France attributes October 2026 sabotage of ~700 supermarket refrigeration controllers to IRGC-linked Shahid Kaveh (CyberAv3ngers)

Linha do tempo

1. theregister.com ↗ · pub. 09/11/2026 19:45 · coletado 09/11 21:00

   France attributes October sabotage of supermarket refrigeration controllers to Iran's Shahid Kaveh unit

   ler a análise desta fonte ocultar

   France's Cyber Crisis Coordination Centre (C4) attributes the October attacks on refrigeration controllers at more than 700 grocery stores to the IRGC cyber unit Shahid Kaveh, better known as CyberAv3ngers (article, citing the C4 report). The attacks affected Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups, started at least 15 fires and caused food losses in the tens of millions of euros. Paris prosecutors say the attackers used Farsi and IP addresses linked to devices in Iran, and they are seeking international arrest warrants (pbs.org). The C4 report describes the campaign as the first cyber offensive carried out purely for sabotage on national territory, and no CVE or vendor advisory for the controllers was identified in the sources opened, so the public record is attribution-driven rather than vulnerability-driven.

   Technical Details

   • Since at least June 2024, the Shahid Kaveh unit has been able to scan, access and control industrial control equipment from Schneider Electric, Siemens and Rockwell (article).
   • The infrastructure used for the October supermarket attacks was also used in the same period to run reconnaissance against Schneider Electric equipment, focused on small and medium energy and water production units (article).
   • Temperatures reached 50°C (122°F) for about six hours, forcing stores to discard fresh food (pbs.org).
   • Similar attacks on commercial refrigerators were reported in early November in Belgium, Ireland, Luxembourg and Sweden (article).

   Remediation

   • Owners and operators of refrigeration and other industrial controllers should confirm that no controller is reachable from the internet, and should restrict and monitor remote access paths, which the article describes as the means of control used here (analyst recommendation based on the article).
   • Prioritise the review of Schneider Electric, Siemens and Rockwell equipment that is exposed or managed remotely, since the unit's access is documented against those brands (article).
   • The article reports that the US federal government has urged owners and operators to take security measures against these attacks, and the French government has reserved the right to take further measures (article).
2. olhardigital.com.br ↗ · pub. 09/11/2026 16:32 · coletado 09/11 18:00

   France attributes October supermarket refrigeration sabotage to Iran's IRGC-linked Shahid Kaveh unit

   ler a análise desta fonte ocultar

   The French government has attributed to Iran a cyberattack that remotely raised the temperature of supermarket refrigeration systems in France in October, causing fires and food losses. Foreign Minister Jean-Noël Barrot blamed the Islamic Revolutionary Guard Corps (IRGC) and said Iran's ambassador had been summoned, with diplomatic measures and sanctions to be pursued with the EU. The Paris Prosecutor's Office requested international arrest warrants against the head of Shahid Kaveh, an offensive cyber unit linked to the IRGC, and two of its deputies (olhardigital.com.br). Per the article, the first attribution came from Le Figaro citing anonymous sources, and it is part of a wider wave: similar attacks hit supermarkets in Sweden, Ireland, the Netherlands, Estonia, Finland, Belgium and Luxembourg on 2 November, and bomb-threat hoaxes disrupted flights. The full national report and the prosecutor's statement could not be retrieved in this research, so the attribution rests on the government's public claims as reported by the press.

   Technical Details

   • Per the Al Jazeera report (aljazeera.com), investigators say the attackers used Farsi and IP addresses linked to devices located in Iran, gained internet access to the refrigeration systems and remotely pushed temperatures to 50 °C overnight.
   • The French report, as summarised in search results from therecord.media, cites Farsi text artefacts, tooling and reconnaissance infrastructure, and names the unit's leadership in an annex. The full report was not opened during this research.
   • The article does not describe the initial access vector, the exploited vulnerabilities or the specific malware used.

   Remediation

   • The article and the sources reviewed do not describe defensive measures for operators of refrigeration or industrial control systems. Operators of building and refrigeration OT should review internet exposure of these controllers and their remote-access paths, which is a general recommendation and not a finding from the sources.
3. techcrunch.com ↗ · pub. 09/11/2026 16:19 · coletado 09/11 18:00

   France attributes mass hacks of supermarket freezer controllers and blood bank cold units to Iran's IRGC

   ler a análise desta fonte ocultar

   The French government has formally attributed to the Islamic Revolutionary Guard Corps (IRGC) a series of cyberattacks that hit thousands of internet-connected industrial refrigerated and freezer units in France and wider Europe. Two waves in October and November 2026 remotely accessed web-based controllers that manage cold-storage fleets at grocery stores and supermarkets and raised temperatures to spoil food. Medical blood banks were also targeted, but according to the French Blood Establishment the attacks were stopped before any blood was spoiled. French foreign minister Jean-Noël Barrot confirmed responsibility, Paris summoned Iran's ambassador, and France said it would seek European-wide sanctions against those responsible. The U.S. government reportedly links the attacks to pro-Iranian hacktivists working for Tehran, while the U.S. intelligence community has made no formal public attribution.

