French authorities have accused a hacking unit linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) of sabotaging refrigeration systems at approximately 700 commercial locations. The October attacks reportedly caused at least 15 fires, damaged equipment, and forced retailers to discard food worth tens of millions of euros.
France announced the attribution on November 9, 2026, identifying Shahid Kaveh, a cyber unit associated with the IRGC’s electronic and cyber operations center, as the suspected perpetrator. Foreign Minister Jean-Noël Barrot condemned the incidents and announced plans to pursue European Union sanctions against those responsible.
The attacks occurred overnight on October 11 and 12, targeting internet-connected controllers responsible for managing commercial refrigeration equipment. According to French investigators, the attackers remotely modified temperature and defrost settings, causing refrigerators and freezers to operate outside their intended conditions.
Some units reportedly reached temperatures of 50°C (122°F), resulting in spoiled food and overheating equipment. French authorities documented at least 15 fires associated with the disruption.
The affected businesses included major supermarket chains such as Carrefour, Intermarché, Leclerc, Casino, and Coopérative U. Smaller butcher shops, food-processing facilities, and a slaughterhouse were also among the targets.
France’s Cyber Crisis Coordination Center, which brings together cybersecurity, military, and intelligence specialists, investigated the operation. Its findings linked the attacks to Shahid Kaveh through several indicators, including infrastructure previously associated with the group and similarities to earlier cyber operations.
Investigators also identified Farsi-language artifacts within the attackers’ infrastructure and activity involving FOFA, a search platform used to locate internet-connected devices. A propaganda channel associated with Shahid Kaveh reportedly publicized the refrigeration attacks shortly after they occurred.
French officials said the unit operates through several online identities, including CyberAveng3rs, Soldiers of Solomon, and Cyber Isnaad Front. These identities have previously been associated with operations targeting industrial control systems.
The investigation uncovered related activity against Schneider Electric equipment at small hydroelectric installations in France. Authorities attributed those attempts to the same campaign but reported that their operational consequences were limited.
Paris prosecutors have opened a judicial investigation targeting the suspected leader of Shahid Kaveh, two deputies, and other potentially involved individuals. International arrest warrants are being sought.
France has also announced plans to summon Iran’s ambassador to formally protest the attacks. Iranian authorities have previously rejected allegations of involvement in malicious cyber operations.
The October incidents were followed by another wave of refrigeration-related attacks affecting more than 115 establishments across six European countries. Similar interference was also reported at French blood-storage facilities.