France Names an IRGC Cyber Unit Behind 700 Fridge Attacks
The French foreign ministry attributed the 11 to 12 October sabotage of industrial refrigeration controllers to SHAHID KAVEH, a unit of Iran's Revolutionary Guard. Paris prosecutors opened a judicial investigation the same day and are seeking international arrest warrants.
France attributed last month's sabotage of industrial refrigeration controllers at more than 700 retail sites to Iran on 9 November 2026, naming SHAHID KAVEH, an offensive cyber unit affiliated with the Electronic Warfare and Cyber Defense Organization of the Islamic Revolutionary Guard Corps.
The attacks ran through the night of 11 to 12 October. The foreign ministry declaration says they caused significant material damage, sparked fires and spoiled foodstuffs worth tens of millions of euros, and that they "constitute a major breach of the interests of the nation and the security of the French people". It describes the campaign as "unprecedented in its scale and level of aggressiveness" and as "the first offensive cyber campaign carried out purely for the purposes of sabotage on French soil".
This is an attack of unprecedented scale and aggressiveness. It is the first large-scale cyberattack aimed at sabotage on French soil, and it represents a major threat to our national interests and the security of the French people. That is why it will not go unanswered.
Two units, and a trail back to 2020
The technical services behind the attribution published their own report the same day. CERT-FR document CERTFR-2026-CTI-009, dated 9 November, says members of the Cyber Crisis Coordination Centre observed several destabilisation attacks against French interests and can impute them to two offensive cyber units, Shahid Shoostari and Shahid Kaveh, operating within the Electronic and Cyber Centre of the Revolutionary Guard. The centre brings together ANSSI, the cyber defence command COMCYBER, the armament directorate DGA and the DGSE and DGSI intelligence services.
That report places the October attack alongside activity going back to at least 2020, including operations against Charlie Hebdo in 2023 and against a French video display company in 2024 around the Paris Olympic and Paralympic Games. The foreign ministry adds that the European Union sanctioned the Iranian entity Emmenet Pasargad in March 2026, and says it contributed to the October attacks.
The prosecutor's version differs on one detail
Paris prosecutor Laure Beccuau said in a statement that a formal judicial investigation was opened on 9 November into suspected organised cybercrime with the aggravating circumstance of "having been committed to serve the interests of a foreign power", in this case Iran, the Associated Press reported. Investigators found the attackers had used Farsi and IP addresses linked to devices located in Iran, and the prosecutor's office is seeking international arrest warrants.
The two official accounts do not line up neatly. The foreign ministry declaration treats SHAHID KAVEH as the name of a cyber unit. AP, reporting the prosecutor's statement, describes Shahid Kaveh as the leader of the group, with the investigation also targeting two deputies. Nothing published so far resolves whether the name belongs to a person, a unit, or both.
What the sabotage actually reached
AP put the scale at about 700 of France's roughly 10,000 supermarkets, with temperatures driven up overnight. NPR, citing the ANSSI statement, reported that the targets ran from supermarkets to butchers and that several small hydroelectric power plants were also hit, with "moderate effects". France has summoned Iran's ambassador and reserved the right to take further steps publicly and otherwise.
The target class is the one American agencies warned about three days before the attribution. As Parallax Nexus reported on 8 November, CISA, the FBI, HHS, the USDA and the Department of Transportation told owners of industrial refrigeration and cold chain monitoring systems to take controllers off the public internet, without saying who had been compromised.
The owned judgment here is that the attribution matters more for the precedent than for the technique. A controller reachable from the internet and turned up overnight is not a sophisticated intrusion, and the French documents do not claim it was. What France has done is attach a named state unit, a criminal case and a sanctions push to an attack on food retail rather than on a defence or energy target, which is the part other governments will study.
What is not known is how the attackers obtained access. Neither the declaration nor the CERT-FR summary says how many controllers were reachable from the public internet, which products or vendors were involved, or whether credentials were reused, guessed or left at defaults.
What happens next?
- France will put further sanctions against Iranian entities and individuals to its European Union partners.
- The Paris prosecutor's office is seeking international arrest warrants against those named in the judicial investigation.
- Iran's ambassador to France has been summoned to receive France's condemnation of the attacks.
- The Cyber Crisis Coordination Centre's joint report on IRGC-linked activity against French interests is available in full and may draw vendor advisories on the affected controller products.
Related topics
Sources & references
- 01Declaration of attribution to Iran of cyber attacks against France — French Ministry for Europe and Foreign AffairsprimaryOfficial declaration, 9 November 2026; source of the quoted attribution language.
- 02Activites cyber offensives ciblant la France menees par des acteurs iraniens lies au CGRI — CERT-FR / ANSSI (CERTFR-2026-CTI-009)primaryJoint Cyber Crisis Coordination Centre report, first version 9 November 2026.
- 03France blames Iran for the massive cyberattack on supermarket fridges — Associated Pressnews9 November 2026; source of the Barrot and Beccuau quotes.
- 04France accuses Iran of cyber 'sabotage' in fridge attacks — NPRnews9 November 2026; reports the hydroelectric targeting from the ANSSI statement.
- 05France accuses Iran of cyber attacks on supermarket refrigerators — Financial Timesnews9 November 2026.
More from Security
Binance Saw $3.64bn of Net Outflows on Its First Day Back
Binance says it has replaced 95 per cent of the stolen tokens with its own money, having set aside $6.34 billion. The FBI has attributed the largest cryptocurrency theft on record to North Korea, and about $3 billion of the proceeds was frozen on-chain.
CISA Adds the Two Ivanti Flaws That Complete the Root Chain
CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities Catalog on 30 October 2026. Both entries say the flaws chain with CVE-2026-104935, listed 17 days earlier, completing the path to root that Volexity documented.
CISA Confirms PHP2Shell Is Being Exploited in the Wild
A researcher at Perplexity got a working shell against a honeypot on 24 October 2026. Two days later CISA reversed its position on PHP2Shell, while declining to say who has been compromised or how many production systems are affected.
Stolen GitHub Tokens Put Malware in a LiteLLM Release
A compromised release pipeline put a poisoned LiteLLM build on PyPI and Docker for under three hours on 21 October 2026. It harvested cloud secrets, AI provider API keys and SSH keys, and Wiz says the attackers were spending stolen AWS credentials about four and a half hours later.