   Technical Details

   • The attackers remotely broke into web-based controllers that manage fleets of industrial cold and chilling units, then raised temperatures to spoil food and destroy goods.
   • Security researchers have warned that these web-based controllers are vulnerable to remote attacks, and some affected models made by Danfoss no longer receive security fixes.
   • The article gives no CVE identifiers, vulnerable firmware versions, or authentication and access prerequisites, so the exact entry point is not established.
   • U.S. officials are reportedly investigating whether freezer units on military bases were hacked, following similar outages earlier in 2026.
4. securityaffairs.com ↗ · pub. 09/11/2026 16:12 · coletado 09/11 18:00

   France attributes sabotage of supermarket refrigeration controllers to IRGC-linked Shahid Kaveh unit

   ler a análise desta fonte ocultar

   On 9 November 2026 the French government, through the Paris prosecutor's office and the Cyber Crisis Coordination Centre (C4), blamed the Islamic Revolutionary Guard Corps (IRGC) for sabotaging refrigeration controllers at about 700 French grocery sites on 11 and 12 October (therecord.media). The Shahid Kaveh cyber unit, tied to the IRGC Electronic and Cyber Center, was named as the operator, and the report's annex names its commanders (therecord.media). Foreign Minister Jean-Noël Barrot summoned Iran's ambassador and promised EU sanctions, while Paris prosecutors opened a judicial inquiry into the unit's head and two deputies and requested international arrest warrants (therecord.media). Iran routinely denies malicious cyber operations and had not responded to the allegations by the time of reporting (therecord.media). The attacks reportedly forced defrost cycles, destroyed perishable stock and started at least 15 fires (therecord.media). This is an official attribution rather than an independently verified finding, and no vendor advisory, CVE or patch is tied to the campaign in the sources reviewed, so defenders should rely on the generic CISA and FBI guidance.

   Technical Details

   • Five US federal bodies (CISA, FBI, HHS, USDA and DOT) issued a fact sheet on 5 November 2026 describing hostile activity against electronic temperature controllers and commercial refrigeration controllers in grocery stores and cold storage sites (gbhackers.com).
   • The fact sheet cites authentication bypass and arbitrary code injection as possible exploitation paths, but it names no specific vulnerability and no affected manufacturer (gbhackers.com).
   • Successful intrusion would let an attacker change settings remotely and push units into heating or defrost cycles, with consequences such as inventory loss, fire hazards and operators losing sight of real temperatures (gbhackers.com).
   • French investigators tied the campaign to Shahid Kaveh through Farsi text artefacts, tooling and infrastructure used to scout other industrial equipment (therecord.media).
   • ANSSI also reported that the same actors targeted Schneider Electric equipment at several small hydroelectric facilities, with moderate disruption (therecord.media).
   • US agencies had earlier identified Shahid Kaveh as another name for CyberAv3ngers, a group linked to disruptive attacks on operational technology across US critical infrastructure (therecord.media).
   • ANSSI attributes earlier French incidents to Shahid Shoostari, also known as Emennet Pasargad, including a defacement of the Charlie Hebdo website and an attempt to hijack Paris Olympics display screens in 2024 (therecord.media).

   Remediation

   • Remove refrigeration and temperature controllers from direct internet exposure; where remote access is required, route it through a protected, updated firewall or edge device (gbhackers.com).
   • Place operational technology on dedicated network segments separated from business systems (gbhackers.com).
   • Replace default passwords, enforce strong credentials, adopt phishing-resistant multifactor authentication where feasible, update firmware and replace unsupported devices (gbhackers.com).
   • Restrict who can change settings with device and IP allowlisting (gbhackers.com).
   • Keep tested offline backups, review logs and set safe operating limits with alerts on deviations; report suspicious activity to CISA or the FBI (gbhackers.com).

