Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorcritical

France blames Iran’s Shahid Kaveh for supermarket fridge sabotage

9 sources · 9 articlesFirst reported Updated ()1
What's new

November 10: Infosecurity Magazine says CERT-FR’s notice also links Shahid Shoostari, cites OFAC and DGSI traces, names three leaders, and does not cover the early-November French Blood Service attack.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

France attributes October refrigeration sabotage at about 700 stores to Iran’s Shahid Kaveh, while later European and blood-bank incidents remain disputed.

France’s foreign ministry, ANSSI and the Cyber Crisis Coordination Centre blame IRGC unit Shahid Kaveh for October 11–12 attacks that remotely raised defrost settings on refrigeration controllers at about 700 French stores, spoiling food and starting fires. Chains named include Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. Most outlets report at least 15 fires and losses in the tens of millions of euros; The Hacker News and Cyber Security News cite about 20 fires, and SecurityWeek says temperatures hit 50 Celsius for about six hours. Paris summoned Iran’s ambassador, opened a case and sought arrest warrants and EU sanctions. BleepingComputer and Security Affairs leave a later European wave unattributed, while TechCrunch says France also blamed October and November attacks, including blood-bank intrusions that other outlets say were not attributed.

Key facts
  • CERT-FR named Danfoss, Dixell and Copeland controllers; some Danfoss models are end of life.
  • Prosecutors seek warrants for Shahid Kaveh’s leader and two deputies.
  • Aliases include CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front.
  • Moderate effects were reported on Schneider Electric gear at small hydro plants.
  • Security Affairs says the later wave hit nine countries; BleepingComputer says six.
  • Iran had not responded by Monday evening, according to The Record.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 11, 2026Attackers raised defrost settings at about 700 French sites · The Hacker News
  2. Oct 13, 2026CERT-FR cites a CyberbanNews post about the attacks · BleepingComputer
  3. Nov 2, 2026Suspected freezer attacks reported in other European countries · Security Affairs
  4. Nov 5, 2026CISA and FBI issued a controller-abuse fact sheet · Security Affairs
  5. Nov 9, 2026France attributed the attacks and said it would summon Iran · Infosecurity Magazine

What each outlet adds

beyond the shared facts
  • SecurityWeekSays systems hit 50 Celsius for six hours; Intermarché losses
  • Security AffairsNine-country November wave, Kallas comment, CISA and FBI sheet
  • TechCrunchAttributes November wave; blood-bank attacks stopped before spoilage
  • The RegisterNames leaders Reza Salarvand and Mahdi Lashgarian
  • Infosecurity MagazineCERT-FR also cites Shahid Shoostari and excludes blood service
Vendors
DanfossDixellCopelandSchneider ElectricSiemensRockwell
Products
AK-SMAK-SCxwebDanfoss AK-SM 800Aindustrial refrigeration controllersrefrigeration controllers
Threat actors
Shahid KavehCyberAveng3rsCyber Isnaad FrontIslamic Revolutionary Guard CorpsCyberAv3ngersShahid ShoostariEmennet PasargadSoldiers of SolomonMr. Soul
Victims
CasinoLeclercCoopérative UMetroCarrefourIntermarchéSystème UE.LeclercFrench Blood Establishment
Organizations
Islamic Revolutionary Guard CorpsANSSICERT-FRDGSICISAFBIFrance’s Cyber Crisis Coordination CentreParis Prosecutor’s OfficeFrance’s Ministry for Europe and Foreign AffairsCyber Crisis Coordination CentreOFACParis Public Prosecutor's Office
Countries
FranceIranUnited StatesBelgiumIrelandLuxembourgSweden

Coverage

oldest first · one row per article · UTC
  1. · 1d ago BleepingComputerFirst report

    France ties October supermarket fridge attacks to Shahid Kaveh

    Attackers raised defrost temperatures overnight on October 11–12; France has not attributed the later European wave.

  2. · 1d ago The Record

    France blames IRGC unit for grocery refrigeration attacks and fires

    A joint French report ties Shahid Kaveh to October sabotage at about 700 stores and moderate disruption at small hydro plants.

  3. · 1d ago Security Affairs

    France says IRGC hit 700 sites in October fridge attacks

    Prosecutors are investigating Shahid Kaveh's leadership, while a November wave in nine countries remains unattributed.

  4. · 1d ago TechCrunch · Security

    France blames Iran's IRGC for attacks on store and blood-bank freezers

    Attackers raised temperatures on industrial cold units in October and November; blood-bank intrusions were stopped before spoilage.

  5. · 1d ago The Register · Security

    France blames Iran unit for grocery refrigeration sabotage

    Attacks on more than 700 stores started at least 15 fires and spoiled food worth tens of millions of euros.

  6. · 20h ago SecurityWeek

    France blames Iran's IRGC for supermarket refrigerator cyberattack

    The October 12 attack heated systems at about 700 stores to 50 Celsius and cost Intermarché tens of millions of euros.

  7. · 18h ago The Hacker News

    France blames Iran's IRGC for sabotage at about 700 retail sites

    Attackers raised defrost settings on Danfoss and Dixell controllers on October 11, causing food losses and fires.

  8. · 17h ago Cyber Security News

    France blames IRGC-linked unit for attacks on 700 supermarket fridges

    Remote defrost changes at Système U, Intermarché and E.Leclerc on October 11–12 caused food losses and about 20 fires.

  9. · 17h ago Infosecurity Magazine

    France blames IRGC units for refrigeration attacks on 700 supermarkets

    CERT-FR linked the October 11–12 sabotage to Shahid Kaveh; Paris opened a probe and will seek EU sanctions.