# France says Iran's Revolutionary Guards sabotaged 700 store fridges, names three commanders A government cyber report lays out its evidence and Paris opens a criminal inquiry. Barrot wants EU sanctions. Iran has not responded, and later attacks elsewhere remain unattributed. By 567 Politics staff · 567politics Published: 2026-11-09T20:12:18.574091Z Updated: 2026-11-09T20:12:31.033668Z Canonical: https://567politics.com/news/france-blames-iran-irgc-shahid-kaveh-supermarket-fridge-cyberattack-eu-sanctions-november-2026 Cite citation_url. Preserve source links, dates and qualifications. date_modified is an edit date, not proof that every claim was rechecked. Third-party images and quoted material retain their own rights. Resolve relative links against https://567politics.com/news/france-blames-iran-irgc-shahid-kaveh-supermarket-fridge-cyberattack-eu-sanctions-november-2026. France on Monday, November 9, 2026, publicly blamed Iran's Islamic Revolutionary Guard Corps (IRGC) for the cyberattack that heated up refrigeration systems in about 700 French food stores on the night of October 11 to 12. Foreign Minister [Jean-Noël Barrot](/politicians/jean-noel-barrot) said the government would seek sanctions at the European level. Paris prosecutors opened a judicial investigation against the named head of an IRGC hacking unit and his two deputies. France summoned Iran's ambassador. Iran had not publicly responded by Monday evening, according to [The Record](https://therecord.media/france-blames-iran-for-fridge-cyberattacks). The attribution answers one question that [567politics left open after a second European wave of fridge hacks](/news/europe-supermarket-refrigeration-cyberattacks-second-wave-november-2026) on November 2. It does not answer the rest. The French report covers only the October attack in France. It says nothing about the later attacks on stores in other European countries, and France's cyber agency chief said it is too early to link an attack on blood bank freezers to the same group. ## What France says happened, and who did it The core document is a five-page report from the government's Cyber Crisis Coordination Center, known as the C4. The center brings together the national cyber agency ANSSI, military cyber command, the DGA arms agency and the DGSE and DGSI intelligence services. The report was [published by CERT-FR](https://cert.cyber.gouv.fr/cti/CERTFR-2026-CTI-009/) on November 9 under the reference CERTFR-2026-CTI-009. According to [the report](https://cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-009.pdf), the C4 was alerted on October 12 to an attack on the cold-storage controllers of about 700 retail sites. Attackers changed the defrost settings so that equipment ran at high temperatures. That caused heavy losses of goods and, in at least 15 cases, fires. Most victims were large grocery groups, which the report names as Casino, Leclerc, Coopérative U, Metro, Carrefour and Intermarché. Smaller victims included several butcher shops, a slaughterhouse and cooperative food plants. The report also says the same attackers targeted Schneider Electric equipment at several small hydroelectric sites in France at the same time. It describes the effects there as moderate. The [Foreign Ministry's attribution statement](https://www.diplomatie.gouv.fr/fr/presse-et-ressources/decouvrir-et-informer/actualites/declaration-d-attribution-a-l-iran-de-cyber-attaques-visant-la-france) puts the food losses at "several tens of millions of euros." It calls the campaign the first cyberattack carried out on French soil "purely for sabotage." It names the attacker as the Shahid Kaveh unit, which it says belongs to the IRGC's Electronic and Cyber Center. Paris prosecutor Laure Beccuau gave a slightly different fire count. Her office described "about twenty" fires and said the attackers took remote control of the equipment through web interfaces, [franceinfo reported](https://www.franceinfo.fr/internet/securite-sur-internet/cyberattaques/cyberattaque-contre-des-frigos-de-supermarches-le-parquet-de-paris-ouvre-une-enquete-visant-une-unite-des-gardiens-de-la-revolution-iraniens_8274806.html). They started defrost cycles with no time limit and switched off the sensor alarms meant to warn when temperatures rose too high. The two figures are not necessarily in conflict, since the C4 says "at least 15," but readers should treat the exact number of fires as unsettled. ### The evidence France has made public The C4 lists four strands of evidence. Each is circumstantial on its own. France presents them together as a "set of clues." - **Shared infrastructure.** The servers used in the attack were also used, during the same period, to scan Schneider Electric equipment at small energy and water sites. The report says the scanning method, using the Modbus protocol on port 502, has been used by Shahid Kaveh since at least April 2026. - **A familiar tool.** The operators used a scanning service called FOFA. The report says this group habitually uses it. - **Propaganda.** An outlet called CyberbanNews, which the report links to Shahid Kaveh, relayed the attack from October 13. - **Language.