France blames Iran for mass supermarket cyberattacks
Abdullateef Fowewe
France has blamed Iran for a large-scale cyber sabotage campaign that targeted refrigeration systems at more than 700 retail sites across the country in mid-October, causing fires, widespread food spoilage, and tens of millions of euros in damage.
In a statement, the French Ministry for Europe and Foreign Affairs said, “France condemns in the strongest terms the unacceptable cyber attacks against its interests on its territory conducted by the Islamic Republic of Iran.”
The attacks, which occurred on the night of 11–12 October, “targeted the supermarket refrigeration system controls of more than 700 retail sites in France. These cyber attacks caused significant material damage, sparking fires and spoiling foodstuffs estimated to be worth tens of millions of euros.”
French authorities described the operation as “unprecedented in its scale and level of aggressiveness” and “the first offensive cyber campaign carried out purely for the purposes of sabotage on French soil.”
They attributed the attacks to SHAHID KAVEH (also linked to the online persona CyberAveng3rs), an offensive cyber unit affiliated with the Electronic Warfare and Cyber Defence Organisation of Iran’s Islamic Revolutionary Guard Corps (IRGC).
Investigators cited multiple indicators, including reused digital infrastructure previously associated with the group, traces of Farsi in the attack systems, IP addresses linked to Iran, and the use of tools and techniques matching earlier Shahid Kaveh operations.
The Paris prosecutor’s office opened a judicial investigation targeting the unit’s leadership, including individuals identified as Hamid Reza Lashgarian, Mahdi Lashgarian, and Reza Salarvand, and requested international arrest warrants.
Hackers reportedly gained remote access to controllers including models from suppliers such as Danfoss and Dixell, forced prolonged high-temperature defrost cycles, and disabled safety alerts.
Temperatures in some units rose dramatically, leading to at least 15 fires and the loss of large quantities of fresh and frozen goods at chains including Intermarché, E.Leclerc, Carrefour, Monoprix, and Coopérative U.
France has summoned Iran’s ambassador to express its condemnation “in the strongest terms.”
Foreign Minister Jean-Noël Barrot said the country would propose further European Union sanctions against Iranian entities and individuals involved, and reserved the right to take additional public or non-public measures it deems necessary and proportionate.
The French statement notes that the Iranian cyber threat to French interests is not new.
It cites prior activities, including actions linked to the weekly magazine Charlie Hebdo in 2023 and the organization of the Paris 2024 Olympic and Paralympic Games.
In March 2026, the EU adopted sanctions against the Iranian entity Emmenet Pasargad in connection with related cyber activities.
Shahid Kaveh has been associated by Western agencies with earlier campaigns targeting industrial control systems, particularly against Israeli and U.S. interests, often operating through front “hacktivist” personas.
The October incident highlights growing concerns over state-linked actors targeting operational technology and critical infrastructure for physical disruption rather than pure data theft or website defacement.
France’s 2026 National Cybersecurity Strategy emphasises using all available means—diplomatic, economic, and otherwise alongside European and international partners to deter and respond to such actions.
However, Iran has rejected the accusations as baseless.
