France Attributes Fridge Cyberattacks to IRGC Shahid Kaveh

France’s cyber crisis cell has attributed the October supermarket fridge cyberattacks to Shahid Kaveh, an offensive unit inside Iran’s Islamic Revolutionary Guard Corps electronic and cyber centre. The CERT-FR technical report (CERTFR-2026-CTI-009, first version 9 November 2026) and a parallel foreign ministry attribution statement were published the same day. ANSSI summarised the findings in a five-post thread on X.

The story that matters for operators is the response path: public attribution, a judicial investigation with requested international arrest warrants, a summons for Iran’s ambassador in Paris, and a French push for further EU sanctions. The overnight sabotage of industrial refrigeration controllers remains the fact pattern; this piece centres on how France is answering it, not on replaying the attack.

What C4 and the foreign ministry attributed

The Centre de Coordination des Crises Cyber (C4)—ANSSI, COMCYBER, DGA, DGSE and DGSI—says it can attribute destabilisation attacks against French interests to the Shahid Shoostari and Shahid Kaveh units operating inside the IRGC’s electronic and cyber centre (CGRI-CEC). French quotes below are TSN’s translations.

CERT-FR describes the 11–12 October hit on industrial refrigeration controllers as “an unprecedented attack by its scale and level of aggressiveness.” The report says about 700 retail sites were affected after defrost settings were forced to high temperatures, causing heavy stock losses and, in at least 15 cases, fires. The foreign ministry separately says controllers were hit across “more than 700” large-retail sites, with considerable material damage, fire outbreaks and food losses estimated at several tens of millions of euros. French press citing the Paris prosecutor has used “about twenty” fires; that figure is the prosecutor’s as reported by outlets such as ZDNet, not the CERT-FR count. Keep each figure attached to the body that published it.

The ministry calls the October wave “the first cyber-offensive campaign operated purely for sabotage purposes on national territory.” It attributes those destructive acts to Shahid Kaveh. CERT-FR also links Shahid Shoostari to earlier destabilisation activity against Charlie Hebdo in 2023 and a Paris 2024 video-display firm during the Olympics period. Named commanders appear in the report’s annex as covered by press summaries of that annex; those names sit in the report’s attribution language, not as courtroom findings.

ANSSI’s fifth post says the Paris prosecutor’s office has opened a judicial investigation and requested international arrest warrants against several Shahid Kaveh members. The foreign ministry says France will summon Iran’s ambassador and will propose new EU sanctions against Iranian entities and individuals tied to this attack and other malicious cyber activity. As of the 9 November sources, Iran had not publicly responded.

Scope: France’s October wave only

This attribution covers France’s October refrigeration wave. It does not, on the documents published 9 November, extend to later refrigeration incidents reported in Belgium, Sweden or the UK. TSN’s earlier coverage of how supermarket refrigeration attacks spread in Europe (3 November) and of the original French case, prosecutors’ estimate of about 700 victims, remains the chronology for those waves. US agencies’ separate industrial refrigeration cyber warnings sit beside the French attribution as defensive guidance, not as part of the IRGC finding.

Defence first: exposed controllers and basic hygiene

ANSSI and partner guidance around the October events has already pointed operators at internet-exposed refrigeration controllers, patching and segmentation—the unglamorous controls that decide whether a compromised PLC becomes a fire risk. That is the durable lesson for UK and European retailers running the same controller classes: inventory what is reachable from the internet, remove or gate management interfaces, and treat defrost and temperature set-points as safety-critical parameters, not convenience settings.

Attribution is a tool; hygiene is the daily work

Public attribution plus warrants and proposed sanctions are how France is trying to raise the cost of sabotage against soft industrial targets. They do not replace the configuration mistakes that made hundreds of supermarket sites reachable in a single night. Readers should keep three lines separate. The CERT-FR fire count is “at least 15.” The prosecutor’s “about twenty,” where reported, is a different source. The IRGC/Shahid Kaveh finding applies to France’s October wave as stated on 9 November—not to every later European refrigeration incident.

For UK and EU retailers the compliance lesson is dull and expensive: cold-chain PLCs belong on the same asset register as payment systems, with network exposure treated as a safety defect rather than an IT inconvenience. Boards that only fund “advanced threat” tools while leaving Modbus interfaces on the public internet are buying the wrong half of the problem.

The next evidence to watch is whether EU partners take up the sanctions proposal, whether the requested warrants produce identifiable arrests, and whether retailers publish concrete counts of internet-exposed controllers removed after the October wave. Until those land, the operational priority stays the same: shrink the attack surface on cold-chain controllers before the next opportunistic scan.

Sources

• CERT-FR: CERTFR-2026-CTI-009 (9 November 2026)
• French foreign ministry: attribution declaration (9 November 2026)
• ANSSI on X, 9 November 2026

Related stories

Supermarket refrigeration attacks spread as Belgium issues fix advice is the nearest earlier TSN fridge post and the right next read for how the European wave unfolded after France’s October night.