** Investigators found traces of Farsi in the attack infrastructure. Prosecutor Beccuau added a fifth point. She said investigators found IP addresses that led back to devices located in Iran, according to franceinfo and [The Guardian](https://www.theguardian.com/world/2026/nov/09/france-blames-irans-revolutionary-guards-for-cyber-attacks-on-supermarket-fridges). This is more detail than governments often release with an attribution. It still falls short of proof that outside experts can test. Farsi text and Iranian IP addresses can in principle be planted, and shared tools can be reused. [BBC News](https://www.bbc.com/news/articles/cmg474vk6dyqo) noted that attribution of cyberattacks is "extremely hard" because hackers can hide their locations. France's case rests on the overlap of several indicators with a group its agencies say they have tracked for years. Independent researchers have not yet published their own analysis of the French data. ## The people France named The report's annex names three men. It lists Hamid Reza Lashgarian as head of the IRGC Electronic and Cyber Center, and Mahdi Lashgarian and Reza Salarvand as commanders of Shahid Kaveh. The prosecutor's investigation targets the head of Shahid Kaveh, his two deputies "and any other person who may be identified." The charges, as quoted by franceinfo, include fraudulent attacks on an automated data system by an organized group and damage by means dangerous to people by an organized group. Both are aggravated because they were allegedly committed "to serve a foreign power, in this case Iran." The prosecutor also cited conspiracy to prepare a crime. The Record reported that Beccuau has asked for international arrest warrants. None of the named men has been tried. The charges are allegations at the start of a judicial investigation. ### A unit with a record in the United States The report says Shahid Kaveh is best known through online personas that claim its attacks, including CyberAveng3rs, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front. It says the unit claimed a November 2023 campaign against the Israeli firm Unitronics, which makes industrial controllers used in the United States and Europe. It also says the unit claimed sabotage against Israeli and American industrial equipment, including Israeli refrigeration gear, in March and April 2026. The Record reported that U.S. agencies earlier this year identified Shahid Kaveh as another name for the CyberAv3ngers group. It said the U.S. State Department had offered rewards of up to $10 million for information on six IRGC officials tied to 2023 attacks on U.S. water utilities, a list that names both Lashgarians. Salarvand had not been publicly named before, according to The Record. ## France says this is part of a longer campaign The C4 report goes beyond the fridge attack. It attributes earlier operations against France to a second IRGC unit, Shahid Shoostari, which researchers also call Emennet Pasargad. ```diagram type: timeline title: Attacks France now attributes to IRGC cyber units source: [CERT-FR / C4 report](https://cert.cyber.gouv.fr/uploads/CERTFR-2026-CTI-009.pdf), [French Foreign Ministry](https://www.diplomatie.gouv.fr/fr/presse-et-ressources/decouvrir-et-informer/actualites/declaration-d-attribution-a-l-iran-de-cyber-attaques-visant-la-france) --- 2020: Shahid Shoostari plans an attack on Charlie Hebdo after it reprints cartoons of the Prophet 2023-01-04: Charlie Hebdo's online shop is defaced and its customer data taken 2024-07-20: A French video display firm is breached before the Paris Olympics 2026-03: The EU sanctions Emennet Pasargad over earlier attacks 2026-04: Shahid Kaveh scans Schneider Electric systems in France 2026-10-12: Fridge controllers at about 700 French sites are sabotaged overnight 2026-11-09: France names the IRGC and opens a judicial investigation ``` The report says the January 2023 defacement came on the day Charlie Hebdo was due to publish cartoons of Iran's then supreme leader, Ali Khamenei, in support of protests in Iran. It says that in July 2024 the attackers tried to use hacked display screens to show images condemning the participation of Israeli athletes in the Paris Games. The breach was found on July 25, before any images were shown. Investigators traced the images to a Persian-language Instagram account, two X accounts and an Iranian news site, and found two IP addresses belonging to Iranian internet providers. ## What France plans to do The Foreign Ministry statement lists three steps. France will summon Iran's ambassador to express its "firmest condemnation." It will propose new EU sanctions against Iranian entities and individuals involved in the fridge attack and other malicious cyber activity. And it "reserves the right" to take any further measure, "public and non-public," that it judges necessary and proportionate. Barrot spoke to reporters at a G7 meeting in Paris. "I am able to confirm that the Islamic Republic of Iran's Revolutionary Guards are responsible for this attack," he said, in The Guardian's translation. He called it an attack "of