France says Iran's Revolutionary Guards sabotaged 700 store fridges, names three commanders

France on Monday, November 9, 2026, publicly blamed Iran's Islamic Revolutionary Guard Corps (IRGC) for the cyberattack that heated up refrigeration systems in about 700 French food stores on the night of October 11 to 12. Foreign Minister Jean-Noël Barrot said the government would seek sanctions at the European level. Paris prosecutors opened a judicial investigation against the named head of an IRGC hacking unit and his two deputies. France summoned Iran's ambassador. Iran had not publicly responded by Monday evening, according to The Record.

The attribution answers one question that 567politics left open after a second European wave of fridge hacks on November 2. It does not answer the rest. The French report covers only the October attack in France. It says nothing about the later attacks on stores in other European countries, and France's cyber agency chief said it is too early to link an attack on blood bank freezers to the same group.

What France says happened, and who did it#

The core document is a five-page report from the government's Cyber Crisis Coordination Center, known as the C4. The center brings together the national cyber agency ANSSI, military cyber command, the DGA arms agency and the DGSE and DGSI intelligence services. The report was published by CERT-FR on November 9 under the reference CERTFR-2026-CTI-009.

According to the report, the C4 was alerted on October 12 to an attack on the cold-storage controllers of about 700 retail sites. Attackers changed the defrost settings so that equipment ran at high temperatures. That caused heavy losses of goods and, in at least 15 cases, fires. Most victims were large grocery groups, which the report names as Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. Smaller victims included several butcher shops, a slaughterhouse and cooperative food plants.

The report also says the same attackers targeted Schneider Electric equipment at several small hydroelectric sites in France at the same time. It describes the effects there as moderate.

The Foreign Ministry's attribution statement puts the food losses at "several tens of millions of euros." It calls the campaign the first cyberattack carried out on French soil "purely for sabotage." It names the attacker as the Shahid Kaveh unit, which it says belongs to the IRGC's Electronic and Cyber Center.

Paris prosecutor Laure Beccuau gave a slightly different fire count. Her office described "about twenty" fires and said the attackers took remote control of the equipment through web interfaces, franceinfo reported. They started defrost cycles with no time limit and switched off the sensor alarms meant to warn when temperatures rose too high. The two figures are not necessarily in conflict, since the C4 says "at least 15," but readers should treat the exact number of fires as unsettled.

The evidence France has made public#

The C4 lists four strands of evidence. Each is circumstantial on its own. France presents them together as a "set of clues."

• Shared infrastructure. The servers used in the attack were also used, during the same period, to scan Schneider Electric equipment at small energy and water sites. The report says the scanning method, using the Modbus protocol on port 502, has been used by Shahid Kaveh since at least April 2026.
• A familiar tool. The operators used a scanning service called FOFA. The report says this group habitually uses it.
• Propaganda. An outlet called CyberbanNews, which the report links to Shahid Kaveh, relayed the attack from October 13.
• Language. Investigators found traces of Farsi in the attack infrastructure.

Prosecutor Beccuau added a fifth point. She said investigators found IP addresses that led back to devices located in Iran, according to franceinfo and The Guardian.

This is more detail than governments often release with an attribution. It still falls short of proof that outside experts can test. Farsi text and Iranian IP addresses can in principle be planted, and shared tools can be reused. BBC News noted that attribution of cyberattacks is "extremely hard" because hackers can hide their locations. France's case rests on the overlap of several indicators with a group its agencies say they have tracked for years. Independent researchers have not yet published their own analysis of the French data.

The people France named#

The report's annex names three men. It lists Hamid Reza Lashgarian as head of the IRGC Electronic and Cyber Center, and Mahdi Lashgarian and Reza Salarvand as commanders of Shahid Kaveh. The prosecutor's investigation targets the head of Shahid Kaveh, his two deputies "and any other person who may be identified."

The charges, as quoted by franceinfo, include fraudulent attacks on an automated data system by an organized group and damage by means dangerous to people by an organized group. Both are aggravated because they were allegedly committed "to serve a foreign power, in this case Iran." The prosecutor also cited conspiracy to prepare a crime. The Record reported that Beccuau has asked for international arrest warrants.

None of the named men has been tried. The charges are allegations at the start of a judicial investigation.

A unit with a record in the United States#

The report says Shahid Kaveh is best known through online personas that claim its attacks, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front. It says the unit claimed a November 2023 campaign against the Israeli firm Unitronics, which makes industrial controllers used in the United States and Europe. It also says the unit claimed sabotage against Israeli and American industrial equipment, including Israeli refrigeration gear, in March and April 2026.

