700 Stores. 15 Fires. France Names the Attackers.

France has named the attackers behind the October cyberattacks that disrupted refrigeration systems at more than 700 supermarkets and other retail locations: Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of Iran’s Islamic Revolutionary Guard Corps. The attacks caused tens of millions of euros in food losses and sparked at least 15 fires, France said in a statement issued Monday.

“France condemns in the strongest possible terms the unacceptable cyberattacks carried out on its territory by the Islamic Republic of Iran against its interests,” the statement from the Ministry for Europe and Foreign Affairs reads. France says it will summon Iran’s ambassador to condemn the attacks and propose new European Union sanctions against Iranian individuals and organizations involved in malicious cyber operations.

This is a major development in a story this blog covered last week, when the FBI and CISA warned that refrigeration and cold-chain systems were being targeted worldwide. At the time, the scale was estimated at 250 to 350 French supermarkets. French authorities have now revealed the real number: approximately 700 retail locations, including Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché, along with smaller butcher shops, a slaughterhouse, and cooperative food-processing facilities.

The attacks, and the trail back to Tehran

The attacks happened overnight on October 11–12. Hackers compromised industrial refrigeration controllers and remotely changed defrost settings to high temperatures, disrupting the systems that keep food cold. Stores were forced to discard fresh and frozen products, and the overheated equipment caught fire in at least 15 locations.

France’s Cyber Crisis Coordination Center, known as C4, brings together the country’s cybersecurity agency ANSSI, military cyber command, and intelligence agencies. It attributed the attacks to Shahid Kaveh through several observations, laid out in a technical report from France’s CERT-FR. The attacker’s infrastructure had also been used for reconnaissance against Schneider Electric industrial systems, using techniques previously associated with the Iranian unit. The attackers used FOFA, an internet-connected device search platform that CERT-FR says the group commonly uses. A propaganda outlet called CyberbanNews, which France links to Shahid Kaveh, publicized the refrigeration attacks on October 13. And investigators found traces of Farsi in the attacker’s infrastructure.

Shahid Kaveh operates through several online hacktivist identities, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul, and Cyber Isnaad Front. CERT-FR says the unit claimed responsibility for a large-scale sabotage campaign targeting Israeli and U.S. interests in March and April 2026, including attacks on Israeli refrigeration equipment and other industrial control systems. In April 2026, the unit was observed conducting large-scale reconnaissance of Schneider Electric industrial control systems, including systems in France.

It did not stop in October

French investigators also detected attacks against Schneider Electric industrial equipment at small hydroelectric installations during the same period, linked to the same campaign, though those had moderate effects. And the October attacks were followed by a second wave in November, affecting more than 115 stores across six European countries. France’s national blood service reported a similar incident that altered temperature and defrost settings at three facilities used to store blood products.

France has attributed only the October attacks against French supermarkets to Iranian hackers — not the later wave. Last week, the FBI and CISA warned of ongoing cyberattacks targeting industrial refrigeration and cold-chain monitoring systems worldwide, and the November wave shows that warning was not theoretical.

What this means for anyone running industrial systems

The campaign’s real lesson is that industrial controllers are now front-line targets for state-backed sabotage, not just collateral in ransomware. If you operate refrigeration, cold storage, or any industrial control system, four habits matter more than ever:

• Take controllers off the open internet. The attackers found their targets through FOFA, a search engine for internet-connected devices. A controller that answers to the whole internet is a controller anyone can attack.
• Change default passwords and close unused access. Industrial equipment ships with known credentials and open services. If you have not changed them, assume someone else already knows them.
• Watch for odd setting changes. The damage here came from defrost settings pushed to high temperatures — a legitimate function used maliciously. Alert on configuration changes, not just on logins.
• Patch and segment the network. Keep control systems on their own network segment, away from office IT, and patch them on a schedule. A freezer that cannot reach the internet cannot be turned into a fire hazard from another country.

The attribution also changes the stakes. This was not a criminal gang chasing a ransom. It was, according to France, a state-backed unit running a sabotage campaign — one that had already rehearsed against the same kind of equipment in Israel and the United States earlier this year. The XCPE Android TV botnet showed how factory-built access can turn millions of ordinary devices into a weapon; this campaign shows the same logic applied to the machines that keep food and blood cold. When the target is infrastructure, the fix is not just a patch — it is treating every connected device as part of your security perimeter.