EN PT-BR
← Voltar ao feed
critical retail food_processing healthcare energy

France attributes October supermarket refrigeration sabotage, with fires, to IRGC-linked Shahid Kaveh unit

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 15:32 · coletado há 1 hora

In a statement issued Monday, France's Ministry for Europe and Foreign Affairs attributed the October 11–12 attacks on industrial refrigeration controllers to Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of the IRGC. The intruders remotely set defrost settings to high temperatures, spoiling food at roughly 700 retail locations and sparking at least 15 fires, and French authorities put the food losses in the tens of millions of euros. The attribution comes from France's Cyber Crisis Coordination Center (C4), and the technical report was published by CERT-FR. France will summon Iran's ambassador and propose new EU sanctions, but it has attributed only the October attacks on French sites to Iran, not the November wave that hit more than 115 stores across six European countries. The article also ties attacks on Schneider Electric equipment at small hydroelectric installations to the same campaign and describes their effects as moderate. Criticity is critical because the campaign is confirmed, large-scale and has caused physical damage, although no CVE or vendor severity applies and the article does not describe the intrusion prerequisites.

Detalhes técnicos

The CERT-FR technical report and the FBI and CISA warning were not opened during the research, so these details rest on the article and on search excerpts.

  • The attackers compromised industrial refrigeration controllers and remotely changed defrost settings to high temperatures during the night of October 11–12.
  • CERT-FR lists Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché among the affected retailers, along with butcher shops, a slaughterhouse and cooperative food-processing facilities.
  • Attribution indicators named by French investigators include the propaganda outlet CyberbanNews, which relayed the refrigeration attacks on October 13, 2026, the use of the FOFA internet-connected device search platform, which CERT-FR says the group commonly uses, and traces of Farsi-language content in the attacker's infrastructure.
  • The same infrastructure was used for reconnaissance of Schneider Electric industrial systems, using techniques previously associated with the unit.
  • CERT-FR says Shahid Kaveh operates through the hacktivist identities CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, and claimed a sabotage campaign against Israeli and US interests in March and April 2026, including Israeli refrigeration equipment.
  • A similar incident altered temperature and defrost settings at three facilities of France's national blood service. The article does not attribute it to Iran.
  • The article reports that the FBI and CISA warned last week of ongoing attacks on industrial refrigeration and cold-chain monitoring systems worldwide.

Remediação

No vendor or CERT-FR remediation guidance is named in the article, and the research did not open a source that provides it, so this section is omitted.

Relatos divergentes

  • The article's earlier BleepingComputer estimate of 250 to 350 French supermarkets is superseded by the French authorities' figure of approximately 700 retail locations.
  • A search excerpt from aljazeera.com describes the hack as having hit more than 1,000 stores. The pages opened did not confirm that count, so the French figure of about 700 is kept as the more authoritative one.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 09/11/2026 15:32 · coletado 09/11 16:00 primeiro registro

    France attributes October supermarket refrigeration sabotage, with fires, to IRGC-linked Shahid Kaveh unit

    ler a análise desta fonte

    In a statement issued Monday, France's Ministry for Europe and Foreign Affairs attributed the October 11–12 attacks on industrial refrigeration controllers to Shahid Kaveh, a cyber-offensive unit affiliated with the electronic and cyber center of the IRGC. The intruders remotely set defrost settings to high temperatures, spoiling food at roughly 700 retail locations and sparking at least 15 fires, and French authorities put the food losses in the tens of millions of euros. The attribution comes from France's Cyber Crisis Coordination Center (C4), and the technical report was published by CERT-FR. France will summon Iran's ambassador and propose new EU sanctions, but it has attributed only the October attacks on French sites to Iran, not the November wave that hit more than 115 stores across six European countries. The article also ties attacks on Schneider Electric equipment at small hydroelectric installations to the same campaign and describes their effects as moderate. Criticity is critical because the campaign is confirmed, large-scale and has caused physical damage, although no CVE or vendor severity applies and the article does not describe the intrusion prerequisites.

    Technical Details

    The CERT-FR technical report and the FBI and CISA warning were not opened during the research, so these details rest on the article and on search excerpts.

    • The attackers compromised industrial refrigeration controllers and remotely changed defrost settings to high temperatures during the night of October 11–12.
    • CERT-FR lists Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché among the affected retailers, along with butcher shops, a slaughterhouse and cooperative food-processing facilities.
    • Attribution indicators named by French investigators include the propaganda outlet CyberbanNews, which relayed the refrigeration attacks on October 13, 2026, the use of the FOFA internet-connected device search platform, which CERT-FR says the group commonly uses, and traces of Farsi-language content in the attacker's infrastructure.
    • The same infrastructure was used for reconnaissance of Schneider Electric industrial systems, using techniques previously associated with the unit.
    • CERT-FR says Shahid Kaveh operates through the hacktivist identities CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, and claimed a sabotage campaign against Israeli and US interests in March and April 2026, including Israeli refrigeration equipment.
    • A similar incident altered temperature and defrost settings at three facilities of France's national blood service. The article does not attribute it to Iran.
    • The article reports that the FBI and CISA warned last week of ongoing attacks on industrial refrigeration and cold-chain monitoring systems worldwide.

    Remediation

    No vendor or CERT-FR remediation guidance is named in the article, and the research did not open a source that provides it, so this section is omitted.

    Conflicting Reports

    • The article's earlier BleepingComputer estimate of 250 to 350 French supermarkets is superseded by the French authorities' figure of approximately 700 retail locations.
    • A search excerpt from aljazeera.com describes the hack as having hit more than 1,000 stores. The pages opened did not confirm that count, so the French figure of about 700 is kept as the more authoritative one.