France names Iran’s Shahid Kaveh for the supermarket fridge sabotage. the controllers were still on the internet

a month ago, refrigeration controllers at about 700 French supermarkets were remotely set to defrost at high temperatures overnight. food spoiled, and at least 15 sites saw fires start. this week France formally attributed it to Shahid Kaveh, an offensive cyber unit of Iran’s Islamic Revolutionary Guard Corps, summoned the Iranian ambassador, and said it will push for EU sanctions. Iran says it is all baseless. the fridges, meanwhile, were reachable from the public internet, which is the part nobody is going to sanction.

what happened in October, now with official detail

we covered the attack itself in October. the C4 report fills in what was officially known only in fragments then. from CERTFR-2026-CTI-009, dated 09/11/2026, TLP:CLEAR, our translation:

• on October 12, 2026, C4 was alerted to an attack on the refrigeration controllers of about 700 large retail sites in France.
• after compromise during the night of Sunday October 11 to Monday October 12, defrost settings were changed to high temperatures, causing significant loss of goods and, in at least 15 cases, fires starting.
• affected entities were mainly large retailers, the report names the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups. C4 also knows of victims in the food sector, including several small butcher shops, a slaughterhouse and cooperative food plants.
• C4 also observed concurrent targeting, which it links to the same attack, of several Schneider Electric devices at small hydroelectric installations in France, “with moderate effects” on the targeted equipment.

CNBC, citing the Paris prosecutor’s statement, adds that attackers took control of Danfoss and Dixell controllers through their web interfaces, started unlimited defrost cycles, and disabled the safety alerts meant to fire when temperatures cross a threshold. the Foreign Ministry puts the damage at “tens of millions of euros.”

the attribution, and what it rests on

C4 says the attack presents “a body of evidence” pointing to the IRGC as sponsor and Shahid Kaveh as the unit that carried it out. the four elements it lists:

1. the attack infrastructure was also used, in the same period, for reconnaissance against Schneider Electric equipment used in small and medium energy and water production, using techniques C4 says Shahid Kaveh has used since at least April 2026 (Modbus, port 502).
2. operators used the FOFA scanning service, which C4 says this actor routinely uses.
3. the attack was publicized by CyberbanNews, a propaganda outlet C4 associates with Shahid Kaveh, as early as October 13, 2026.
4. traces of Farsi were found in the attack infrastructure.

per CNBC, the prosecutor’s statement also mentions IP addresses pointing to devices in Iran. the Paris prosecutor is seeking international arrest warrants.

a fair reading: this is a government attribution based on infrastructure overlap, tooling habits, a propaganda claim and language artifacts. it is not a public forensic dossier, and C4 does not claim it is. it is also consistent with what Shahid Kaveh’s public personas have bragged about for years.

who Shahid Kaveh is, per France

C4 describes the unit as led by Reza Salarvand and Mahdi Lashgarian, and names Hamid Reza Lashgarian as head of the IRGC’s Electronic and Cyber Centre. it says the unit is mostly known through hacktivist personas that publicly claim its attacks, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front, with CyberbanNews as its communications channel.

C4 says the unit runs large-scale campaigns against industrial equipment for sabotage, mainly against Israel and the United States but also France and other European countries. it cites the CyberAveng3rs claim of the November 2023 campaign against devices from Unitronics, an Israeli maker of industrial controllers used in the US and Europe, and a claimed March to April 2026 sabotage campaign against Israeli and American industrial control equipment, including Israeli refrigeration gear. C4 also says the unit has had scripts to scan, access and control Schneider Electric, Siemens and Rockwell equipment since at least June 2024.

if CyberAveng3rs rings a bell, it should. the 2023 Unitronics campaign was the one where US water utilities found their PLC screens displaying anti-Israel messages, on devices reachable from the internet with default credentials. same playbook, different appliance.

the other unit, and the other history

the report’s second section attributes operations since 2020 to Shahid Shoostari, which it says is documented in open sources as Iliyanet or Emennet Pasargad:

• a 2020 targeting of Charlie Hebdo, first revealed in 2021 by Lab Dookhtegan.
• on January 4, 2023, the defacement of Charlie Hebdo’s online shop and theft of its database, on the date the magazine was due to publish results of a caricature contest about Ali Khamenei.
• from July 20, 2024, the compromise of a French company that runs video-display kiosks, ahead of the Paris Olympics. attackers tried to push photo montages denouncing Israeli athletes’ participation. C4 says the compromise was found before the images were displayed, and that investigators saw two IP addresses belonging to Iranian ISPs during the intrusion.

