France Monday formally blamed a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC) for the October sabotage of refrigeration controls at more than 700 French supermarket sites, The Record reported. It is the first government attribution in a campaign that has since spread across Europe, and it names a unit U.S. agencies already link to intrusions at American water utilities, which raises the stakes for U.S. grocers and cold-chain operators.
What Happened
In a statement, the French Foreign Ministry said a unit called Shahid Kaveh, tied to the IRGC's electronic and cyber center, attacked supermarket refrigeration controllers overnight Oct. 11-12, causing fires, material damage and food losses it put at several tens of millions of euros. The ministry called it the first offensive cyber campaign on French soil carried out purely for sabotage.
France summoned Iran's ambassador, The Record reported. The ministry said France will propose new European Union sanctions against the Iranian entities and people involved and reserves the right to take further public and non-public measures. A companion report, "Activités cyber offensives ciblant la France menées par des acteurs iraniens liés au CGRI", from France's interministerial Cyber Crisis Coordination Centre, which includes cybersecurity agency ANSSI, military cyber command and the DGSE and DGSI intelligence services, ties Shahid Kaveh and a second IRGC unit, Shahid Shoostari, to attacks on French interests since at least 2020.
French authorities counted at least 15 fires, The Record and BleepingComputer reported. Citing the report, BleepingComputer said victims included Carrefour, Casino, Intermarché, Leclerc, Metro and Coopérative U stores, along with butcher shops, a slaughterhouse and food-processing cooperatives. The attackers took over controllers made by Danfoss and changed defrost settings to high temperatures, the outlet said. The same campaign hit Schneider Electric equipment at small hydroelectric sites, with what officials called moderate effects.
Paris prosecutor Laure Beccuau opened a judicial investigation into the unit's head, two deputies and others, and is seeking international arrest warrants, the Associated Press reported. The attackers used the equipment’s web interfaces to force nonstop defrost cycles and switched off temperature alarms, Agence France-Presse reported, and prosecutors cited Persian-language traces and IP addresses linked to Iran.
Foreign Minister Jean-Noël Barrot, speaking at a Group of Seven meeting in Paris, said the attack "will not go unanswered," according to AP. U.S. Secretary of State Marco Rubio said of Iran, "It does not surprise us," AFP reported. Iran, which routinely denies such operations, had not responded by Monday evening, The Record said.
Why It Matters
The Defense Department, FBI and National Security Agency identified Shahid Kaveh earlier this year as another name for CyberAv3ngers, The Record reported. A 2023 joint advisory by U.S. and allied agencies said IRGC-affiliated CyberAv3ngers broke into at least 75 U.S. industrial controllers, 34 of them in water systems, often by logging in with default passwords or none. The Treasury Department sanctioned six IRGC cyber officials in February 2024, including center head Hamid Reza Lashgarian and Mahdi Lashgarian.
For boards, the shift is from defacement to physical harm across a national retail sector in one night. The weak points were ordinary facilities equipment, not core IT. Five U.S. agencies, including the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI, urged operators Nov. 5 to take refrigeration controllers off the internet, replace factory passwords, patch and retire unsupported units, The Primary Wire reported. Because the attackers silenced alarms, operators should also confirm alerts reach staff by a route the attackers cannot switch off.
Context
France attributed only the October wave. A second wave in early November hit stores in more of Europe, The Primary Wire reported, and France's blood service reported tampering at storage sites. Neither has been tied to Iran. The Primary Wire reported in October that the French count had passed 350 stores. In the U.S., officials suspect Iran-linked hackers in freezer failures at about six military commissaries, a claim Nextgov/FCW reported from two people familiar with the matter and no agency has confirmed.
What to Watch
Watch whether EU governments adopt the sanctions France proposes, whether other governments join the attribution, and whether investigators tie the November wave or the U.S. commissary failures to the same unit. Also watch for any response from Tehran.