   Conflicting Reports

   • Scope of the second wave: the article says at least nine other European countries reported freezer attacks on 2 November, while therecord.media reports at least 11 European countries (therecord.media). The Record's count is the more specific figure, but neither source gives a per-country list.
   • Fires: the article says fires broke out in several stores, while therecord.media reports at least 15 fires attributed to the French government's report (therecord.media).
   • Earlier incident: the article describes a 2023 breach of an online store attributed to Emennet Pasargad, while therecord.media describes Emennet Pasargad's activity against Charlie Hebdo as a website defacement and gives no 2023 store breach (therecord.media).
5. bleepingcomputer.com ↗ · pub. 09/11/2026 15:32 · coletado 09/11 16:00

   France attributes October supermarket refrigeration sabotage, with fires, to IRGC-linked Shahid Kaveh unit

   ler a análise desta fonte ocultar

   In a statement issued Monday, France's Ministry for Europe and Foreign Affairs attributed the October 11–12 attacks on industrial refrigeration controllers to Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of the IRGC. The intruders remotely set defrost settings to high temperatures, spoiling food at roughly 700 retail locations and sparking at least 15 fires, and French authorities put the food losses in the tens of millions of euros. The attribution comes from France's Cyber Crisis Coordination Center (C4), and the technical report was published by CERT-FR. France will summon Iran's ambassador and propose new EU sanctions, but it has attributed only the October attacks on French sites to Iran, not the November wave that hit more than 115 stores across six European countries. The article also ties attacks on Schneider Electric equipment at small hydroelectric installations to the same campaign and describes their effects as moderate. Criticity is critical because the campaign is confirmed, large-scale and has caused physical damage, although no CVE or vendor severity applies and the article does not describe the intrusion prerequisites.

   Technical Details

   The CERT-FR technical report and the FBI and CISA warning were not opened during the research, so these details rest on the article and on search excerpts.

   • The attackers compromised industrial refrigeration controllers and remotely changed defrost settings to high temperatures during the night of October 11–12.
   • CERT-FR lists Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché among the affected retailers, along with butcher shops, a slaughterhouse and cooperative food-processing facilities.
   • Attribution indicators named by French investigators include the propaganda outlet CyberbanNews, which relayed the refrigeration attacks on October 13, 2026, the use of the FOFA internet-connected device search platform, which CERT-FR says the group commonly uses, and traces of Farsi-language content in the attacker's infrastructure.
   • The same infrastructure was used for reconnaissance of Schneider Electric industrial systems, using techniques previously associated with the unit.
   • CERT-FR says Shahid Kaveh operates through the hacktivist identities CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, and claimed a sabotage campaign against Israeli and US interests in March and April 2026, including Israeli refrigeration equipment.
   • A similar incident altered temperature and defrost settings at three facilities of France's national blood service. The article does not attribute it to Iran.
   • The article reports that the FBI and CISA warned last week of ongoing attacks on industrial refrigeration and cold-chain monitoring systems worldwide.

   Remediation

   No vendor or CERT-FR remediation guidance is named in the article, and the research did not open a source that provides it, so this section is omitted.

   Conflicting Reports

   • The article's earlier BleepingComputer estimate of 250 to 350 French supermarkets is superseded by the French authorities' figure of approximately 700 retail locations.
   • A search excerpt from aljazeera.com describes the hack as having hit more than 1,000 stores. The pages opened did not confirm that count, so the French figure of about 700 is kept as the more authoritative one.
6. cert.cyber.gouv.fr ↗ · pub. 08/11/2026 21:00 · coletado 09/11 14:01 primeiro registro

   Iran-linked IRGC cyber units behind destabilizing attacks on French industrial refrigeration controllers

   ler a análise desta fonte ocultar

   The Centre de Coordination des Crises Cyber (C4), an inter-ministerial body grouping ANSSI, COMCYBER, DGA, DGSE and DGSI, attributes a series of destabilization attacks against French interests to the Shahid Shoostari and Shahid Kaveh cyber-offensive units. These units operate within the CGRI-CEC, the electronic and cyber centre of Iran's Islamic Revolutionary Guard Corps. The most recent case, on 11 and 12 October 2026, targeted French industrial refrigeration controllers, which CERT-FR judges unprecedented in scale and aggressiveness. The report places it in a longer pattern observed since at least 2020, including attacks against Charlie Hebdo in 2023 and a French video display advertising company in 2024 linked to the Paris 2024 Olympic and Paralympic Games. The article names no CVE, malware, IOC, initial access vector or vendor, so defenders have no direct technical indicator to act on. Criticity is high because a state-linked actor is targeting industrial control equipment, but the article describes no confirmed compromise mechanism or public exploit.