France accuses Iran of cyber sabotage of refrigeration at 700 supermarkets – the Revolutionary Guards unit and the measures Paris announces

Paris has formally attributed to Iran the cyberattack that hit the refrigeration of hundreds of French supermarkets in October. In an attribution statement issued on Monday, November 9, the French Ministry for Europe and Foreign Affairs condemns the Islamic Republic’s actions “in the most categorical terms” and calls them the first cyberattack campaign on French territory whose sole aim was sabotage.

The attack took place overnight from Sunday, October 11 to Monday, October 12. The intruders took control of the cooling controllers in about 700 retail stores and set defrost cycles to high temperatures. As a result food worth several tens of millions of euros was spoiled, and in at least 15 cases a fire broke out. Victims were mainly stores of the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups, but also small butchers, a slaughterhouse and food cooperatives.

The Shahid Kaveh unit and the Farsi traces

The Cyber Crisis Coordination Centre (C4), which includes ANSSI, DGSE, DGSI, the Directorate General of Armaments and the Cyber Defence Command, attributes responsibility to the Shahid Kaveh unit of the Revolutionary Guards’ Electronic Warfare and Cyber Command (CEC). In its technical report, CERT-FR names Reza Salarvand and Mahdi Lashgarian as the unit’s commanders, and Hamid Reza Lashgarian as head of the centre.

The French cite four elements. First, the same infrastructure was used in the same period to scan Schneider Electric equipment over the Modbus protocol (port 502), a technique the unit has applied since at least April. Second, the perpetrators scanned targets with the FOFA tool, usually used by the same group. Third, the “propaganda organ” CyberbanNews, linked to the unit, spread news of the attack as early as October 13. Fourth, traces of Farsi use were found in the infrastructure. In a related operation that the French link to the same attack, Schneider Electric equipment at small hydroelectric plants was also targeted, with limited effects.

Shahid Kaveh typically appears behind “hacktivist” identities such as CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front. In 2023 it claimed attacks on systems of Israel’s Unitronics, and in March and April 2026 it claimed a sabotage campaign against industrial equipment of Israeli and American interests, including Israeli cooling systems. On November 5 US agencies had warned about attacks on refrigeration controllers in supermarkets, and since the start of the war with Iran in February, cyberattacks on US infrastructure have been attributed to Iranian groups, such as Los Angeles transit in March and water treatment plants in July.

France links the case to older actions by a second unit, Shahid Shoostari, also known as Emennet Pasargad: the attack on the Charlie Hebdo online shop in January 2023 and the attempt to display propaganda photomontages on screens against the participation of Israeli athletes in the 2024 Paris Olympics.

Paris’s response

Paris summoned the Iranian ambassador to the Quai d’Orsay to express its most categorical condemnation, will propose new sanctions on Iranian individuals and entities to its European partners, and reserves the right to take “any additional measure, public or non-public.” At the same time, the Paris prosecutor’s office asked for international arrest warrants for the unit’s head and his two deputies. Tehran consistently denies conducting malicious cyber operations.