The Record reported that U.S. agencies earlier this year identified Shahid Kaveh as another name for the CyberAv3ngers group. It said the U.S. State Department had offered rewards of up to $10 million for information on six IRGC officials tied to 2023 attacks on U.S. water utilities, a list that names both Lashgarians. Salarvand had not been publicly named before, according to The Record.

France says this is part of a longer campaign#

The C4 report goes beyond the fridge attack. It attributes earlier operations against France to a second IRGC unit, Shahid Shoostari, which researchers also call Emennet Pasargad.

1. 2020Shahid Shoostari plans an attack on Charlie Hebdo after it reprints cartoons of the Prophet
2. 2023-01-04Charlie Hebdo's online shop is defaced and its customer data taken
3. 2024-07-20A French video display firm is breached before the Paris Olympics
4. 2026-03The EU sanctions Emennet Pasargad over earlier attacks
5. 2026-04Shahid Kaveh scans Schneider Electric systems in France
6. 2026-10-12Fridge controllers at about 700 French sites are sabotaged overnight
7. 2026-11-09France names the IRGC and opens a judicial investigation

Source: CERT-FR / C4 report, French Foreign Ministry

The report says the January 2023 defacement came on the day Charlie Hebdo was due to publish cartoons of Iran's then supreme leader, Ali Khamenei, in support of protests in Iran. It says that in July 2024 the attackers tried to use hacked display screens to show images condemning the participation of Israeli athletes in the Paris Games. The breach was found on July 25, before any images were shown. Investigators traced the images to a Persian-language Instagram account, two X accounts and an Iranian news site, and found two IP addresses belonging to Iranian internet providers.

What France plans to do#

The Foreign Ministry statement lists three steps. France will summon Iran's ambassador to express its "firmest condemnation." It will propose new EU sanctions against Iranian entities and individuals involved in the fridge attack and other malicious cyber activity. And it "reserves the right" to take any further measure, "public and non-public," that it judges necessary and proportionate.

Barrot spoke to reporters at a G7 meeting in Paris. "I am able to confirm that the Islamic Republic of Iran's Revolutionary Guards are responsible for this attack," he said, in The Guardian's translation. He called it an attack "of unprecedented scale and unprecedented aggression." He said Iran's ambassador had been summoned "to protest in the strongest possible terms."

EU sanctions need the agreement of all member states. Kaja Kallas, quoted by Politico Europe, said she had "just heard" about the attribution. She said the matter would be discussed at next week's meeting of EU foreign ministers and that, if the attribution is confirmed, Europe's response "should be strong." EU food commissioner Christophe Hansen had earlier called the attacks a "deliberate attempt to disrupt our food supply chain," Politico reported.

What the attribution does not cover#

Three questions remain open.

The second European wave. Supermarket fridges in several other countries were hit on November 2, as 567politics reported last week. The Record said that wave reached at least 11 countries, including British meat suppliers. The French report does not address it, and none of those attacks has been attributed. Deutsche Welle said it was not clear whether the incidents were connected.

The blood bank. Three sites of France's national blood service, the EFS, were also targeted. ANSSI director general Vincent Strubel wrote that France was not taking a position on that attack "at this stage." "Even if the modus operandi is similar, nothing at present allows us to say it is the same attacker," he said, according to franceinfo.

Rival claims. The BBC reported that two Russia-aligned hacktivist groups had claimed responsibility for attacks last week, though it said few believed them. Politico noted that some experts had suspected Russian involvement, which the Kremlin has denied. France's report does not mention Russia.

Iran's side#

Iran's foreign ministry and its embassy in Paris did not immediately answer Politico's request for comment. Iran's mission to the United Nations did not return messages seeking comment, NBC News reported. The Record said Iran "routinely denies" conducting malicious cyber operations and had not responded publicly by Monday evening. 567politics found no on-the-record Iranian statement about the French findings at publication time. This story will be updated if Tehran responds.

The accusation lands during a tense period in Iran's relations with the West. Talks mediated by Qatar over a possible U.S.-Iran deal were under way, and U.S. strikes on Qeshm Island were recent. There is no public evidence in the French report tying the fridge attack to those events, and the report does not suggest a motive.

Why the target matters#

Grocery refrigeration is not usually treated as critical infrastructure in the way power grids or water plants are. The October attack exposed how many store systems can be reached over the internet. The BBC reported that the attackers first went after software from the Danish firm Danfoss. Franceinfo said they then reached systems from Dixell and Copeland. Deutsche Welle put the share of affected stores at about 700 of France's roughly 10,000 supermarkets.

Gérôme Billois, a partner at the consulting firm Wavestone, told The Guardian that two countries "are known for this kind of attack: Iran and Russia." He warned that a state group with time and resources might move on from "easy equipment" to water or electricity systems. The C4's finding that the same infrastructure scanned small hydro and water sites gives that warning some grounding. It is still a forecast, not a finding.

