🔍 Read the full analysis: France Says Iran’s Guards Hacked Fridges—What Evidence Was Shown? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
France attributed the October 11–12 attack on supermarket refrigeration controllers to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. Its report cites shared infrastructure, a scanning tool, an associated propaganda channel and traces of Farsi; the Paris prosecutor also cited IP addresses linked to devices in Iran. Iran had not publicly responded by Monday evening, and the attribution has not been tested in court.
France on November 9 attributed an October cyberattack on refrigeration controllers at about 700 retail sites to Shahid Kaveh, a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). The French government’s technical report describes a bundle of indicators behind that assessment, while the Paris prosecutor has opened a judicial investigation; the accusation has not been tested in court.
France’s Cyber Crisis Coordination Centre, or C4, said attackers changed refrigeration equipment’s defrost settings to high temperatures during the night of October 11–12. Its report said the incident caused significant goods losses and fires in at least 15 cases. The foreign ministry described the affected footprint as more than 700 retail sites and estimated food losses at several tens of millions of euros.
The attribution rests on several indicators rather than one decisive piece of evidence, according to the five-page report published through CERT-FR. It cites shared attack infrastructure, use of the internet-scanning tool FOFA, an attack relay by the outlet CyberbanNews—which France associates with Shahid Kaveh—and traces of Farsi in the infrastructure. The report says the shared infrastructure was also used around the same period to scan Schneider Electric equipment used in smaller energy and water production facilities.
The Paris prosecutor’s office added, according to The Associated Press, that investigators identified IP addresses linked to devices in Iran. Prosecutor Laure Beccuau opened a judicial investigation targeting the unit’s head, two deputies and other people who may be identified. The prosecutor’s office is seeking international arrest warrants, AP reported. An investigation and warrant request are not findings of guilt.
France’s fridge-hacking claim What evidence was shown?
France attributes the supermarket refrigeration attack to Shahid Kaveh, an IRGC-affiliated cyber unit. Its published case combines technical indicators and investigative leads, but has not been tested in court.
What France says happened
Attackers allegedly changed overnight defrost settings, disrupting refrigeration and causing food losses.
The affected equipment had management interfaces reachable over the internet, contrary to good practice.
France says defrost settings were raised to high temperatures during the night of October 11–12.
The C4 report describes significant goods losses and fires in at least 15 cases.
Indicators behind the attribution
France says several clues together support its assessment; none is presented as a standalone court finding.
Shared attack systems
The report cites infrastructure also used around the same period to scan Schneider Electric equipment.
FOFA scanning
France’s report says attackers used the internet-scanning tool FOFA.
CyberbanNews relay
The report cites an attack relay by an outlet France associates with Shahid Kaveh.
Farsi traces
The technical report also points to traces of Farsi in the infrastructure.
Technical claim vs. judicial process
The government’s attribution and the prosecutor’s investigation are related, but they are not a verdict.
- Attributes the operation to Shahid Kaveh, described as IRGC-affiliated.
- Cites shared infrastructure, FOFA, CyberbanNews and Farsi traces.
- The prosecutor also cited IP addresses linked to devices in Iran.
- The attribution has not been tested in court.
- Investigators are seeking international arrest warrants.
- Public information does not establish who operated the devices or whether suspects will be apprehended.
Why businesses should care
The incident highlights how exposed controls for everyday operations can create physical and commercial risks.
- Review whether refrigeration and other operational equipment can be reached from the internet.
- Protect management interfaces from unauthorized remote access.
- Consider the potential for equipment disruption to spoil stock or cause fires.
Food losses and diplomatic action
The incident shows how internet-connected equipment used to manage ordinary building operations can become a route to physical disruption. In this case, changing refrigeration settings was associated with spoiled stock and fires, rather than only stolen data or a temporary loss of computer services. France’s own cybersecurity report said the affected controllers had management interfaces exposed to the internet, contrary to good practice.
The government has also moved beyond a technical assessment. France summoned Iran’s ambassador and said it would propose new European Union sanctions. The prosecutor’s investigation adds a judicial track, although pursuing suspects internationally does not establish that they will be arrested or that the case will result in convictions. The episode could affect French-Iranian relations and prompt businesses to review how connected industrial and commercial equipment is secured.
