The French government has formally attributed a series of destructive cyberattacks on national supermarket infrastructure to the Iranian Islamic Revolutionary Guard Corps (IRGC). The campaign, which occurred throughout October, targeted refrigeration controllers at more than 700 grocery stores across France, including locations operated by major retail groups such as Carrefour, Leclerc, Intermarché, Metro, Casino, and Coopérative U. These intrusions resulted in at least 15 fires and caused tens of millions of euros in food spoilage.
A comprehensive report released by France’s Cyber Crisis Coordination Centre (C4)—a multi-agency body comprising national cybersecurity, intelligence, and defense organizations—characterizes the event as the first instance of a cyber offensive campaign conducted exclusively for the purpose of sabotage on French soil. The French Ministry for Europe and Foreign Affairs has labeled the operation an unprecedented act of aggression, vowing to utilize all available domestic and international means to deter and respond to the threat.
French authorities have identified the perpetrator as the Shahid Kaveh cyber unit, an entity within the IRGC reportedly led by Reza Salarvand and Mahdi Lashgarian. This group is widely associated with the hacktivist persona CyberAv3ngers, which has previously been linked by private-sector analysts to attacks on internet-exposed water systems in the United States. While the U.S. government has not officially attributed those prior water facility intrusions to a specific state actor, the French government’s assessment asserts that the Shahid Kaveh unit has been actively scanning and accessing industrial control equipment from manufacturers including Siemens, Rockwell, and Schneider Electric since at least June 2024.
The attribution is based on several lines of evidence gathered by French investigators. The C4 report notes that the infrastructure utilized during the October supermarket attacks matches the infrastructure used to conduct reconnaissance on Schneider Electric equipment at energy and water production facilities earlier this year. Furthermore, investigators identified traces of Farsi language within the attack infrastructure. The report also highlights that an Iranian media outlet, CyberbanNews, which is reportedly affiliated with the Shahid Kaveh unit, began publicizing the supermarket incidents as early as October 13, shortly after the attacks occurred on the night of October 11 and 12.
The scope of the disruption extends beyond French borders. Similar attacks on commercial refrigeration systems have been reported across Europe, with grocery stores in Belgium, Sweden, Luxembourg, and Ireland experiencing significant food losses after attackers remotely increased temperatures to as high as 122°F (50°C). In response to the widening threat, the U.S. federal government has issued guidance urging facility owners and operators to implement security measures to prevent similar compromises of their own industrial control systems.
France’s Ministry for Europe and Foreign Affairs stated that the Iranian cyber threat is part of a broader pattern of destabilizing activities, citing previous Iranian-linked efforts to target the weekly magazine Charlie Hebdo in 2023 and the 2024 Paris Olympic Games. The ministry has confirmed that it intends to summon the Iranian ambassador to express formal condemnation of the attacks.
Regarding future actions, the French government has indicated that it is pursuing additional European Union sanctions against the individuals and entities involved in the campaign. While the government has emphasized its commitment to working with international partners, it has also explicitly reserved the right to take further public or non-public measures deemed necessary and proportionate to address the sabotage.
The incident underscores long-standing warnings from security researchers regarding the vulnerabilities of industrial control systems. Experts had previously cautioned that attackers could manipulate refrigeration units to spoil food supplies months before the French supermarket incidents took place. The C4 report confirms that the techniques employed by the Shahid Kaveh unit in these attacks have been observed in their operations since at least April 2026.
