France ties October supermarket fridge sabotage to Iran’s IRGC and seeks arrest warrants

Editor’s Note: France on Nov. 9 attributed the Oct. 11 to 12 sabotage of refrigeration controllers at about 700 large French retail sites to Shahid Kaveh, a cyber unit of Iran’s Islamic Revolutionary Guard Corps (IRGC), in a report by the government’s interministerial Cyber Crisis Coordination Center. The attackers set defrost cycles of unlimited duration and switched off temperature alarms, causing food losses and at least 15 fires. Paris prosecutors, investigating since Oct. 12, handed the case to investigating judges and requested international arrest warrants; no charges have been announced. Iran’s foreign ministry rejected the accusation as baseless and one-sided.

For cybersecurity, information governance and eDiscovery professionals, a named state actor changes post-incident work: controller, remote-access and network records held by retailers and contractors may carry the same kinds of traces prosecutors cite, and some insurance market model exclusions give weight to a government’s attribution, though attribution alone does not trigger them. France has not attributed a November wave that hit at least 11 European countries, including its blood service. Watch for EU sanctions on the officers France named, any attribution of the November wave and how insurers treat claims from both.

News Analysis – Cybersecurity Beat

France ties October supermarket fridge sabotage to Iran’s IRGC and seeks arrest warrants

ComplexDiscovery Staff

France on Nov. 9 attributed the Oct. 11 to 12 sabotage of refrigeration controllers at about 700 large French retail sites to Shahid Kaveh, a cyber unit of Iran’s Islamic Revolutionary Guard Corps (IRGC).

The same day, Paris prosecutors, who had taken up the case Oct. 12, moved it to investigating judges and requested international arrest warrants. Their release cites an attack method characteristic of the unit, traces of Farsi and IP addresses pointing to terminals in Iran, evidence gathered with the support of France’s specialized state services.

What the French report says happened

The five-page report, CERTFR-2026-CTI-009, comes from France’s interministerial Cyber Crisis Coordination Center (C4). Its members are ANSSI, the national cybersecurity agency; COMCYBER, the military’s cyber command; DGA, the defense procurement agency; and two intelligence services, the DGSE and DGSI. According to the report, attackers compromised the controllers during the night of Sunday, Oct. 11, and reset their defrost parameters to high temperatures, causing heavy merchandise losses and at least 15 fires.

The C4 said the victims were mainly large retailers, naming the Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché groups. It also listed several small butcher shops, a slaughterhouse and cooperative food plants, and it tied concurrent targeting of Schneider Electric equipment at small French hydroelectric installations to the same attack, with moderate effects.

The Paris prosecutor’s office supplied the mechanics in its own Nov. 9 release, naming Danfoss and Dixell as the targeted controller brands. The attackers took remote control through web interfaces to launch abnormal defrost cycles of unlimited duration while switching off the probe alarms meant to trigger above a set temperature. The prosecutor counted about 20 fires; because the C4 figure of at least 15 is a floor, the two counts are compatible.

ANSSI Director General Vincent Strubel separated the two brands in a LinkedIn post the same day. He said the roughly 700 sites ran Danfoss controllers, reached through their direct internet connections and weak passwords, and that a few dozen more sites with equipment he identified as Dixell/Copeland suffered a similar attack shortly afterward. His post presents France’s attribution as covering both the Danfoss and the Dixell/Copeland attacks.

France’s foreign ministry said food losses were estimated at several tens of millions of euros, and it called the operation the first cyber-offensive campaign carried out purely for sabotage on French territory.

Why investigators point to Shahid Kaveh

The report presents its case as a body of converging indicators. Infrastructure used in the attack was also used during the same period to reconnoiter Schneider Electric equipment over the Modbus protocol on port 502. The C4 says Shahid Kaveh has used that technique since at least April 2026. Operators also used FOFA, which the C4 calls a scanning tool and describes as habitually used by the unit’s intrusion set, the agency’s term for the tactics, code and infrastructure a group uses consistently over time. CyberbanNews, a propaganda outlet tied to the unit, relayed the attack from Oct. 13, and investigators found traces of Farsi in the attack infrastructure.