unprecedented scale and unprecedented aggression." He said Iran's ambassador had been summoned "to protest in the strongest possible terms." EU sanctions need the agreement of all member states. Kaja Kallas, quoted by [Politico Europe](https://www.politico.eu/article/france-blames-iran-for-cyberattacks-targeting-supermarket-fridges/), said she had "just heard" about the attribution. She said the matter would be discussed at next week's meeting of EU foreign ministers and that, if the attribution is confirmed, Europe's response "should be strong." EU food commissioner Christophe Hansen had earlier called the attacks a "deliberate attempt to disrupt our food supply chain," Politico reported. ## What the attribution does not cover Three questions remain open. **The second European wave.** Supermarket fridges in several other countries were hit on November 2, as 567politics reported last week. The Record said that wave reached at least 11 countries, including British meat suppliers. The French report does not address it, and none of those attacks has been attributed. [Deutsche Welle](https://www.dw.com/en/french-officials-blame-iran-for-supermarket-fridge-hacking/a-79903646) said it was not clear whether the incidents were connected. **The blood bank.** Three sites of France's national blood service, the EFS, were also targeted. ANSSI director general Vincent Strubel wrote that France was not taking a position on that attack "at this stage." "Even if the modus operandi is similar, nothing at present allows us to say it is the same attacker," he said, according to franceinfo. **Rival claims.** The BBC reported that two Russia-aligned hacktivist groups had claimed responsibility for attacks last week, though it said few believed them. Politico noted that some experts had suspected Russian involvement, which the Kremlin has denied. France's report does not mention Russia. ## Iran's side Iran's foreign ministry and its embassy in Paris did not immediately answer Politico's request for comment. Iran's mission to the United Nations did not return messages seeking comment, [NBC News reported](https://www.nbcnews.com/world/france/france-supermarket-cyberattacks-iran-revolutionary-guard-corps-accused-rcna608354). The Record said Iran "routinely denies" conducting malicious cyber operations and had not responded publicly by Monday evening. 567politics found no on-the-record Iranian statement about the French findings at publication time. This story will be updated if Tehran responds. The accusation lands during a tense period in Iran's relations with the West. Talks mediated by Qatar over [a possible U.S.-Iran deal](/news/iran-doha-talks-draft-proposal-hormuz-plan-november-2026) were under way, and [U.S. strikes on Qeshm Island](/news/us-limited-strikes-qeshm-island-iran-defensive-vance-progress-november-2026) were recent. There is no public evidence in the French report tying the fridge attack to those events, and the report does not suggest a motive. ## Why the target matters Grocery refrigeration is not usually treated as critical infrastructure in the way power grids or water plants are. The October attack exposed how many store systems can be reached over the internet. The BBC reported that the attackers first went after software from the Danish firm Danfoss. Franceinfo said they then reached systems from Dixell and Copeland. Deutsche Welle put the share of affected stores at about 700 of France's roughly 10,000 supermarkets. Gérôme Billois, a partner at the consulting firm Wavestone, told The Guardian that two countries "are known for this kind of attack: Iran and Russia." He warned that a state group with time and resources might move on from "easy equipment" to water or electricity systems. The C4's finding that the same infrastructure scanned small hydro and water sites gives that warning some grounding. It is still a forecast, not a finding. ## What to watch - **EU foreign ministers' meeting next week.** Whether member states agree to the sanctions France proposes, and how fast. - **Iran's response.** Whether Tehran denies the claims, ignores them or answers the ambassador's summons with its own protest. - **The other attacks.** Whether any government attributes the November 2 wave or the blood bank attempt. - **Arrest warrants.** Whether international warrants are issued for the three named men, who are not believed to be in France. ## Background and method This story is based on the C4 report and the Foreign Ministry statement, both read in full in French, along with reporting by franceinfo, The Record, The Guardian, the BBC, Deutsche Welle and Politico Europe. Translations from French are by 567politics unless a source's English translation is cited. Attribution claims in this story are France's claims, not independent findings. The investigation opened Monday is at an early stage, and no court has ruled on the allegations. Our [editorial standards](/editorial-standards) explain how we handle attributed claims and unanswered allegations. Background on the head of state is on our profile of [President Emmanuel Macron](/politicians/emmanuel-macron).