Popular right now
Dyson V15 Detect Cordless Vacuum
Breville Barista Touch Impress Espresso Machine, Noir (BES881NRE)
Shark NV752 Rotator Powered Lift-Away TruePet Upright Vacuum, Bordeaux
As an affiliate, we earn on qualifying purchases.
How France built its attribution
France issued its attribution after roughly four weeks of investigation. The foreign ministry said it was in a position to attribute the sabotage to Shahid Kaveh, which it described as part of the IRGC’s electronic and cyber centre. At a G7 meeting in Paris, Foreign Minister Jean-Noël Barrot publicly named the IRGC as responsible, according to AFP.
The technical assessment came from C4, a French coordination body involving the national cybersecurity agency ANSSI, military cyber command, the defence procurement agency and the DGSE and DGSI intelligence services. Its report is the main published technical basis for the claim. It also attributes earlier operations against France since 2020 to a separate IRGC unit, Shahid Shoostari, including the 2023 attack on the Charlie Hebdo website and an attempted hijacking of video display screens during the Paris 2024 Olympics. Those are separate allegations described in the report, not evidence that the same unit carried out the supermarket attack.
France’s computer emergency response team had warned in October that the affected controllers’ management interfaces were reachable over the internet, which it described as contrary to good practice. That detail points to a practical security weakness in the incident, regardless of who was responsible: equipment used to control refrigeration needs protection from unauthorized remote access.
“I can confirm that this attack was carried out by the Islamic Revolutionary Guard Corps (IRGC) of the Islamic Republic of Iran.”
— French Foreign Minister Jean-Noël Barrot, quoted by AFP
What the published evidence cannot prove
The French report provides multiple indicators, but the source material does not describe a single piece of evidence that independently proves who directed or carried out the attack. Shared infrastructure, a commonly used tool, an associated propaganda channel and Farsi traces support France’s assessment; they are not a court ruling. The prosecutor’s reference to IP addresses linked to devices in Iran is another investigative lead, not, by itself, public proof of the identity of the people operating them.
Iran had not publicly responded by Monday evening, according to The Record. The published material does not establish whether the suspects will be apprehended, how the alleged operators obtained access to each controller, or the full number of affected stores. The foreign ministry gave a total of more than 700 sites, while the C4 report’s summary referred to about 700. France’s attribution and the prosecutor’s investigation remain distinct from a finding of criminal responsibility.
Sanctions proposals and court inquiry
France says it will propose new EU sanctions in response to the alleged operation. Any measures would require further action through the European Union; the source material does not specify a timetable or list of proposed targets.
The Paris judicial investigation will proceed against the named unit head and two deputies, as well as any other suspects investigators identify. Prosecutors are seeking international arrest warrants, but the public account does not state when those requests may be decided or whether the suspects are likely to be located. The evidence and allegations may become clearer as the inquiry develops and any formal proceedings advance.
Key Questions
What happened to the supermarket refrigeration systems?
France says attackers changed the defrost settings to high temperatures on controllers during the night of October 11–12. The C4 report said the attack caused significant food losses and fires in at least 15 cases.
Who does France say was responsible?
France attributed the attack to Shahid Kaveh, which it describes as a cyber unit affiliated with Iran’s Islamic Revolutionary Guard Corps. Iran had not publicly responded by Monday evening, according to The Record.
What evidence did France publish?
The report cites shared attack infrastructure, use of the FOFA scanning tool, a relay by CyberbanNews, and traces of Farsi. The Paris prosecutor also cited IP addresses linked to devices in Iran. France presented these as combined indicators supporting its attribution.
Has a court found the suspects guilty?
No. The Paris prosecutor has opened a judicial investigation and is seeking international arrest warrants, according to AP. The attribution is an official French claim; it has not been tested in court and is not a conviction.
What action is France taking?
France summoned Iran’s ambassador and says it will propose new EU sanctions. Separately, the Paris prosecutor’s investigation is examining the unit’s head, two deputies and other potential suspects.
Source: ThorstenMeyerAI.com