According to the report, Shahid Kaveh is led by Reza Salarvand and Mahdi Lashgarian and is known mainly through hacktivist personas, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front. An annex names Hamid Reza Lashgarian as head of the IRGC’s Electronic and Cyber Center (CEC), the parent body, and lists Mahdi Lashgarian and Salarvand as Shahid Kaveh commanders.

The report also assigns older operations to a sister unit, Shahid Shoostari, known in open sources as Emennet Pasargad. They include the January 2023 defacement of Charlie Hebdo’s online shop, with theft of the information in its database. They also include a compromise, beginning July 20, 2024, of a French video-display company whose screens the attackers tried to use for montages denouncing the participation of Israeli athletes in the Paris Olympics. The intrusion was found before any image appeared, the report said.

Sanctions, summons and a denial from Tehran

France’s top diplomat attached political weight to the technical findings. Foreign Minister Jean-Noël Barrot, speaking Nov. 9 at the G7 foreign ministers’ gathering in Paris, said, “This attack is unprecedented in both its scale and its level of aggression,” France 24 reported. The ministry’s Nov. 9 statement said France would summon Iran’s ambassador, and the ministry said the next morning that the ambassador had been received by its secretary-general, France 24’s French-language service reported. The statement also said France would propose to European partners new sanctions against Iranian entities and individuals involved in the attack and in other malicious cyber activity.

The EU listing the French statement cites concerns the sister unit, since the ministry said the bloc adopted sanctions in March 2026 against Emennet Pasargad, the open-source name for Shahid Shoostari. EU spokesman Anouar El Anouni said the bloc stood ready for a “swift and united response” once member states have conferred, according to France 24. As of Nov. 11, the Council of the EU’s press-release listing shows no new cyber-sanctions decision since the French attribution.

Tehran rejected the accusation on Nov. 10, when Iran’s foreign ministry said it “categorically rejects the French government’s baseless and one-sided accusations,” according to France 24 and AFP.

Prosecutors hand the case to investigating judges

The criminal track moves on a separate clock from the diplomatic one. Paris Prosecutor Laure Beccuau’s cybercrime section took up the attacks on its own initiative Oct. 12 under its national jurisdiction. On Nov. 9 it opened a judicial investigation, a French inquiry directed by investigating judges, into suspected fraudulent attacks on an automated data processing system and damage by means dangerous to persons. The release lists both as committed by an organized gang and aggravated by the aim of serving a foreign power, Iran, and adds participation in a criminal association to prepare a crime.

The prosecutor’s office has announced no charges against any individual. The investigation targets the head of Shahid Kaveh, his two deputies and anyone else identified, but the office neither names them nor maps those roles onto the C4 annex. The office requested international arrest warrants without stating how many, while France 24 reported that warrants were sought for two officials.

France’s anti-cybercrime office and the DGSI, working jointly, found an attack method characteristic of the unit, use of Farsi and IP addresses pointing to terminals located in Iran, the release said. For victims, that evidence list doubles as a preservation map, because the same kinds of traces may sit in records retailers and their contractors hold, where those records were kept.

Those records can include controller configurations and event histories, web-interface access logs, alarm-suppression records, remote-access logs kept by installers and maintenance firms, and firewall or VPN logs at the store edge. A joint U.S. government fact sheet dated Nov. 5, “US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems,” is offered for informational purposes and tells owners to enable and review logging. Where operational technology logs are missing or nonstandard, it says to capture network traffic between devices. Organizations expecting claims or litigation should scope a legal hold to identified custodians and systems, third-party maintainers included. The hold should be in place before log rotation or a factory reset overwrites the history investigators and insurers may ask about.

Insurance wordings treat attribution differently

Attribution also reaches the insurance file. Writing in Insurance Journal in October, three lawyers from the firm Zelle, two of whom say they represent insurers, and a forensic accountant said losses from the attack could fall under property cover, cyber cover, both or neither. They added that a state-actor attribution could lead insurers to invoke war or state-backed exclusions. The Lloyd’s Market Association (LMA) has published several model versions of such an exclusion, and they treat a government’s attribution differently.

