More than 700 grocery stores were hit in October, and investigators say the intrusions sparked at least 15 fires and ruined food worth “tens of millions of euros.”
A toll in stores, fires, and ruined food
French authorities report that cyberattacks against refrigeration controllers at over 700 grocery stores in October led to at least 15 fires and food losses measured in the tens of millions of euros. Retail groups affected include Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. Similar incidents were reported in early November across Europe, with grocery chains in Belgium, Ireland, Luxembourg and Sweden describing widespread food losses after attackers raised temperatures as high as 122°F (50°C).
France’s C4 report and a promise to respond
The conclusions and the response come from a report issued by France’s Cyber Crisis Coordination Centre (C4) and a statement from France’s Ministry for Europe and Foreign Affairs. The C4 is an interagency body that, according to the report, comprises the National Cybersecurity Agency of France, the Directorate General for External Security, the Directorate General for Internal Security, the Directorate General for Armament, and the Cyber Defence Command. The ministry called the campaign “unprecedented” and said it constituted “the first cyber offensive campaign carried out purely for the purpose of sabotage on national territory.”
Paris said it will “use all available means of response, including within the European Union and alongside its European and international partners, to anticipate, prevent, deter and respond to destabilizing and destructive actions targeting it in cyberspace.” That package explicitly includes proposing additional EU sanctions against Iranian entities and individuals involved, and France said it would register “its strongest condemnation of these cyberattacks” to the Iranian ambassador. The government also stated that it “reserves the right to take any additional measures, public and non-public, deemed necessary and proportionate to respond to these cyberattacks.”
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAttribution: Iran’s Shahid Kaveh unit and CyberAv3ngers
Both the C4 report and the ministry statement attribute the refrigeration-controller intrusions to the Shahid Kaveh cyber unit of the Iranian Islamic Revolutionary Guard Corps (IRGC). French national security officials named Reza Salarvand and Mahdi Lashgarian as leaders of that unit, which is better known by its hacktivist personas including CyberAv3ngers.
French authorities linked this crew to prior disruptive activity. The report notes that CyberAv3ngers is suspected of involvement in a July campaign that targeted more than 100 internet‑exposed water systems in America — a campaign the U.S. government has not formally attributed to any actor, though private‑sector analysts blamed Iran and CyberAv3ngers. The C4 report also cites a 2023 U.S. attribution: American national security and law enforcement agencies attributed a series of cyberattacks against “multiple” U.S. water facilities to CyberAv3ngers.
Investigators point to several elements tying the supermarket campaign to Shahid Kaveh: shared infrastructure used for the October attacks and for reconnaissance on Schneider Electric equipment; “techniques used during these actions [that] are known to have been used by the Shahid Kaveh unit since at least April 2026”; and “traces of Farsi use” found in the attack infrastructure. Iranian media outlet CyberbanNews, which the report says is reportedly linked to Shahid Kaveh, publicized the incidents quickly — “as early as October 13” for events that unfolded late on October 11 and into October 12.
Technical footprint: refrigeration controllers and vendor systems
The French report says that since at least June 2024 the Shahid Kaveh unit had the ability to scan, access and control industrial control equipment from vendors including Schneider Electric, Siemens and Rockwell. It also says the infrastructure used in the October supermarket attacks was employed during the same timeframe to conduct reconnaissance on Schneider Electric equipment, with activity that focused on small‑ and medium‑sized energy and water production units.
France characterized the supermarket intrusions as “destructive cyberattacks targeting refrigeration controllers,” with the explicit effect of spoiling food and, in some cases, starting fires — a form of sabotage the government described as unprecedented in scale and aggressiveness on French soil.
What this means for supermarket groups, EU policymakers, and security teams
- Supermarket groups (Casino, Leclerc, Coopérative U, Metro, Carrefour, Intermarché): will be managing immediate loss and safety consequences — tens of millions of euros in spoiled goods and at least 15 fires — and are likely to be audited or investigated as part of the national response led by C4.
- EU policymakers and France’s diplomatic apparatus: France has signaled it will push for additional EU sanctions and has already lodged a formal condemnation with the Iranian ambassador, framing the incident as a transnational matter requiring coordinated political measures.
- Security teams and operators of industrial control systems: the French report notes a documented ability since mid‑2024 to scan, access and control Schneider Electric, Siemens and Rockwell controllers and points to reconnaissance activity focused on small‑ and medium‑sized energy and water units — facts that underscore the need for targeted protections around refrigeration and other industrial controllers.
Paris has placed the incident squarely in the category of intentional sabotage and tied it to a named IRGC unit it says has long targeted industrial control systems. The immediate steps France will take include proposing additional EU sanctions and raising its objection with Iran’s ambassador, while reserving broader public and non‑public responses should they be judged necessary and proportionate. U.S. authorities and owners/operators were already urged in the days following the European reports to take measures to prevent similar intrusions from spreading to America, and the events reported in Belgium, Ireland, Luxembourg and Sweden indicate the problem has crossed multiple national borders.
Source: The Register — France blames Iran for supermarket hack meltdowns
