson is for anyone who runs equipment that’s reachable from the internet. Last week, U.S. agencies warned that attackers were targeting exactly this kind of controller worldwide, without naming victims. France’s report puts a real, large incident behind that warning.

What you can do

1. If you run a shop, restaurant or warehouse with refrigeration controls, ask your installer or maintenance company whether the controllers or their web dashboards are reachable from the internet. If they are, put them behind a VPN or take them offline.
2. Change default passwords on controllers and building systems, and keep their firmware updated.
3. Keep an independent temperature alarm that doesn’t depend on the same controller, so a tampered setting is noticed quickly.
4. Know who to call. In Canada, businesses can report cyber incidents to the Canadian Centre for Cyber Security.

How Frame helps

This was sabotage of equipment, not a breach of personal data, so there’s nothing to add to your breach list. Frame can still look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t monitor industrial equipment.

Related coverage

• CISA and the FBI say attackers are targeting refrigeration controllers: the U.S. warning from November 5 about the same class of equipment, which named no victims. France’s report now describes a real attack of that kind.

Sources

• France Diplomatie, Déclaration d’attribution à l’Iran de cyberattaques visant la France (in French), November 9, 2026
• CERT-FR / Centre de coordination des crises cyber, Activités cyber offensives menées par des acteurs iraniens liés au CGRI (in French, PDF), November 9, 2026
• BBC News, France accuses Iran of supermarket fridge hacking, November 2026