In an escalating geopolitical and cybersecurity crisis, the French government has formally blamed Iranian state-backed hackers for a sophisticated and destructive wave of cyberattacks that crippled industrial refrigeration systems across hundreds of supermarkets and retail establishments last October. The coordinated digital assault, which targeted critical cold-chain infrastructure, not only resulted in the spoilage of massive quantities of perishable goods and tens of millions of euros in financial losses but also sparked at least 15 physical fires due to the severe operational stress placed on compromised machinery.
The formal attribution was announced in a strongly worded statement issued by France’s Ministry for Europe and Foreign Affairs. According to French authorities, the offensive operations were masterminded and executed by Shahid Kaveh, a specialized cyber-offensive unit operating under the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps (IRGC). This declaration marks a critical turning point in how European governments are publicly addressing state-sponsored cyber sabotage that transcends the digital realm and causes tangible, physical damage to civilian infrastructure.
An Unprecedented Digital Assault on Civilian Food Supply
The crisis unfolded overnight between October 11 and October 12, when unknown malicious actors systematically bypassed the digital perimeter defenses of industrial refrigeration controllers deployed across France. Once inside the operational technology (OT) networks, the threat actors remotely manipulated system configurations, specifically altering defrost settings to excessively high temperatures. This unauthorized intervention crippled the temperature-regulation mechanisms essential for preserving fresh food, dairy, and frozen inventories.
While initial reports estimated that between 250 and 350 supermarkets were affected, comprehensive follow-up investigations by France’s Cyber Crisis Coordination Center (C4)—which integrates the country’s national cybersecurity agency ANSSI, military cyber command, and premier intelligence agencies—revealed the true scale of the operation. Approximately 700 retail and food-processing locations were ultimately targeted during the October campaign.
A technical report published by France’s CERT-FR outlined the broad spectrum of victims. Major French retail conglomerates, including Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché, were struck. However, the impact was not limited to corporate giants; smaller independent butcher shops, rural slaughterhouses, and regional cooperative food-processing facilities were also caught in the crosshairs. The resulting food losses and material damage pushed total economic costs into the tens of millions of euros.
Beyond the supermarket sector, investigators uncovered parallel cyberattacks targeting Schneider Electric industrial equipment installed at small hydroelectric facilities during the same operational window. Although these secondary utility attacks resulted in only moderate technical disruptions, they demonstrated a broader intent to probe and destabilize various facets of France’s critical national infrastructure.
Chronology of a Broader European and Global Campaign
The October attacks against France did not occur in a vacuum; rather, they represent a prominent node in a wider, interconnected matrix of international cyber sabotage. The timeline of these escalating threats highlights a concerted campaign by Iranian-affiliated threat actors against Western critical infrastructure:
- March and April 2026: Shahid Kaveh allegedly conducted extensive reconnaissance and large-scale sabotage campaigns targeting Israeli and United States interests, focusing heavily on refrigeration equipment and industrial control systems (ICS). During this period, the unit was specifically observed scanning Schneider Electric industrial control systems globally, including assets located within French territory.
- October 11–12, 2026: The primary wave of coordinated cyberattacks strikes approximately 700 supermarkets and food facilities across France, causing widespread food spoilage, structural damage, and 15 physical fires.
- October 13, 2026: The sabotage operation is publicly celebrated and detailed on CyberbanNews, a propaganda outlet known to be associated with the Iranian Shahid Kaveh unit, signaling an immediate shift from covert infiltration to psychological warfare and attribution.
- November 2026: A second wave of refrigeration system cyberattacks is reported across Europe, impacting more than 115 commercial stores spanning six different European countries.
- Late 2026: France’s national blood service reports a troubling related incident, wherein malicious actors successfully altered temperature and defrost settings at three separate storage facilities dedicated to preserving vital blood products.
- Recent Weeks: The United States Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) issue a joint urgent warning regarding ongoing, persistent cyberattacks targeting industrial refrigeration and cold-chain monitoring systems on a global scale.
