France has formally attributed the October cyberattacks on supermarket refrigeration systems to Iran, identifying the IRGC-linked Shahid Kaveh unit as the operator behind a campaign that caused physical damage as well as food losses.
The Foreign Ministry’s November 9 statement concerns attacks carried out overnight on October 11–12. It says refrigeration controllers were targeted at more than 700 French retail sites and estimates spoiled food losses in the tens of millions of euros.
From temperature changes to physical damage
A joint technical report published through CERT-FR says attackers changed defrost settings to high temperatures after compromising refrigeration controllers. Investigators recorded fire outbreaks in at least 15 cases. The report also identifies victims beyond supermarkets, including small butcher shops, a slaughterhouse and cooperative food-processing facilities.
French investigators linked simultaneous targeting of Schneider Electric equipment at small hydroelectric installations to the same attack, describing the effects on that equipment as moderate.
The C4 interministerial cyber coordination group bases its attribution on several observations: overlapping attack infrastructure used for industrial-system reconnaissance, techniques associated with Shahid Kaveh, use of the FOFA scanning service, Farsi-language traces, and publicity through CyberbanNews, which France associates with the unit.
These are the French authorities’ published grounds for attribution. Individual clues such as a language trace or a widely available scanning tool should be read as parts of that assessment, rather than standalone proof of who operated an attack.
The scope of the attribution matters
BleepingComputer notes that the attribution covers the October French supermarket attacks, not the later November wave of refrigeration incidents. Similar equipment or operational effects do not, by themselves, establish a common attacker.
France says it will summon Iran’s ambassador and propose additional European Union sanctions against Iranian people and organisations involved in malicious cyber operations. Those are announced responses, not sanctions already adopted as a result of this statement.
For cold-chain operators, the immediate significance is the demonstrated safety consequence of unauthorised control changes. An incident involving refrigeration equipment can become a stock-loss and physical-safety emergency even when its initial entry point is digital.
