> France blames Iran for supermarket hack meltdowns

France has turned up the heat on Iran over destructive cyberattacks targeting refrigeration controllers at more than 700 grocery stores in October, spoiling food and sparking fires. The country vowed to take action using “all available means of response.” The supermarket attacks, which affected Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché groups, started at least 15 fires and caused food losses in the tens of millions of euros, according to a Monday report by France’s Cyber Crisis Coordination Centre (C4). The C4 includes the National Cybersecurity Agency of France, the Directorate General for External Security, the Directorate General for Internal Security, the Directorate General for Armament, and the Cyber Defence Command. “This is an unprecedented campaign in terms of its scale and level of aggressiveness, thus constituting the first cyber offensive campaign carried out purely for the purpose of sabotage on national territory,” France’s Ministry for Europe and Foreign Affairs said in a statement. All signs point to CyberAv3ngers Both the report and the statement attributed the refrigeration controller hacks to the Iranian Islamic Revolutionary Guard Corps’ (IRGC) Shahid Kaveh cyber unit. The Shahid Kaveh unit, which French national security officials say is led by Reza Salarvand and Mahdi Lashgarian, is better known by its hacktivist personas, including CyberAv3ngers. This is the same crew suspected of involvement in the July attacks that targeted more than 100 internet-exposed water systems in America. While the US government hasn’t attributed the intrusions to any country or group, private-sector security analysts blamed Iran, and specifically CyberAv3ngers. The IRGC-affiliated hacking crew has been breaking into industrial controllers for years, and in 2023, American national security and law enforcement agencies attributed a series of cyberattacks against "multiple" US water facilities to CyberAv3ngers. “The Iranian cyber threat against French interests is not new,” according to the Ministry for Europe and Foreign Affairs. “Iran has already carried out several destabilizing acts against us, notably targeting the weekly magazine Charlie Hebdo in 2023 and the organization of the Paris Olympic Games in 2024.” Since at least June 2024, the Shahid Kaveh unit has had the ability to scan, access, and control industrial control equipment from Schneider Electric, Siemens, and Rockwell, the French government said in its report. It pins the refrigeration controller hacks on this particular Iranian crew for a couple of reasons. Making the case for attribution First: the infrastructure used to carry out the October supermarket attacks was also used during this timeframe to conduct reconnaissance on Schneider Electric equipment, zeroing in on small- and medium-sized energy and water production units. “The techniques used during these actions are known to have been used by the Shahid Kaveh unit since at least April 2026,” the report says. It also notes that investigators found “traces of Farsi use” in the attack infrastructure. Plus, Iranian media outlet CyberbanNews, which is reportedly linked to the Shahid Kaveh unit, publicized the incidents that occurred late on October 11 and into October 12 extremely quickly: “as early as October 13.” In early November, similar cyberattacks on commercial refrigerators and freezers were reported across Europe, with grocery stores in Belgium, Ireland, Luxembourg, and Sweden reporting widespread food losses after miscreants spiked temperatures to as high as 122°F (50°C). Last week, the US federal government urged owners and operators to take security measures to prevent these types of attacks from spreading to America. France fights back The French government, for its part, said that it would “use all available means of response, including within the European Union and alongside its European and international partners, to anticipate, prevent, deter and respond to destabilizing and destructive actions targeting it in cyberspace.” This includes proposing additional EU sanctions against Iranian entities and individuals involved. France also vowed to express “its strongest condemnation of these cyberattacks” to the Iranian ambassador. However, the country didn’t rule out responding with more than just harsh words: “France reserves the right to take any additional measures, public and non-public, deemed necessary and proportionate to respond to these cyberattacks.” ®