The 2021 model, LMA5567, makes the main though not sole attribution test whether the government where the affected computer system sits blames another state. While that attribution is pending, it lets an insurer rely on an inference that is objectively reasonable and pay no loss. If the government takes an unreasonable time, does not attribute or says it cannot, the insurer must prove attribution from other evidence. The January 2023 revision, LMA5567A, instead has the insurer and insured weigh the objectively reasonable evidence available, which may include formal attribution by that government, and leaves the insurer’s burden of proof unchanged. A companion version issued the same day, LMA5567B, contains no attribution paragraph at all.

Attribution alone does not trigger any of these models. The 2023 versions exclude losses arising from war, from a cyber operation carried out as part of a war or its immediate preparation, or from a cyber operation that turns a state into an impacted state. That term means a state suffering a major detrimental impact on its security or defense, or on its functioning through disruption of an essential service such as financial, health or utility services. That limb carves out systems used by the insured or its providers that sit outside an impacted state.

Whether supermarket spoilage meets the major-impact test is a question these models leave to the facts, and French law adds a filter of its own. In the authors’ reading, French law likely governs the grocers’ policies, and it lets an insurer rely only on an exclusion that is “formelle et limitée,” or clear and narrowly drawn. That requirement comes from Article L113-1 of the French Insurance Code. ComplexDiscovery found no public disclosure of the affected retailers’ policy wordings and, as of Nov. 11, no public report of an insurer invoking a war or state-actor exclusion over the October attack.

A second wave without an official answer

The insurance question is harder for the organizations hit later. The Record reported that a second wave in early November hit at least 11 European countries, with victims ranging from British meat suppliers to three French blood service sites. It added that the C4 report does not address that wave.

French officials have kept the blood service case apart from the October attribution. Strubel addressed it directly, writing that France was not ruling at this stage on the Nov. 2 incident at the Établissement français du sang (EFS). Despite a similar method, he wrote, nothing yet shows it was the same attacker. The prosecutor’s cybercrime section, which opened a separate investigation into the blood service incident, told AFP on Nov. 10 that it could not confirm a link to the supermarket case at this stage.

The blood service came through with its stocks intact. The EFS said no health impact had been identified and no blood products were lost. Its deputy director general, Sophie Le Cam, credited monitoring systems independent of its refrigeration provider for the fast response, according to AFP. In Belgium, Katrien Eggers, a spokesperson for the Centre for Cybersecurity Belgium, told The Record on Nov. 2, “It is not known who is behind this attack, and it may never be possible to identify them.” The Nov. 5 U.S. fact sheet, from the Cybersecurity and Infrastructure Security Agency (CISA), the FBI and three other federal departments, urged operators to harden refrigeration controllers but named no actor.

As of Nov. 11, ComplexDiscovery found no government statement attributing the November wave, which leaves the organizations it hit with no government attribution to cite in a claim, a regulatory notice or a board report. Where a policy carries the 2021 LMA wording, that gap also matters for timing, because the clause lets an insurer withhold payment while attribution is pending. If the government delays unreasonably, declines or says it cannot attribute, the clause instead requires the insurer to prove attribution from other evidence. Under the 2023 LMA5567A wording, the parties can still weigh other objectively reasonable evidence. For now, the accurate description of the November incidents in the sources reviewed is that no government has publicly attributed them, even where the techniques resemble the October attack.

U.S. agencies already track the named unit

The October attribution, by contrast, names an actor U.S. agencies already track under another label. A joint advisory hosted by CISA, AA26-097A, was first published April 7, 2026, and updated July 22. It warns of ongoing Iranian-affiliated targeting of internet-connected industrial controllers, and its July update extended that warning to observed targeting of Schneider Electric and Siemens devices. Separately, the advisory says its authoring agencies previously reported similar activity by CyberAv3ngers, also known as the Shahid Kaveh Group, which it ties to what it calls the IRGC Cyber Electronic Command (CEC). The French report spells the persona CyberAveng3rs.