What to watch#

• EU foreign ministers' meeting next week. Whether member states agree to the sanctions France proposes, and how fast.
• Iran's response. Whether Tehran denies the claims, ignores them or answers the ambassador's summons with its own protest.
• The other attacks. Whether any government attributes the November 2 wave or the blood bank attempt.
• Arrest warrants. Whether international warrants are issued for the three named men, who are not believed to be in France.

Background and method#

This story is based on the C4 report and the Foreign Ministry statement, both read in full in French, along with reporting by franceinfo, The Record, The Guardian, the BBC, Deutsche Welle and Politico Europe. Translations from French are by 567politics unless a source's English translation is cited. Attribution claims in this story are France's claims, not independent findings. The investigation opened Monday is at an early stage, and no court has ruled on the allegations. Our editorial standards explain how we handle attributed claims and unanswered allegations. Background on the head of state is on our profile of President Emmanuel Macron.

Differing perspectives

How should France and the EU respond after Paris attributed the October fridge attacks to Iran's Revolutionary Guards?

Each position is summarized as its supporters make it, with equal weight and in alphabetical order. A summary is not an endorsement; the evidence for each is weighed in the story above.

• Attribute only what the evidence shows

  Who holds it: ANSSI director general Vincent Strubel

  Strubel says France is not taking a position yet on the attack on blood bank freezers. He says that even if the method looks similar, nothing so far allows officials to say it was the same attacker. The position holds that each attack should be attributed on its own evidence, so the October finding is not stretched to cover later incidents in France or elsewhere in Europe.

  In their words: franceinfo ↗

• Confirm the attribution, then respond strongly

  Who holds it: Kaja Kallas, senior EU official, as quoted by Politico Europe

  Kallas says she had only just heard of the French attribution and that EU foreign ministers will discuss it at their meeting next week. She says that if the attribution is confirmed, Europe's response should be strong. The approach treats a joint EU reaction as stronger than a national one, but ties it to a shared review of France's findings first.

  In their words: Politico Europe ↗

• Harden water and power systems next

  Who holds it: Gérôme Billois, cybersecurity partner at Wavestone

  Billois says Iran and Russia are the two countries known for this kind of attack. He argues that a state group with means, determination and time has so far hit easy equipment, and that France should prepare for attacks on other systems such as water or electricity. The emphasis is on defending exposed industrial controls, whatever diplomatic steps follow.

  In their words: The Guardian ↗

• Impose EU sanctions now

  Who holds it: French Foreign Minister Jean-Noël Barrot and the French government

  The government argues that the attack was the first purely sabotage-driven cyber campaign on French soil and caused fires and losses of several tens of millions of euros. It says the attacks break international law and UN norms Iran has endorsed. It wants new EU sanctions on the Iranian people and entities involved, has summoned Iran's ambassador and reserves the right to take further public and non-public measures.

  In their words: French Ministry for Europe and Foreign Affairs ↗

{{cite news |title=France says Iran's Revolutionary Guards sabotaged 700 store fridges, names three commanders |url=https://567politics.com/news/france-blames-iran-irgc-shahid-kaveh-supermarket-fridge-cyberattack-eu-sanctions-november-2026 |work=567politics |author=567 Politics staff |date=2026-11-09 |language=en}}

{
  "id": "https://567politics.com/news/france-blames-iran-irgc-shahid-kaveh-supermarket-fridge-cyberattack-eu-sanctions-november-2026",
  "type": "article-newspaper",
  "title": "France says Iran's Revolutionary Guards sabotaged 700 store fridges, names three commanders",
  "URL": "https://567politics.com/news/france-blames-iran-irgc-shahid-kaveh-supermarket-fridge-cyberattack-eu-sanctions-november-2026",
  "container-title": "567politics",
  "language": "en",
  "author": [
    {
      "literal": "567 Politics staff"
    }
  ],
  "issued": {
    "date-parts": [
      [
        2026,
        11,
        9
      ]
    ]
  }
}

<iframe src="https://567politics.com/embed/news/france-blames-iran-irgc-shahid-kaveh-supermarket-fridge-cyberattack-eu-sanctions-november-2026?theme=auto" title="France says Iran's Revolutionary Guards sabotaged 700 store fridges, names three commanders by 567politics" width="100%" height="440" style="border:0;max-width:100%" loading="lazy"></iframe>
<p style="font-size:14px">France says Iran's Revolutionary Guards sabotaged 700 store fridges, names three commanders by <a href="https://567politics.com/news/france-blames-iran-irgc-shahid-kaveh-supermarket-fridge-cyberattack-eu-sanctions-november-2026" rel="nofollow">567politics</a></p>
<script async src="https://567politics.com/embed.js"></script>