Unmasking Shahid Kaveh and Its Proxy Personas
France’s C4 and CERT-FR have meticulously pieced together the operational infrastructure of the actors responsible for the breach. Investigations revealed that Shahid Kaveh does not exclusively operate under a single banner; instead, the unit routinely employs various online hacktivist personas to obscure its direct connection to the Iranian regime.
Among the primary aliases linked to the Shahid Kaveh unit by Western intelligence agencies are CyberAveng3rs, Soldiers of Solomon, Mr. Soul, and the Cyber Isnaad Front. These fictitious "hacktivist" fronts are frequently used to claim responsibility for destructive cyber operations, providing Tehran with a veneer of plausible deniability while simultaneously advancing Iranian strategic interests through proxy warfare.
French technical analysts confirmed the link between the October supermarket sabotage and Shahid Kaveh by analyzing digital artifacts, command-and-control infrastructure, and the distinct tactics, techniques, and procedures (TTPs) utilized during the intrusions. Notably, the rapid amplification of the supermarket attacks on the CyberbanNews channel served as a definitive fingerprint connecting the digital kinetic activity back to the IRGC-affiliated unit.
Diplomatic Fallout and Proposed Sanctions
In response to the unprecedented violation of French sovereignty and the direct endangerment of its civilian population, the French government has initiated a robust diplomatic and economic counter-offensive.
The Ministry for Europe and Foreign Affairs announced that the Iranian ambassador to France will be formally summoned to receive a blistering condemnation of the attacks. During this diplomatic reprimand, French officials intend to make clear that targeting critical civilian infrastructure—particularly food supply chains and public health assets—crosses an intolerable red line in international relations.
Furthermore, Paris is not limiting its response to bilateral censure. France has signaled that it will actively lobby its partners within the European Union to formulate and implement a new, targeted package of EU sanctions. These proposed punitive measures are designed to freeze assets and impose travel bans on specific Iranian individuals, entities, and military organizations identified as participating in or facilitating malicious cyber operations against European nations.
It is important to note, however, that the French government’s formal attribution currently restricts itself to the October supermarket attacks. French authorities have not officially pinned subsequent November multi-country refrigeration disruptions or the blood-storage facility tampering on Tehran, though intelligence sharing among European and transatlantic allies continues at a rapid pace to determine the full scope of the threat actor network.
Implications for Industrial Security and Global Food Chains
The realization that state-backed threat actors are actively weaponizing industrial refrigeration and cold-chain systems marks a sobering milestone in the evolution of cyber warfare. Traditionally, nation-state cyber operations have focused on espionage, intellectual property theft, or the disruption of high-profile financial and governmental networks. The intentional targeting of commercial food refrigeration systems—yielding literal food shortages, economic strain, and physical fires—illustrates a dangerous descent into asymmetric warfare aimed at civilian populations and foundational societal lifelines.
Cybersecurity experts emphasize that industrial control systems (ICS) and operational technology (OT) networks have historically lagged behind enterprise IT systems in terms of robust security hardening, multi-factor authentication, and continuous monitoring. Many commercial refrigeration units are connected to the broader internet for remote maintenance and monitoring by third-party vendors, inadvertently creating expansive attack surfaces for sophisticated adversaries to exploit.
The joint warnings issued by agencies like CISA, the FBI, ANSSI, and CERT-FR underscore an urgent industry-wide imperative. Organizations operating critical cold-chain infrastructure—ranging from supermarket conglomerates and food processors to medical storage facilities—are now forced to rapidly overhaul their cybersecurity postures. Implementing strict network segmentation, auditing third-party vendor access, deploying anomaly detection systems tailored for OT environments, and ensuring that physical safety overrides cannot be triggered remotely are no longer optional best practices; they are absolute necessities for survival in an increasingly hostile digital landscape.
As geopolitical tensions continue to spill over into the cyber domain, the events in France serve as a stark reminder that the digital battleground is no longer confined to virtual data servers. When lines of code can cause physical fires, spoil millions of tons of food, and disrupt the distribution of life-saving medical supplies, cybersecurity unequivocally becomes a matter of national security and public safety.