the EU sanctioned Emennet Pasargad in March 2026, per both the Foreign Ministry and CNBC.

the diplomatic part

the Foreign Ministry statement of November 10 says France will summon the Iranian ambassador, propose further EU sanctions against Iranian entities and individuals involved, and “reserves the right to take any further steps, both publicly and non-publicly.” Foreign Minister Jean-Noël Barrot told Franceinfo the government was “not ruling anything out,” including entry bans and asset freezes, per CNBC. Iran’s foreign ministry rejected the accusations as “baseless and malicious,” also per CNBC.

“non-publicly” is doing a lot of work in that sentence. we will let you draw your own conclusions about what a country with DGSE and COMCYBER on the attribution team means by it.

it did not stop at France

CNBC reports that more supermarket fridges elsewhere in Europe were targeted in November, with stores in Belgium, Luxembourg, the Netherlands, Finland, Ireland and Sweden reporting losses, and that the French Blood Establishment (EFS) said cold storage temperature and defrost thresholds were “set to excessively high levels” in attacks on November 2. the C4 report does not attribute those later incidents. neither do we. other outlets are circulating larger country counts. we could not trace them to a primary source, so we are not repeating them.

the part about the fridges being on the internet

here is the thing nobody in a ministry will say at a podium. CERT-FR’s own alert from October, CERTFR-2026-ALE-012, opens with the observation that “exposing a management interface on the Internet is contrary to good practice.” its advice, in order: remove internet exposure from affected units and every unit on a public IP, check the whole configuration including defrost ranges, restore access only through a secure VPN or protected network, update firmware, use the vendor’s strict security mode, and change default passwords.

it also warns that keeping an end-of-life controller without security fixes on the internet means “a very high probability of compromise,” and that a factory reset alone is insufficient because the device “will certainly be compromised again.”

and one line in that alert says more about the state of OT than any attribution report: check your insurance contract terms before cutting the internet data feed to your refrigeration contractor. the fridge is on the internet because the maintenance contract and, sometimes, the insurance policy expect it to be.

so a state unit, per France, scanned with a commercial search engine, found refrigeration controllers on public IPs, and changed their settings through the web interface. CNBC quotes SE Labs CEO Simon Edwards asking “why were these fridges connected to the internet in the first place, and accessible without passwords?” that is the right question. sanctions do not answer it.

what operators should take from this

• search for yourself before FOFA does. C4 says the operators used FOFA. Shodan, Censys and FOFA all index refrigeration and building-management interfaces. if your store’s controller shows up there, assume it is on a target list.
• get the maintenance access off the open internet. CERT-FR’s interim answer, source-IP filtering to the refrigeration contractor, is explicitly called “not durable.” VPN or a protected network is the target state.
• alarm on the safety settings, not just the temperature. per CNBC, attackers disabled the over-temperature alerts. if the only thing watching the alarm thresholds is the device that was compromised, you have no alarm.
• EOL means replace. CERT-FR says resetting an EOL controller and putting it back online leads to re-compromise. budget for hardware.
• read your contracts. know what your refrigeration contractor and insurer require for remote monitoring, then negotiate it into a shape that does not involve a web UI on a public IP.

the industry part

for a decade OT security conferences have shown slides of internet-exposed controllers with default passwords and said “imagine if someone malicious did this.” someone did. at 700 sites, overnight, with fires. the response is diplomatic, legal and entirely appropriate. it will not take a single controller off the internet.

that part is still on the people who bought the fridges.

sources

• C4 (ANSSI, COMCYBER, DGA, DGSE, DGSI), CERTFR-2026-CTI-009, “Activités cyber offensives menées par des acteurs iraniens liés au CGRI” (dated November 9, 2026, TLP:CLEAR, in French; translations ours)
• France Diplomatie, “Declaration of attribution to Iran of cyber attacks against France” (November 10, 2026)
• CERT-FR, CERTFR-2026-ALE-012, refrigeration remote controller incident alert (October 12, 2026, last updated October 16, 2026)
• CNBC, “France blames Iran for supermarket refrigerator cyberattacks, weighs sanctions” (Jenni Reid, November 10, 2026), for the prosecutor’s details, Barrot’s comments, Iran’s response and the November incidents elsewhere in Europe