The French report says the unit has held scripts to scan, access and control industrial equipment from Schneider Electric, Siemens and Rockwell since at least June 2024, the same brands the U.S. advisory lists. The Treasury Department sanctioned six IRGC-CEC officials in February 2024, including Hamid Reza Lashgarian, whom it identified as the CEC’s head, and Mahdi Lashgarian. Salarvand was not among them, though Iran International, a Persian-language broadcaster, named and pictured him in September 2022 as head of a Shahid Kaveh sub-unit. Its reporting drew on material leaked by Lab Dookhtegan, which the C4 report describes as a group presenting itself as Iranian dissident hacktivists.

For U.S. grocers, cold-storage operators and the integrators that service them, the practical reading of the French findings and the U.S. guidance starts with internet exposure and default settings. Take controller web interfaces off the public internet and replace default credentials. Then set setpoint limits that keep equipment within safe ranges, alert on deviations and review who can disable alarms remotely, since the October attackers switched alarms off. The blood service’s experience suggests one more layer: temperature monitoring that does not depend on the refrigeration vendor’s own platform.

A defrost setpoint is routine maintenance data until a government names who changed it. In France it is now part of a criminal investigation, a potential fact in insurance disputes and a test of whether the EU moves from statements to sanctions listings over this attack. If the November wave is attributed next, will the organizations it hit have kept the records that prove which wave reached them?

News Sources

• Activités cyber offensives ciblant la France menées par des acteurs iraniens liés au CGRI (CERT-FR)
• Campagnes de déstabilisation et sabotage menées à l’encontre des intérêts français par la République islamique d’Iran (ANSSI)
• Déclaration d’attribution à l’Iran de cyberattaques visant la France (Ministère de l’Europe et des Affaires étrangères)
• CP: Cyberattaque frigos connectés (Parquet de Paris via LinkedIn)
• Imputation CGRI (Vincent Strubel, ANSSI, via LinkedIn)
• US Government Partners Urge Hardening Industrial Refrigeration and Cold Chain Monitoring Systems (CISA, FBI, HHS, USDA and DOT via IC3)
• Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (CISA)
• Treasury Sanctions Actors Responsible for Malicious Cyber Activities on Critical Infrastructure (U.S. Department of the Treasury)
• Press releases and statements (Council of the European Union)
• War, Cyber War and Cyber Operation Exclusion No. 4 (Lloyd’s Market Association, LMA5567, Nov. 25, 2021)
• War and Cyber Operation Exclusion No. 4 (Lloyd’s Market Association, LMA5567A, Jan. 18, 2023)
• War and Cyber Operation Exclusion No. 4 (Lloyd’s Market Association, LMA5567B, Jan. 18, 2023)
• Code des assurances (Légifrance, Article L113-1)
• France blames Iran for fridge cyberattacks, says some caused fires (The Record from Recorded Future News, Nov. 9, 2026)
• Second wave of suspected cyberattacks hits supermarket freezers across Europe (The Record from Recorded Future News, Nov. 2, 2026)
• France vows sanctions for supermarket hacks as Iran rejects ‘baseless accusations’ (France 24)
• Frigos victimes de cyberattaques : la France “ne s’interdit rien” dans la riposte contre l’Iran (France 24)
• Des chambres froides de l’Établissement français du sang victimes d’une cyberattaque d’un prestataire (AFP via France 24)
• Le parquet de Paris ouvre une enquête après la cyberattaque ayant touché des chambres froides de l’Etablissement français du sang (franceinfo with AFP)
• Another IRGC Cyber Warfare Commander Exposed (Iran International)
• The Cost of Losing Your Cool: Tallying the Losses of a Supermarket Cyberattack (Insurance Journal)

Assisted by GAI and LLM Technologies

Additional reading

• ENISA’s update advisory turns the patch pipeline into an evidence trail
• Britain’s cyber agency warns of a possible surge, and its own incident figures raise a question
• Supermarket freezer attacks reach at least six European countries, and the record linking them to US base failures stays thin
• Microsoft finds 2 North Korean groups using ARTEX, a tool that alone cannot name an attacker
• With over 40 percent of the record Binance theft frozen, getting it back becomes a legal project
• Estonia’s cyber authority saw no state-sector PHP crisis as three state institutions shut or restricted services
• AI recording spreads in Estonian health care as the regulator says the audio needs its own legal basis

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.