---
title: France formally attributes the Oct 11-12 sabotage of refrigeration controllers at about 700 supermarkets to Iran's IRGC unit Shahid Kaveh | ctxsec
url: https://ctxsec.com/items/france-attributes-oct-11-12-supermarket-refrigeration-sabotage-to-irgc-shahid-kaveh
description: "France's foreign ministry says the overnight campaign against refrigeration controllers at more than 700 retail sites caused considerable damage, fires and food losses estimated in the tens of millions of euros, and calls it the first purely sabotage-driven cyber campaign on French soil. CERT-FR's report, on behalf of the interministerial C4 (ANSSI, COMCYBER, DGA, DGSE, DGSI), says defrost settings were changed to high temperatures, at least 15 sites caught fire, and victims included the Casino, Leclerc, Coop\u00e9rative U, Metro, Carrefour and Intermarch\u00e9 groups plus butchers, a slaughterhouse and food-processing plants. It also links concurrent targeting of Schneider Electric equipment at small hydroelectric sites to the same attack. The unit's known personas include CyberAveng3rs, the group behind the 2023 Unitronics PLC campaign."
status: "official (French Ministry for Europe and Foreign Affairs attribution statement and CERT-FR CERTFR-2026-CTI-009, both Nov 9, 2026); Paris prosecutor's judicial investigation reported by France 24 and Euronews"
published: 2026-11-09
---

> France's foreign ministry says the overnight campaign against refrigeration controllers at more than 700 retail sites caused considerable damage, fires and food losses estimated in the tens of millions of euros, and calls it the first purely sabotage-driven cyber campaign on French soil. CERT-FR's report, on behalf of the interministerial C4 (ANSSI, COMCYBER, DGA, DGSE, DGSI), says defrost settings were changed to high temperatures, at least 15 sites caught fire, and victims included the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups plus butchers, a slaughterhouse and food-processing plants. It also links concurrent targeting of Schneider Electric equipment at small hydroelectric sites to the same attack. The unit's known personas include CyberAveng3rs, the group behind the 2023 Unitronics PLC campaign.

[← Cybersecurity News](/news) · [markdown](/items/france-attributes-oct-11-12-supermarket-refrigeration-sabotage-to-irgc-shahid-kaveh.md)

official (French Ministry for Europe and Foreign Affairs attribution statement and CERT-FR CERTFR-2026-CTI-009, both Nov 9, 2026); Paris prosecutor's judicial investigation reported by France 24 and Euronews

2026-11-09

### France formally attributes the Oct 11-12 sabotage of refrigeration controllers at about 700 supermarkets to Iran's IRGC unit Shahid Kaveh

- **Attribution evidence (CERT-FR):** the attack infrastructure was also used in the same period for Modbus (TCP 502) reconnaissance of Schneider Electric equipment at small energy and water plants, a technique tied to Shahid Kaveh since at least April 2026; operators used the FOFA scanning service; the IRGC-linked outlet CyberbanNews relayed the attack on Oct 13; and Farsi traces were found on the infrastructure.
- **Named leaders:** CERT-FR names Reza Salarvand and Mahdi Lashgarian as Shahid Kaveh's commanders and Hamid Reza Lashgarian as head of the IRGC electronic and cyber center.
- **Also attributed:** the IRGC's Shahid Shoostari unit (Emennet Pasargad) for the January 2023 Charlie Hebdo shop defacement and data theft, and a July 2024 compromise of a video-display operator ahead of the Paris Olympics.
- **What to do:** internet-exposed building and refrigeration controllers are the target set. See the Nov 5 CISA/FBI cold-chain hardening item and its companion tip for finding exposed controllers.

Sources: [France Diplomatie: Déclaration d'attribution à l'Iran de cyberattaques visant la France (Nov 9, 2026)](https://www.diplomatie.gouv.fr/fr/presse-et-ressources/decouvrir-et-informer/actualites/declaration-d-attribution-a-l-iran-de-cyberattaques-visant-la-france) · [CERT-FR CERTFR-2026-CTI-009: Activités cyber offensives menées par des acteurs iraniens liés au CGRI (Nov 9, 2026, TLP:CLEAR)](https://cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-009.pdf)