France attributed a destructive cyberattack that disabled hundreds of commercial refrigerators and freezers in October to Shahid Kaveh, a hacking unit within Iran’s Islamic Revolutionary Guard Corps.
Commercial Refrigeration Sabotage Across France
The October 11–12 operation overrode temperature controls on commercial refrigeration units in hundreds of establishments across France, causing tens of millions of euros in food losses and at least 15 fires. Supermarket employees had to cart boxes of perished meat and melted ice cream into giant trash containers.
France’s Ministry for Europe and Foreign Affairs attributed the campaign on Monday, marking the country’s first cyberattack campaign conducted purely for sabotage on French territory. French intelligence linked Shahid Kaveh to online hacktivist personas including CyberAveng3rs and Soldiers of Solomon. Investigators found that infrastructure used in the attacks matched tools previously deployed by Shahid Kaveh, alongside traces of Farsi and a linked propaganda outlet.
The attacks themselves were not particularly complex,
Rafe Pilling, senior director at Sophos
Cybersecurity experts noted that the hackers exploited default passwords and outdated firmware on obsolete commercial refrigerators to break into the systems with relative ease. Intelligence reports also noted that the same operation targeted equipment at small hydroelectric facilities in France with limited effects.
According to Pilling, investigators now presume a connection between the French incidents and a series of unauthorized defrosting breaches observed throughout Europe during the preceding week. Authorities in Paris note that the Iranian government has adopted an increasingly antagonistic stance toward the country, particularly due to French backing for Iranian civil society groups.
Diplomatic Fallout and European Union Sanctions
Foreign Minister Jean-Noël Barrot described the operation as an unprecedented scale and unprecedented aggression and announced that the Iranian ambassador had been summoned to the foreign ministry in Paris. French officials say that Iran’s Revolutionary Guards were behind the disruptions that struck commercial refrigeration systems across France in October. The summoning of the Iranian ambassador took place on Tuesday morning.
We will take whatever measures are necessary, including some that we will not discuss publicly, if we judge them proportionate and necessary to deter any new attacks and punish those responsible for this unacceptable aggression,
Jean-Noël Barrot, French Foreign Minister
Barrot stated that France would push for new European Union sanctions against Iranian individuals and entities involved in the attacks. Meanwhile, Iran’s foreign ministry rejected the accusations as baseless and hostile
and denied carrying out malicious cyber operations.
Relations between Paris and Tehran have faced strain over regional activities, ballistic missile programmes, and nuclear issues, deteriorating further after the expulsion of diplomats following a dispute involving the arrest and subsequent expulsion of two French diplomats.
🔴 French authorities have identified three IRGC cyber officials in a government report accusing Iran of orchestrating cyberattacks that disrupted refrigeration systems at hundreds of commercial sites across France last month 🔴 The report named Hamid Reza Lashgarian as head of… pic.twitter.com/ofvDAnIXyA
Global Context of Industrial Cyberattacks
The French attribution aligns with a broader pattern of industrial equipment targeting. Earlier in the year, French intelligence linked Shahid Kaveh to attacks on Israeli refrigeration equipment, following a 2023 campaign that targeted Unitronics industrial controllers.
Analysts point out that Iran frequently deploys cyber operations to project power internationally and signal political displeasure with regional and international adversaries. Hostile cyber operations against the west tend to come from China, Russia, Iran, and North Korea, with different aims spanning industrial espionage, infrastructure disruption, crypto theft, and sending messages.
Additional incidents have affected infrastructure globally. In August, refrigerators at least half a dozen US military commissaries failed in malfunctions that Pentagon investigators are treating as a suspected cyberattack.
The Pentagon said it is aware of speculation regarding a potential cyber incident, and the US military considers Iran a suspect in that commissary sabotage campaign. Other international targets have included ships bound for the United States in August, US water treatment plants in July, and the Los Angeles transit system in March.
Following the October events in France, a second wave of hacking hit more than 100 establishments across Europe, affecting refrigerators used by French blood banks and forcing employees to move blood units to alternative storage. French officials observe that Tehran’s animosity toward France has grown progressively worse, driven primarily by French support for Iranian civil society.
